none
Event ID 3028 MSExchangeApplicationLogic RRS feed

  • Frage

  • Hi,

    I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

    I can't seem to find any articles or blogs relating to this issue.

    Thanks for any help.

    Montag, 3. November 2014 09:16

Alle Antworten

  • What cumulative update is installed?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

    • Als Antwort vorgeschlagen WieseLD Donnerstag, 26. Juli 2018 18:34
    Montag, 3. November 2014 17:42
    Moderator
  • Hi,

    Please delete the file killbit.xml and then perform IIS reset to check result.

    Here is a related thread for your reference.

    https://social.technet.microsoft.com/Forums/en-US/feff98cb-5b48-4537-b86b-8dcf41cb9992/event-id-3028-msexchangeapplcationlogic

    Hope this is helpful to you.

    Best regards,


    Belinda Ma
    TechNet Community Support

    Dienstag, 4. November 2014 05:15
    Moderator
  • Thank you for your reply.

    The Exchange is 15.0.995.29 which is CU6


    Atis Smits

    Dienstag, 4. November 2014 15:03
  • I tried to delete the killbit.xml file and reset the IIS. First no event was recorded and I thought that the issue has been solved but unfortunately the event was logged again with re-occurrence after 12 hours this time instead of every 6 hours as it was earlier and is now.

    Atis Smits

    Donnerstag, 6. November 2014 09:19
  • Hi,

    Please run handle.exe on killbit.xml and check if there is any process using it.

    And please check if there is Antivirus scan running. If there is, please disable it temporarily to check result.

    Best regards,


    Belinda Ma
    TechNet Community Support

    • Als Antwort markiert Belinda MaModerator Freitag, 14. November 2014 08:41
    • Tag als Antwort aufgehoben atissmits Freitag, 13. März 2015 11:45
    Montag, 10. November 2014 02:07
    Moderator
  • Hello, same problem here.

    Fresh install of Win 2012 R2 + Exchange 2013 SP1 updated to CU7 in the VM, no antivirus.

    I've got six times per day ID 3028 Warning

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1044.25\ext\killbit\killbit.xml' because it is being used by another process.

    I have already tried to delete killbit.xml and restart IIS but the problem persists.

    Handle.exe doesn't show anything.

    Do you have any suggestion?

    Regards,
    M.

    Montag, 22. Dezember 2014 08:19
  • I also see this about 6 to 8 times a day.  Also a fresh install of EX2013 CU7. No AV.
    Freitag, 2. Januar 2015 18:05
  • Exactly the same problem here (fresh install EX2013 CU7, no AV)

    Anyone found a solution meanwhile?

    Montag, 23. Februar 2015 09:51
  • Same issue, new install Ex2013 CU6 no AV on VM.
    Every 6 hours

    Samstag, 28. Februar 2015 21:22
  • @Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!

    I kindly ask you to remove that tagging.

    Samstag, 28. Februar 2015 21:49
  • Hi all,

    Any update about this KillBit issue ?

    I have the same issue also after upgrading to CU7 of Exchange 2013.

    Thx,

    Michaël

    Freitag, 13. März 2015 11:14
  • Did not help

    Atis Smits

    Freitag, 13. März 2015 11:46
  • Did not help

    Atis Smits

    Freitag, 13. März 2015 11:47
  • Have done that

    Atis Smits

    Freitag, 13. März 2015 11:47
  • Same issue here.  Fresh install CU7 no AV.
    Freitag, 13. März 2015 20:34
  • Same thing for me on CU7. 
    Montag, 23. März 2015 16:43
  • Same problem. Fresh install of Exchange 2013 on Windows 2008 R2 SP1. All updates and pre-req performed correctly and in order. CU7 applied. No AV.

    Rob Holmes


    Freitag, 27. März 2015 12:36
  • Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

    and regarding
    "@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

    I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!




    Mittwoch, 1. April 2015 10:00
  • You are so right about this. This seems to be a growing trend among the moderators and Microsoft staff here. The best thing you can do is report them to customer service and be sure to talk to someone outside their department.

    Rob Holmes

    Mittwoch, 1. April 2015 10:54
  • I'm encountering the same issue(s).  In short:

    1. We upgraded to Exchange 2013 CU7 and started seeing the same errors.
    2. As pointed out, they errors ONLY happen on Mailbox servers and not CAS servers.
    3. They appear to happen every 12 hours.  (The time moves by a minute or two each day.)

    Thanks,

    Robert
    Montag, 13. April 2015 15:50
  • I have pointed out the hippocracy of the Microsoft tech's marking their own non-answers as answers for years. Nothing seems to change, they do it all the time and it is a shame. I don't have time for threads marked with answers only to find (like this one) nothing is solved.

    That said, we are using Exchange 2013 CU8 with both mailbox roles and CAS roles installed on the same machine. The full error is below.

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'E:\Exchange2013-v15\ClientAccess\owa\prem\15.0.1076.9\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    Donnerstag, 23. April 2015 11:27
  • This issue seems to hitting many.

    We have 2 X Exchange 2013 Enterprise CAS and Mailbox roles on same servers operating under Hyper-v 2012R2.

    This issue is only occurring on the 1 Exchange node not on both.  The 2 Exchange servers are configured in a DAG.

    It does not appear to be impacting operations as far as I cal tell but would like to have a clean log.

    Hopefully this additional information can forward this topic and someone can determine the root cause.

    Rometheis Wize
    Senior ISE & Microsoft Solutions Architect
    (Direct) 416-849-2946
    rwize@it911.ca
    rsw@rometheis.com 


    Hi,

    I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

    I can't seem to find any articles or blogs relating to this issue.

    Thanks for any help.


    Donnerstag, 30. April 2015 20:21
  • Seeing the same thing here - single 2013CU8 server with MB and CAS roles.  Operations seem OK, but I'm skeptical long term.  FWIW, this server also had an issue installing CU8 - the update kept disabling all Exchange services, I had to re-enable them at each step of installation manually via PowerShell.  Not sure if there's a relationship there?
    Freitag, 1. Mai 2015 12:28
  • Hello,

    Have this problem since CU1 (currently CU7). And don't think updating to CU8 will resolve the issue.

    Before putting this server in production, I had a support ticket at microsoft to explain those warnings and errors we already had before the server actually did something so here's the reply I had for this error :

    1. 3028 MSExchangeApplicationLogic Extension N/A Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException

    Un problème de reporting qui a apparu sur Exchange 2010, par contre, cela n’a pas été corrigé dans E15 (Exchange 2013) – il me reste à valider avec la personne en charge quelle est la suite à donner;

    (translate : A reporting problem that appeared in Exchange 2010, it was not corrected in E15)

    So I think we should stop worrying about it : another "bug" microsoft won't care to resolve.

    A good ol' "safe to ignore"

    -  


    Montag, 4. Mai 2015 14:24
  • I have the same issue..
    Dienstag, 29. September 2015 20:44
  • Deleted
    Freitag, 23. Oktober 2015 12:26
  • Looks like I have similar/same issue: Ex13, CU9

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1104.5\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    ALSO: 

    Scenario: GetKillBit. Failed to download killbit list from OMEX server. Exception: System.Net.WebException: The remote name could not be resolved: 'store.office.com'
       at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.BaseAsyncOmexCommand.<>c__DisplayClass2.<EndGetResponseCallback>b__1()

    Note: Yes, I can browse to store.office.com just fine.

    • Bearbeitet Josh.Thayer Dienstag, 10. November 2015 01:22
    Dienstag, 10. November 2015 01:17
  • I installed Exchange 2016 and this event is still there.

    Leo

    Montag, 18. Januar 2016 21:22
  • I can confirm that this same problem still exists in Exchange 2013 CU11.
    Dienstag, 19. Januar 2016 17:09
  • Also confirm it is still occurring in Exchange 2016. Unbelievable.
    Mittwoch, 20. Januar 2016 01:48
  • Just got hit with this as well.  Exchange 2016 on 2012.  Nice to see Microsoft's commit to consistent results is still alive and well. :(
    Donnerstag, 21. Januar 2016 16:44
  • I managed to run Handle.exe while this killbit.xml was in use. Most of the time the file is not in use, so no handles are found.

    The processes that used this killbit.xml file at the same time were w3wp.exe of these Application pools: MSExchangeOwaAppPool and MSExchangeServicesAppPool.

    Maybe someone can shed some light with this knowledge?

    Leo


    Leo

    Dienstag, 26. Januar 2016 10:09
  • After each event 3028 you get the 3026 event: "Scenario: GetKillBit. Successfully download killbit list from OMEX server."

    Leo

    Dienstag, 26. Januar 2016 10:30
  • So what does that mean?
    Dienstag, 26. Januar 2016 15:31
  • If Exchange can't get it from the killbit.xml file, it will fetch it from the Omex server and - if the file doesn't exist - create a new killbit.xml.

    Contents of the killbit.xml:

    <?xml version="1.0" encoding="UTF-8"?>
    <o:assets xmlns:o="urn:schemas-microsoft-com:office:office" o:host="weu-zzz.retailer.osi.office.net,OmexStorefront_IN_1" o:corrid="b6884a4a-30b7-42b2-8a79-04634016a779" o:rr="6"/>


    Leo


    • Bearbeitet leof Dienstag, 26. Januar 2016 17:05
    Dienstag, 26. Januar 2016 17:02
  • I think, value of "o:corrid ..." can be different from computer to computer ...

    =STAS=

    Dienstag, 26. Januar 2016 18:50
  • I'm getting the same error. Happens at 4:29PM and 10:29AM each day

    Running Exchange 2013 SP1, 2012R2. I won' t bother looking at the CU version - seems to not matter

    Donnerstag, 4. Februar 2016 00:03
  • Exchange 2016:

    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 11:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 11:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 23:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 23:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 11:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 11:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 11:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 23:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 17:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 5:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 23:48:48 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 23:48:48 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension

    It never stops...


    Leo

    Dienstag, 16. Februar 2016 18:03
  • Same issue here. - every 6 hours

    standalone exchange 2013 Version 15.0 (Build 1130.7) no DAG

    Montag, 22. Februar 2016 09:44
  • I too have the same problem every 6 hours. I have scoured the internet, tried the delete and restart the service fix, restarted the server, and tried everything but powdered bat wings and still no solution. It is amazing to me that MSFT will let this problem remain through three iterations of one of their prestige products,
    Mittwoch, 24. Februar 2016 22:36
  • Wow I can't believe this is still a problem in the recent Exchange CU's and even in 2016!!!!

    I use an event monitoring system called Event Sentry so I guess I will just create a filter and exclude this one.  Our Exchange 2013 CU6 is running fine.  I know its a little behind in the CU updates, but if it ain't broke, don't fix it.

    Dienstag, 15. März 2016 17:41
  • Deleted
    Donnerstag, 17. März 2016 13:08
  • I updated my exchange 2013 to CU 12 still I have the same problem, I open a ticket with Microsoft support I will keep you update it.
    Mittwoch, 6. April 2016 06:41
  • I also just updated an Exchange 2013 server to CU 12 and continue to have the problem. All eyes are on you Simssa
    Donnerstag, 7. April 2016 20:51
  • "Hippocracy."  Is that a government fun by hippopotamuses?


    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Donnerstag, 7. April 2016 23:47
    Moderator
  • @Simsaa: Any news on your ticket?
    Mittwoch, 20. April 2016 08:11
  • Hey Simssa,You still awake out there. It's been 3 weeks. Those boys at Redmond come up with anything??

    Mittwoch, 27. April 2016 19:37
  • It's been over a month since Simssa opened his ticket and nothing. Anyone else had any success in clearing this error?
    Dienstag, 10. Mai 2016 13:49
  • I'd check your AV exclusions.  Again, look at the error.  The file is in use by another process. 

    You could also take a look at process explorer, see what process is accessing that file. 

    Any time we see files which are locked and cannot be accessed by another process, the key is finding out what file(s) are accessing it and why. 


    Dienstag, 7. Juni 2016 15:54
  • All Exchange locations are excluded on my Exchange server.
    And, as I stated before:

    "I managed to run Handle.exe while this killbit.xml was in use. Most of the time the file is not in use, so no handles are found.   The processes that used this killbit.xml file at the same time were w3wp.exe of these Application pools: MSExchangeOwaAppPool and MSExchangeServicesAppPool""

    I have no idea why they would want to access killbit.xml.


    Leo

    Dienstag, 7. Juni 2016 17:04
  • I just applied CU13 to Exchange 2013 and the problem still exists! Drat!
    Sonntag, 26. Juni 2016 16:21
  • I noticed the same thing on windows 2012 with Exchange 2013.  this event is logged every 6 hours

    chanwingkai

    Donnerstag, 25. August 2016 01:51
  • The upgrade to CU14 didn't help either. Double drat. I wonder what the average lifetime is for a Microsoft "non-critical" error.
    Sonntag, 23. Oktober 2016 20:38
  • Installed CU3 on Exchange 2016. Warnings 3028 still occur.

    Leo

    Samstag, 12. November 2016 09:44
  • I have tried all the suggestions but still have this error coming up as well.  Adding this thread to my alerts, hopefully someone will come up with some info one day.
    Dienstag, 22. November 2016 23:08
  • Exchange 2013 CU15 on 2012 R2.. still happening

    Norman Schlorke

    • Als Antwort vorgeschlagen Norman Scorpion Mittwoch, 28. Dezember 2016 19:31
    • Nicht als Antwort vorgeschlagen Norman Scorpion Mittwoch, 28. Dezember 2016 19:31
    Mittwoch, 28. Dezember 2016 18:33
  • Same here, and I had such great hopes for this update!
    Mittwoch, 28. Dezember 2016 22:22
  • Same problem here, clean new installation of Ex2016 CU2.

    Montag, 2. Januar 2017 16:46
  • Thank god some of you have a sense of humour, otherwise this thread would have been tedious to read.

    Ex2016 CU4 - can report same issue as some of my frustrated peers above =)

    "please fix" 


    Mittwoch, 11. Januar 2017 14:53
  • I can't believe this thread won't die.  Is this still a problem?
    Donnerstag, 12. Januar 2017 00:30
  • Yepp, Exchange 2013 CU15.

    -Ray.

    Dienstag, 17. Januar 2017 10:05
  • Same problem here, clean new installation of ex2016 cu4 and got event 14005 too....

    Mittwoch, 15. März 2017 03:02
  • Same problem here. Exchange 2016 cu4 new installation...
    Montag, 27. März 2017 14:01
  • Using Exchange 2016 CU 5 and it still is happening.  This is ridiculous.
    Donnerstag, 6. April 2017 18:00
  • I just applied Exchange 2013 CU16 and the error messages are still happening. The saga continues....
    Montag, 10. April 2017 20:31
  • Same with Exchange 2013 CU17
    Samstag, 8. Juli 2017 16:12
  • Fresh install Exchange Server 2016 CU on Windows Server 2016 Standard;

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.1.1034.26\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)


    Hello!

    Dienstag, 25. Juli 2017 13:44
  • Hi there,

    also having the same issue with Exchange 2013 und CU17 on Win Server 2012 R2.

    I can see 2 reasons for this:

    1) Microsoft doesn't care about it.
    or
    2) Microsoft is not able to solve the problem.

    Both of them are absolutely embarrassing.
    The time I need to google all these problems takes hours and hours without getting any solution.
    I'll never use Exchange-Server again!

    Dienstag, 1. August 2017 02:03
  • Still there with 2013 CU18
    Sonntag, 22. Oktober 2017 17:55
  • I have Exchange 2016 CU7 installed. Same issue....

    Any progress from Microsoft?

    Dienstag, 24. Oktober 2017 16:02
  • Exchange 2016 CU 7 problem still exists!
    Freitag, 24. November 2017 23:11
  • I've installed Exchange 2016 CU7 on Server 2016 Standard. The problem still exists!
    Samstag, 25. November 2017 08:34
  • Hi

    Same problem 2016 CU 7 2012 R2 Standelone No AV

    Donnerstag, 7. Dezember 2017 13:02
  • I notice that the errors appear in groups of 3 at exactly the same time right to the second. Then there is a 4th entry where the killbit file is downloaded from the Microsoft OMEX server.
    Sonntag, 24. Dezember 2017 19:44
  • I will say this for Microsoft, they are consistent. I just installed CU19 and there is my little Application Logic 3028 buddy again. I will probably miss it when it's gone, but there is probably no chance of that.
    Donnerstag, 11. Januar 2018 22:05
  • NO CHANGE ON EXCH 2016 CU8
    Montag, 5. März 2018 13:07
  • I just applied CU20 to Exchange 2013. Once the update was applied I had a critical error because of a certificate problem with ipport 444. I fixed that and I haven't had a 3028 since. Was it the cert problem or was it fixed in CU20? I have no idea but I sure like the looks of my logs now! It's only been one day so I will feel better after a week with no errors.
    Montag, 16. April 2018 21:44
  • Installed CU20 yesterday, but the problem persists.

    @NMCowboy: What did you change regarding your certificate problem?

    Donnerstag, 19. April 2018 07:45
  • First, let me revise my message as of the 16th. I did not get rid of the 3028's entirely. I have reduced the number of occurrences, and stretched out the interval time, but there are still some there. Drat, I thought I had it.

    As to the certificate problem on port 444 I had a thumbprint specified for a certificate that no longer existed. Why didn't I get an error with CU19? I have no idea, but there was probably some logic changes in CU20 that made it boil to the top. But once I saw the error in the event logs I ran netsh http show sslcert and the first 2 listings were for ports 443 and 444. I saw right away that the thumbprint for the cert specified for port 444 did not exist. So I just copied the thumbprint specified for port 443 and did a netsh http add sslcert ipport=0.0.0.0:444 using the certhash and appid from 443 and the error disappeared.  I didn't even have to restart.

    Montag, 23. April 2018 16:10
  • This has actually started happening with increased frequency on my Exchange 2016 CU9 system....  right around the time my backups kick off....

    Tim Magnuson | MCTS, MCITP | MCCA 2011 |
    Ok, so I changed my name...you can still call me Tom if you like. It's a...jump...to conclusions...mat.
    My Blog Site: http://tmagnuson.wordpress.com

    Dienstag, 1. Mai 2018 15:11
  • Windows 2016 DataCenter Fresh Install

    Exchange 2016 Enterprise DAG Two Nodes

    I get the same event over and over.

    If this can be ignored then when preset the message we have enough events to review

    Can someone please come up with a solution

    Thank you,


    Thomas R Grassi Jr

    Freitag, 8. Juni 2018 20:46
  • After all this time I can't believe it. Last Sunday I rolled on Exchange 2013 CU21. I had to install VC++2103 before I could pass the prerequisite step, but then everything completed ok. I checked the next morning and I had 2 instances of Event ID:3028 from the day before, but get this! I haven't had one since. I used to get 5 or 6 a day, but the last 3 days, Nothing!! My error log is clean.
    Mittwoch, 11. Juli 2018 18:46
  • We still get 4 entries every 6 hours (Exchange 2013 CU21).
    Dienstag, 17. Juli 2018 08:28
  • The same here. Exchange 2016 on Windows 2016.
    Freitag, 24. August 2018 15:40
  • Same issue here - Exchange 2013 CU19.
    Freitag, 14. September 2018 13:11
  • Same event on ONE server in two-node dag Exchange 2013 CU21

    As NMCowboy wrote, really during the update to latest cu (21) I installed VC++2013 as a prerequisite, while the other server updated without any prompts and got only VC++ 2008 and 2012 installed with no error 3028 in log.

    Montag, 17. September 2018 07:38
  • Same error here with Server 2016 and Exchange Server 2016 still CU10. If there is a possible solution based by VC++, I would be interested in which versions on the systems without error are installed.

    Our system has installed

    2010 x86 + x64
    2012 x86 + x64
    2013 only x64 (!)
    2015 x86 + x64

    Regards
    Jo


    • Bearbeitet joschl Montag, 10. Dezember 2018 13:57
    Montag, 10. Dezember 2018 13:33
  • This problem has existed for 4+ years. It has existed through 3 versions of Exchange. We are just banging our heads against a stone wall,  searching for solutions, trading symptoms, etc. It is now obvious to the most casual observer that Microsoft has no interest in solving this  problem. 20 or 30 years ago Microsoft would never say "Just ignore that error, it's  not important." Really! What if we have 20 or 30 warning errors? Should  we just ignore them all? Why do we have an event log if the advise we get from Microsoft is "Just ignore the messages"? I personally am fed up with this attitude.  I guess that there is not anything I can do about it, but I am really disappointed with their attitude.
    Sonntag, 27. Januar 2019 20:38
  • 2013 CU 21 here, issue with all 4 events occurring every 6 hours
    Dienstag, 5. Februar 2019 14:40
  • I am getting this event right before the server bluescreens and reboots.   It happened to correspond with Unintrends backup agent beginning a full backup.  also, the volume shadow copy service started was the last event log message before the blue screen... anyone else seeing a correlation between backups and this error?  Similarly, our virtual exchange server crashes when being checkpointed unless it's in maintenance mode.  Anyone else seeing a correlation between backups and this error? we are on exchange 2016 RTM.

    Dienstag, 5. Februar 2019 21:50
  • Exchange 2016 CU 11 German DAG servers, same odd problem.

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: Der Prozess kann nicht auf die Datei "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.1.1591.12\ext\killbit\killbit.xml" zugreifen, da sie von einem anderen Prozess verwendet wird.

    What I can see, is that just before the error is occouring every 6 hours, there is this eventlog everytime:

    Informationen	05.03.2019 07:34:05	MSExchangeIS	1041	General
    Microsoft Exchange Information Store service has completed an internal schema upgrade on (Folder) (b10bb4fc-3b16-4a4a-864e-2287c3abf244[1]-128108630). The upgrade has brought the version from (0.143) to (0.174).

    And afterwards i can see:

    Informationen	05.03.2019 07:34:25	MSExchange Mid-Tier Storage	9000	(9)
    [Process:w3wp PID:19892 Thread:19] Successfully populated ServiceTopology. Reason to populate ServiceTopology = RefreshTimeout

    I wonder, if this does would not have someting to to with the issue.

    For the case it is to be narrowed down to Visual C++ Runtimes, here is, what is installed on our Exchange Servers:

    Name                                                                                  Version         
    7-Zip 9.20 (x64 edition)                                                              9.20.00.0       
    IIS-URL-Rewrite-Modul 2                                                               7.2.1980        
    Microsoft Exchange 2007 Enterprise Anti-spam Signatures                               3.3.4604.600    
    Microsoft Exchange 2007 Enterprise Block List Updates                                 3.3.4604.001    
    Microsoft Exchange 2007 Standard Anti-spam Filter Updates                             3.3.4604.600    
    Microsoft Exchange Server                                                             15.1.1591.10  
    *** dozends of Language packs                                                                
    Microsoft Exchange Client Language Pack - xxx                                         15.1.1591.10
    Microsoft Exchange Server Language Pack - xxx                                         15.1.1591.10    
    Microsoft Lync Server 2013, Bootstrapper Prerequisites Installer Package              5.0.8308.0      
    Microsoft Server Speech Platform Runtime (x64)                                        11.0.7400.345   
    *** dozends of Microsoft Server Speech Recognition Languages
    Microsoft Server Speech Recognition Language - TELE xxx                               11.0.7400.345
    Microsoft Server Speech Text to Speech Voice (en-US, Helen)                           11.0.7400.345   
    Microsoft Speech Platform VXML Runtime (x64)                                          11.0.7400.345   
    Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit                 5.0.8308.0      
    Microsoft Unified Communications Managed API 4.0, Runtime                             5.0.8308.0      
    Microsoft Unified Communications Managed API 4.0, SSP Runtime                         5.0.8308.0      
    Microsoft Visual C++ 2005 Redistributable                                             8.0.61001       
    Microsoft Visual C++ 2005 Redistributable (x64)                                       8.0.61000       
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161                        9.0.30729.6161  
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161                        9.0.30729.6161  
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219                           10.0.40219      
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219                           10.0.40219      
    Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610                         11.0.60610      
    Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610                            11.0.60610      
    Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005                         12.0.21005      
    Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005                            12.0.21005      
    Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.23918                         14.0.23918      
    Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.23918                            14.0.23918      
    Microsoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325                        14.11.25325     
    Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.11.25325                           14.11.25325     
    Microsoft Web Platform Installer 5.0  
    Nutanix Checks & Prereqs                                                              1.2.2.0         
    Nutanix Guest Agent                                                                   1.2.2.0         
    Nutanix Guest Tools Infrastructure Components Package 1                               1.2.2.0         
    Nutanix Guest Tools Infrastructure Components Package 2                               1.2.2.0         
    Nutanix Self Service Restore                                                          1.2.2.0         
    Nutanix VM Mobility                                                                   1.1.1.0         
    Nutanix VSS Modules 1.1.0                                                             1.1.0.0         
    Symantec Endpoint Protection                                                          14.2.770.0000   
    Universal Agent Framework                                                             1.0.21.0   

    AV exclusions exist.

    All Warnings of yesterday:

    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028








    • Bearbeitet L_Herzog Mittwoch, 6. März 2019 09:04
    Mittwoch, 6. März 2019 08:47
  • I am getting this event right before the server bluescreens and reboots.   It happened to correspond with Unintrends backup agent beginning a full backup.  also, the volume shadow copy service started was the last event log message before the blue screen... anyone else seeing a correlation between backups and this error?  Similarly, our virtual exchange server crashes when being checkpointed unless it's in maintenance mode.  Anyone else seeing a correlation between backups and this error? we are on exchange 2016 RTM.


    Sorry, I cannot see a correlation between backup and the killbit eventlog here. Even though we are taking a (HyCU) backup every 6 hours of the servers, the eventlog appears about one hour after the backup is finished.



    • Bearbeitet L_Herzog Mittwoch, 6. März 2019 10:03
    Mittwoch, 6. März 2019 09:08
  • as stated by others: "safe to ignore"

    Why? The file is actually downloaded. In our case from jpe-001.retailer.osi.office.net

    In Process Monitor and by the filestamp we can say that the file is modified / updated despite of the Warning in eventlog that the file is permanently in use by the w3wp.exe processes.

    to reduce the ammount of Warnings in eventlog, you can change the killbit refresh rate from every 6 hours to once per day as described here:

    https://support.microsoft.com/en-us/help/3110766/msexchangeapplicationlogic-event-3018-in-exchange-server-2013

    process monitor killbit download


    • Bearbeitet L_Herzog Mittwoch, 20. März 2019 15:11 url change
    • Als Antwort vorgeschlagen L_Herzog Mittwoch, 20. März 2019 15:11
    Mittwoch, 20. März 2019 15:08
  • try to enable internet connectivity for the Exchange servers (port 80 and 443) and/or configure Exchange server proxy settings with "Set-ExchangeServer -InternetWebProxy"

    You have to wait afterwards. Not sure if an IISRESET /noforce /timeout:120 might help but i did not tested this since i was working in a productive environment.

    at least this solved this issue in my case after waiting a few hours.

    would be nice to hear if this helps others too.

    Regards


    • Bearbeitet PrayingMoses Mittwoch, 17. April 2019 07:24
    • Als Antwort vorgeschlagen PrayingMoses Mittwoch, 17. April 2019 07:36
    Mittwoch, 17. April 2019 07:24
  • Installed CU22 yesterday and since then, I only get one entry every 6 hours instead of four before. Woohoo progress, Microsoft...
    Donnerstag, 25. April 2019 09:35
  • Aaaaand it's back to four entries again.
    Freitag, 26. April 2019 10:15
  • I find the answer proposed by L_HERZOG (a couple of messages up) does the trick.
    Dienstag, 25. Juni 2019 14:56
  • Not the best way and more a dirty hack, but you can try to suppress these warnings in "Administrative Events" by using the <suppress>  XML filter statement till MS has fixed this issue (if they do so anytime).

    Copy the write protected "Administrative Events" to "Filtered Administrative Events" and there insert the following line

    <Suppress Path="Application">*[System[(EventID=3028)]] and *[EventData[Data='ProcessKillBit']]</Suppress>

    into the filter xml statement like this:

    <QueryList>

      <Query Id="0" Path="Application">

        <Select Path="Application">*[System[(Level=1  or Level=2 or Level=3)]]</Select>

        <Suppress Path="Application">*[System[(EventID=3028)]] and *[EventData[Data='ProcessKillBit']]</Suppress>

    ...

    ...

      </Query>

    </QueryList>

    This way these events are not longer shown in this specific view.

    Dienstag, 3. September 2019 11:18
  • What cumulative update is installed?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

    This is not solved, <style></style>

    Knut W

    Freitag, 18. Oktober 2019 10:24
  • I had this error from first day when we have installed Exchange 2013 4 years ago and now on latest CU23 is still there. Every 6 hours same error. This is so disappointing Microsoft
    Sonntag, 24. November 2019 08:51