Troubleshooting MSExchange Information Store Errors

Diagnosing and resolving issues with Microsoft Exchange server can be frustrating at times. Reviewing the error codes and logs is the best way to start diagnosing what the problem is before you start any resolutions.

Oftentimes administrators will find that after an upgrade they begin to experience problems that previously did not exist. For instance, after having installed Microsoft Exchange Server 2003 Service Pack 1 (SP1), administrators may find that the Microsoft Exchange Information Store service periodically crashes. Administrators should begin their diagnostic process by reviewing the system event logs. They may find that one or more events may be recorded in the system event log on the server similar to the following event error messages:

Event 1
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date:
Time:
User:  N/A
Computer: Computer_Name
Description:
The Microsoft Exchange Information Store service terminated unexpectedly.  It has
done this 1 time(s).
Event2
Event Type:  Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date:
Time:
User:  N/A
Description:
Faulting application store.exe, version 6.5.7226.3, stamp 407db771, faulting module exchmem.dll, version 6.5.7226.0, stamp 406d29b4, debug? 0, fault address 0x00004e3e.

There can be multiple reasons why these error messages are produced. One possible reason for this error message is if there is a malformed email message or other malformed item in the information store.

Fortunately there is a hotfix available which includes support for these event IDs, 7034 and 1000. The hotfix should be applied only to systems that are having this particular problem. The hotfix can be obtained from the Microsoft Customer Service and Support center.

Another issue that can cause many problems is when the Information Store crashes. When the Information Store crashes an error code will get logged in the event log which may look like this:

Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9659
Date:
Time:
User:  N/A
Computer: EXCH
Description:
The Microsoft Exchange Information Store encountered an unexpected exception 0xC0000005 at address 00412CAB while processing a request for user (some username).
For more information, click http://www.microsoft.com/contentredirect.asp.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 45 00 63 00 44 00 6f 00   E.c.D.o.
0008: 52 00 70 00 63 00 45 00   R.p.

An administrator should check if any anti-virus software running on the Exchange server is allowed to scan the transaction logs. There have been reported problems when anti-virus software is scanning the log files during backup commit actions.

It should be noted that the 9659 event ID indicates a general event. The best practice would be to collect and analyze the dump files to isolate what caused the event code.

Another reason for this error code to get logged is if there is a corrupted message in a Microsoft® Exchange Server mailbox. As you can see from the logged error message above the error message includes the name of the user who has a corrupted message in their mailbox. Knowing this information allows an administrator to work backwards through the messages in the inbox for that user and isolate which email caused the error.

Sometimes the error code message received will look similar to the following:

Event ID : 9659
Source : MSExchangeIS
Type : Error
Description : The Microsoft Exchange Information Store encountered an unexpected exception 0xC0000005 at address <address> while processing a request for user <OTHER_SERVER$>.

If you receive this message then the Store.exe process has most likely stopped responding on the system that is running Microsoft Exchange Server 2007.

The solution to this problem is to install Update Rollup 1 for Exchange Server 2007 Service Pack 1. More information about this Update Rollup can be obtained at the site: Description of Update Rollup 1 for Exchange Server 2007 Service Pack 1

If you have the release version of Exchange Server 2007 then an administrator can install Update Rollup 6 for Exchange Server 2007.

If further analysis is needed then an administrator can review the Application log and System log. Search for related Warning events or Error events that come before or after MSExchangeIS event 9659. There will be more details about these events which can help identify the root cause of these errors.

Lastly, diagnostic logging can be increased on the MSExchangeIS and MSExchangeTransport components for more information. Review the Microsoft Knowledge Base article 821912, “How to Collect Diagnostic Data to Help Troubleshoot Information Store Issues” for help with increasing the logging levels.

Written by Mike Rede

Leave A Reply