Home
Microsoft Exchange 2003 – Troubleshooting Event IDs

Microsoft Exchange 2003 – Troubleshooting Event IDs

July 2, 2004 No Comments Exchange 2003

Introduction to Exchange 2003 – Troubleshooting Event ID

The bad news – I cannot cure every Event ID error.  The good news, I will show you how to cure your own problems.

Topics for Troubleshooting Event ID in Exchange 2003

 ♠

Developing a winning method

I want to explain my methods and thought process for dealing with Exchange 2003 problems.  Troubleshooting Event IDs is like solving a ‘Who dunit murder’.  You apply the standard formula of collecting the evidence, rounding up the suspects and delivering your verdict.  There are two beliefs that help me through difficult cases;

a) someone has had this problem before
b) I will find that reference and repair my Exchange server.

Exchange Monitor from SolarWindsGuy Recommends: The SolarWinds Exchange Monitor

Here is a free tool to monitor your Exchange Server.  Download and install the utility, then inspect your mail queues, monitor the Exchange server’s memory, confirm there is enough disk space and check the CPU utilization.

This is the real deal – there is no catch.  SolarWinds provides this fully-functioning freebie, as part of their commitment to supporting the network management community.

Free Download of SolarWinds Exchange Monitor

Application Log Application Log Filter Event Source Exchange 2003

The best place to look for clues is in the Application Log.  One useful trick is to filter on Event Source.  In the case of Exchange 2003, here are useful Event Sources: ESE, MSExchangeIS (Store) and MSExchangeSA (System Attendant).

Once you have located the suspicious Event ID search for references in TechNet.  For Example Event 9582.  This returns about 25 entries, which I then filter on the Location column so that I can see which articles feature Exchange 2003.

TechNet always uses the same formula

Soon you will be an expert.  All you have to do is detect the crucial entry in the Event Viewer and then search for the event ID number in TechNet.  TechNet always presents the answer using the same formula:

Applies to (Exchange 2003)

Symptoms – Store stops.
Event ID is the same as mine = 9582. 
Event type is Error, again mine matches TechNet. 

Cause – Someone has opened over 50 messages in Outlook.

Resolution – Close Outlook, or restart the Store (Dismount then Mount the affected Store).  Further action check to see if a program or virus is automatically opening all these messages.

Guy Recommends: SolarWinds Free Wake-On-LAN UtilitySolarwinds Wake-On-LAN

Encouraging computers to sleep when they’re not in use is a great idea – until you are away from your desk and need a file on that remote sleeping machine!

WOL also has business uses for example, rousing machines so that they can have update patches applied.  My real reason for recommending you download this free tool is because it’s so much fun sending those ‘Magic Packets’. Give WOL a try – it’s free.

Download your free copy of SolarWinds Wake-On-LAN

Confirmation of Your solution

There is a different TechNet reference for Event ID 9582, Event Type WARNING.  Remember, my error was Event Type Error.  So, I always try and pay attention to detail and make sure I have a genuine match between my problem and the reference article.

Naturally, there is the ultimate proof, did the suggested solution cure your error?  If not then extend your search to Google instead of TechNet.  The internet is full of independent forums and sites like this with extra insights into Exchange 2003 problems.

Summary

What is important is learning a troubleshooting method that you can apply to any Exchange 2003 problem.  Think of this page not so much as me giving you a fish to feed for a day, but teaching you fishing so that you will be self sufficient. 

See Also

If you like this page then please share it with your friends

 

About The Author

Guy Thomas

Related Posts