locked
CAS RPC Access crashed RRS feed

  • Question

  • There is a Exchange 2010 SP2.RU3

    It was installed in mixed environment with Ex2003.SP2 (now it's off).

    Today access for RPC client (MAPI) was broken. Only clients with MAPI connection were experiencing the issue; OWA worked fine.

    We found to events in logs:

    Имя журнала:   Application

    Источник:      MSExchange Common

    Дата:          19.07.2012 9:38:18

    Код события:   4999

    Категория задачи:General

    Уровень:       Ошибка

    Ключевые слова:Классический

    Пользователь:  Н/Д

    Компьютер:     EXCH-xx-00-01.DOMAIN.LOCAL

    Описание:

    Будет отправлен отчет программы "Доктор Ватсон" для идентификатора процесса 788 с параметрами E12, c-RTL-AMD64, 14.02.0297.000, OWA, M.E.Clients.Owa, M.E.C.O.C.OwaStoreObjectId.CreateFromItemId, System.ArgumentNullException, 18bb, 14.02.0309.002.

    ErrorReportingEnabled: False

    Xml события:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="MSExchange Common" />

        <EventID Qualifiers="16388">4999</EventID>

        <Level>2</Level>

        <Task>1</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2012-07-19T05:38:18.000000000Z" />

        <EventRecordID>23604</EventRecordID>

        <Channel>Application</Channel>

        <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer>

        <Security />

      </System>

      <EventData>

        <Data>788</Data>

        <Data>E12</Data>

        <Data>c-RTL-AMD64</Data>

        <Data>14.02.0297.000</Data>

        <Data>OWA</Data>

        <Data>M.E.Clients.Owa</Data>

        <Data>M.E.C.O.C.OwaStoreObjectId.CreateFromItemId</Data>

        <Data>System.ArgumentNullException</Data>

        <Data>18bb</Data>

        <Data>14.02.0309.002</Data>

        <Data>False</Data>

        <Data>

        </Data>

      </EventData>

    </Event>

    AND:

    Имя журнала:   System

    Источник:      Service Control Manager

    Дата:          19.07.2012 9:53:25

    Код события:   7011

    Категория задачи:Отсутствует

    Уровень:       Ошибка

    Ключевые слова:Классический

    Пользователь:  Н/Д

    Компьютер:     EXCH-xx-00-01.DOMAIN.LOCAL

    Описание:

    Превышение времени ожидания (30000 мс) при ожидании ответа транзакции от службы "MSExchangeRPC".

    Xml события:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7011</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x8080000000000000</Keywords>

        <TimeCreated SystemTime="2012-07-19T05:53:25.181229100Z" />

        <EventRecordID>8817</EventRecordID>

        <Correlation />

        <Execution ProcessID="508" ThreadID="7092" />

        <Channel>System</Channel>

        <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">30000</Data>

        <Data Name="param2">MSExchangeRPC</Data>

      </EventData>

    </Event>

    After service restart (MSExchangeRPC) users gained the access.

    Does anybody can help with the issue or hint what to check?!

    Thanks a lot.

    PS: Exchange 2010 was installed with SP2 + RU2 (placed in update folder), RU1 was not used.

    PS2: once we were installing RU3 on SP2 and server crashed (power off). We decided that the issue was in power-cord (or UPS). We reinstalled RU3 and everything was fine.

    PS3: in RPC access loggin (txt) we found that last access attept was at 9:23 (it's really far from event time  shoed).

    Thursday, July 19, 2012 7:19 AM

All replies

  • There is a Exchange 2010 SP2.RU3

    It was installed in mixed environment with Ex2003.SP2 (now it's off).

    Today access for RPC client (MAPI) was broken. Only clients with MAPI connection were experiencing the issue; OWA worked fine.

    We found to events in logs:

    Имя журнала:   Application

    Источник:      MSExchange Common

    Дата:          19.07.2012 9:38:18

    Код события:   4999

    Категория задачи:General

    Уровень:       Ошибка

    Ключевые слова:Классический

    Пользователь:  Н/Д

    Компьютер:     EXCH-xx-00-01.DOMAIN.LOCAL

    Описание:

    Будет отправлен отчет программы "Доктор Ватсон" для идентификатора процесса 788 с параметрами E12, c-RTL-AMD64, 14.02.0297.000, OWA, M.E.Clients.Owa, M.E.C.O.C.OwaStoreObjectId.CreateFromItemId, System.ArgumentNullException, 18bb, 14.02.0309.002.

    ErrorReportingEnabled: False

    Xml события:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="MSExchange Common" />

        <EventID Qualifiers="16388">4999</EventID>

        <Level>2</Level>

        <Task>1</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2012-07-19T05:38:18.000000000Z" />

        <EventRecordID>23604</EventRecordID>

        <Channel>Application</Channel>

        <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer>

        <Security />

      </System>

      <EventData>

        <Data>788</Data>

        <Data>E12</Data>

        <Data>c-RTL-AMD64</Data>

        <Data>14.02.0297.000</Data>

        <Data>OWA</Data>

        <Data>M.E.Clients.Owa</Data>

        <Data>M.E.C.O.C.OwaStoreObjectId.CreateFromItemId</Data>

        <Data>System.ArgumentNullException</Data>

        <Data>18bb</Data>

        <Data>14.02.0309.002</Data>

        <Data>False</Data>

        <Data>

        </Data>

      </EventData>

    </Event>

    AND:

    Имя журнала:   System

    Источник:      Service Control Manager

    Дата:          19.07.2012 9:53:25

    Код события:   7011

    Категория задачи:Отсутствует

    Уровень:       Ошибка

    Ключевые слова:Классический

    Пользователь:  Н/Д

    Компьютер:     EXCH-xx-00-01.DOMAIN.LOCAL

    Описание:

    Превышение времени ожидания (30000 мс) при ожидании ответа транзакции от службы "MSExchangeRPC".

    Xml события:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7011</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x8080000000000000</Keywords>

        <TimeCreated SystemTime="2012-07-19T05:53:25.181229100Z" />

        <EventRecordID>8817</EventRecordID>

        <Correlation />

        <Execution ProcessID="508" ThreadID="7092" />

        <Channel>System</Channel>

        <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">30000</Data>

        <Data Name="param2">MSExchangeRPC</Data>

      </EventData>

    </Event>

    After service restart (MSExchangeRPC) users gained the access.

    Does anybody can help with the issue or hint what to check?!

    Thanks a lot.

    PS: Exchange 2010 was installed with SP2 + RU2 (placed in update folder), RU1 was not used.

    PS2: once we were installing RU3 on SP2 and server crashed (power off). We decided that the issue was in power-cord (or UPS). We reinstalled RU3 and everything was fine.

    PS3: in RPC access loggin (txt) we found that last access attept was at 9:23 (it's really far from event time  shoed).

    • Merged by Fiona_Liao Friday, July 20, 2012 1:47 AM duplicated
    Thursday, July 19, 2012 7:19 AM
  • Hi there,

    I am sorry that it seems that you have requested support for exchange product in Russian version. Since we do not familiar with this language, it is very difficult for us to perform further troubleshooting steps, such as capture the log file.  This forum is geared to answer on the English version of the product. For the forum support in Russian please use the link below

    http://social.technet.microsoft.com/Forums/ru-mo/exchangesvrgeneral/

    Your understanding would be appreciated.

    Just for your reference, you may try to create new OST files for effected users. Hope it is helpful.


    Fiona Liao

    TechNet Community Support


    • Proposed as answer by Fiona_Liao Tuesday, July 24, 2012 8:57 AM
    • Unproposed as answer by Fiona_Liao Wednesday, July 25, 2012 3:44 AM
    • Edited by Fiona_Liao Wednesday, July 25, 2012 3:44 AM
    Friday, July 20, 2012 6:35 AM
  • If no more questions on this thread, we may mark it as answered. Your understanding would be appreciated.


    Fiona Liao

    TechNet Community Support

    Tuesday, July 24, 2012 8:57 AM
  • Hi, Fiona_Liao.

    About Russian - there is enough information in the messages that is spelled in English (xml formated). The only data in Russian is that Dr.Watson is sending report on the error and the transaction time limit exceeded (30000 ms) for the service MSExchangeRPC.

    There are no affected users - everything works fine after service restart.

    It's seems to me that uninstalling Exchange SP is not a good idea in any case, because it can lead to much more serious problems.

    Thanks a lot.

    Tuesday, July 24, 2012 9:09 AM
  • Just for your reference, you may try to remove SP2 and then reinstall SP2, or create new OST files for effected users. Hope it is helpful.


    Fiona Liao

    TechNet Community Support

    Hi Fiona,
    Just for your Information...

    Its not possible to uninstall a Service Pack.

    Martina Miskovic

    Tuesday, July 24, 2012 1:52 PM
  • Not, Martina, we cannot uninstall theservice pack. I am sorry about my mistake, and thanks for your reminder. I have already changed my earlier post.


    Fiona Liao

    TechNet Community Support



    • Edited by Fiona_Liao Wednesday, July 25, 2012 3:45 AM
    Wednesday, July 25, 2012 3:40 AM
  • Thanks for your explaination.

    I researched again based on event id 4999, and found that this issue might be caused by antivirus applcation. So if you have this kind of application installed in your CAS server, please remove it or temporarily disable it, and then try again.

    Besides, event id 4999 might accompany with id 9659, for a particular user. It is best if you can find this user out.

    Meanwhile I would still suggest you post the question in Russian forum, which can be more efficiently.


    Fiona Liao

    TechNet Community Support

    Wednesday, July 25, 2012 3:56 AM
  • We have only FEP installed on Exchange server, so there is no third-party antivirus solution installed.

    There was no 9659 event id. All the users were affected until we restarted the service.

    PS: I'll post the thread in Russian forum, but in English one there are much more experienced administrators participate.

    Wednesday, July 25, 2012 7:00 AM
  • Thanks for your cooperation and understanding. I've also involved a next level support engineer in this thread. If there is any finds he/she will join directly and keep you posted. And I will also keep on monitoring.

    Hope the issue can be resolved soon.


    Fiona Liao

    TechNet Community Support


    • Edited by Fiona_Liao Thursday, July 26, 2012 10:36 AM
    Thursday, July 26, 2012 10:35 AM
  • QRS,

    What roles are installed on the Exchange 2010 server?? Do you have a Public Folder database on the same server where you are facing RPC Client Access issues?? See whether this KB is applicable in your case..http://support.microsoft.com/kb/2535105

    Thanks,

    VB

    Wednesday, August 1, 2012 3:59 AM
  • Exchange 2010 SP2.RU3 - single server with HT+CAS+MB roles installed + FEP.

    We have no public folder database.

    Wednesday, August 1, 2012 5:09 AM
  • How frequently does the issue happen?? Can you post the last few entries from the RCA logs located at C:\Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access location during the time of failure...

    Wednesday, August 1, 2012 5:52 AM
  • The issue was only once (I'll try to find that log file - if it's not overwritten).

    I wrote, that during the issue there were no records in the file! Last record was at 9:23 and the next record was logged after the service was restarted.

    Wednesday, August 1, 2012 9:12 AM
  • It sounds as if the RPC Client Access process went into a hang state and came back to normal once you restarted the service. This condition will not provide us with useful info on logs. The next time the issue happens, please contact CTS as they can collect memory dumps of the process and also debug traces to see what is the issue.

    Tuesday, August 21, 2012 4:06 AM