KB 887809 System Attendant unexpected shutdowns
I have a W2k3, Exchange 2003 SP2 DC. It used to be an SBS server, and a Transition pack was installed to get it to W2K3 standard and Exchange 2003 Standard. The problem I am having is MSExchangeSA will throw up an event ID 1031, (One of the System Attendant's task is blocked. Function: CMonitoring Task::Work). Then shortly after MSExchangeAL Event ID 8026, (LDAP Bind was unsuccessful on directory <servername>.<Domain>.local for distinguished name". Directory returned error:[0x51] Server Down. DC=xxx,DC=local. This usually happens between 11:00pm-5:00am at night, but it did happen once during the day. In my hours of research I have found KB 887809 which seems to fit the situation. I found the file versions in my server are: msallog.dll 6.5.6944.0 (older) Abv_dg.dll 6.5.7638.1 (newer sp2) I thought I could run the hotfix and ugrade the msallog.dll, but it said it could not because of SP2. I did a little more research and found Exchane 2003 SP2 was suppose to fix this also. I could not find an upgraded file in the SP2. When this happens, the server basically freezes all services with Exchange. I have to stop services with Task manager, and then power down the server to get it to resume working. The Restart and Shutdown will hang forever, and not work. Does any one have any ideas? Should I rerun SP2 to see if it fixes this? Thanks Randy
October 22nd, 2010 10:30am

That's what I would do, reapply SP2. But I can't promise that it'll fix anything.Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
Free Windows Admin Tool Kit Click here and download it now
October 22nd, 2010 2:51pm

As ED as indicated , please reapply service pack 2 as the msallog.dll is at pre exchange 2003 service pack level. Also ensure you need to reapply all the other updates you have applied after service pack 2. Als please run ExBpa to find any other relevant data, The Kb's mentioned might be helpful in case http://www.eventid.net/display.asp?eventid=1031&eventno=3446&source=MSExchangeSA&phase=1
October 22nd, 2010 7:39pm

Ed & Khoj: I really appreciate the response. I have reinstalled: SP2 first then KB916803, KB912442, KB911829, KB924334, KB931832, KB950159, KB959897, KB926666-HOTFIX, KB976702, all in the order that they were created, and my msallog.dll is still the same version, 6.5.6944.0, that I started with. Several of the dll's have been updated, but not msallog.dll. I cannot even find the latest version info or an update that shows this file besides KB887809 and it will not go in because of SP2 being installed. I would appreciate any Help Randy P.S. I have run EXBP and corrected and small descrepencies I found.
Free Windows Admin Tool Kit Click here and download it now
October 23rd, 2010 11:58am

I don't have an Exchange 2003 SP2 server I can look at, but SPs don't replace all files. Are you sure that file is supposed to be a newer version?Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
October 23rd, 2010 4:36pm

Ed I don't know about SP2, because I have not been able to find the documents saying that SP2 actually replaces it, But I have downloaded KB887809 which does have newer versions tha I do, Date Time Version Size File name -------------------------------------------------------------- 04-Nov-2004 09:49 6.5.7232.49 584,192 Abv_dg.dll 04-Nov-2004 09:49 6.5.7232.49 1,185,280 Msallog.dll But you cannot have SP2 installed before you run this hotfix. This Dll is a lot newer than mine. How can I put it in? Randy
Free Windows Admin Tool Kit Click here and download it now
October 23rd, 2010 8:05pm

I still have the problem: Here are some more error events in the order that they seem to happen: 1. MSExchangeSA Event ID 1031 One of the System Attendant's task is blocked. Function: CMonitoringTask::Work 2. MSExchangeDSaccess Event ID 2115 Process IISIPM660260FA-5922-4308-AC07-EEE0EA7F9542 -AP "EXCHANGEAPPLICATIONPOOL (PID=7292). DSAccess needs to close a connection to the Domain Controller xxx.xxx.local due to error 0x80040952 (LDAP_LOCAL_ERROR (Client-side internal error or bad LDAP message)). 3. MSExchangeDSaccess Event ID 2115 Process INETINFO.EXE (PID=1860). DSAccess needs to close a connection to the Domain Controller xxx.xxx.local due to error 0x80040920 (LDAP_NO_SUCH_OBJECT). 4. MSExchangeDSaccess Event ID 2115 Process INETINFO.EXE (PID=1860). DSAccess needs to close a connection to the Domain Controller xxx.xxx.local due to error 0x80040920 (LDAP_NO_SUCH_OBJECT). 5. MSExchangeDSaccess Event ID 2115 Process STORE.EXE (PID=3312). DSAccess needs to close a connection to the Domain Controller xxx.xxx.local due to error 0x80040920 (LDAP_NO_SUCH_OBJECT). 6. MSExchangeAL Event ID 8026 LDAP Bind was unsuccessful on directory ikbi-sbs.IKBI.local for distinguished name ''. Directory returned error:[0x51] Server Down. DC=IKBI,DC=local 7. MSExchangeDSaccess Event ID 2107 Process STORE.EXE (PID=3312). DSAccess failed to obtain an IP address for DS server ikbi-sbs.IKBI.local, error 11004 (WSANO_DATA (The requested name is valid and was found in the database, but it does not have the correct associated data being resolved for.)). This host will not be used as a DS server by DSAccess. This all happens within about 14-16 minutes and the server is not down but froze up. It takes a reboot to get it active again. Please Help Randy
October 25th, 2010 9:20am

Ed & Koj: I think we have found the solution. I called Microsoft and after 2 days with the Exchange group and finding nothing, they passed me off to the Performance Team, which downloaded some specialized tools to diagnose the system and gather logs. After a day of gathering logs, and 2 days of diagnosing them, they recommended 2 things. 1. to set the \userva switch in the boot.ini to \userva=2800 instead of \userva=3030. 2. to update or remove Trend Micro antivirus. I did this Saturday morning and I have not had any more errors, or a locked up system since then. i actually put in a new service pack for Trend Micro instead of disabling it. After the remote agents were updated and rebooted I had no more errors. I am not sure if the restore from image or an update changed something that caused Trend to go crazy. I am trying to see if Microsoft saw a smoking gun in all the logs that were pulled. I will post any extra details I can find later. Randy
Free Windows Admin Tool Kit Click here and download it now
November 1st, 2010 11:48am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics