locked
Event ID 1040 on Exchange 2007 SP1 RU7 NLB CAS servers RRS feed

  • Question

  • Have a customer getting 1040 event ID’s on their exch 2007/w2k8 NLB’d HT/CAS servers.

     

    Error on the phones vary from “try again later” to “invalid cert”

     

    Activesync is the ONLY thing affected, and appears to be only 1-2 users ever.

     

    Log Name:      Application

    Source:        MSExchange ActiveSync

    Date:          4/3/2009 11:39:06 AM

    Event ID:      1040

    Task Category: Requests

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      cas2.customer.com

    Description:

    The average of the most recent [437] heartbeat intervals used by clients is less than or equal to [540].

    Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and Direct Push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

     

    For more information about how to configure firewall settings when you use Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="MSExchange ActiveSync" />

        <EventID Qualifiers="32772">1040</EventID>

        <Level>3</Level>

        <Task>1</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2009-04-03T16:39:06.000Z" />

        <EventRecordID>25377</EventRecordID>

        <Channel>Application</Channel>

        <Computer>cas2.customer.com</Computer>

        <Security />

      </System>

      <EventData>

        <Data>437</Data>

        <Data>540</Data>

      </EventData>

    </Event>

     

    The article mentioned in the event ID is here:

    http://support.microsoft.com/kb/905013

     

    This has a bare mention of Exchange 2007, and appears to be RTM related.  It mentions where to find a setting in the web.config, but has no recommendation on what to extend it to.

     

    Also, if I extend the MaxHeartbeatInterval, it seems I also need to extend the ProxyHandlerLongTimeout.  It also seems I might just be having these informationally and that I need to configure my HbiAlertThreshold to something more fitting, but I have no recommendation on what that would be, either.

     

    Their firewall is indeed suspect, but there are no HTTPS timeout values to be set on it.  (IBM Proventia M60)  The customer knows the Firewall is dated and potentially an issue, but there is no workaround at this point.

     

    BTW, the testexchangeconnectivity site and the AccessmyLAN Activesync tester pass just fine (from Internet, or from LAN, explicitly testing against each NLB node.

     

    I am running out of ideas – anyone?

    Friday, April 3, 2009 5:10 PM

All replies

  • Exchange 2007 and Windows Mobile are built to handle short session times. Increasing the overall session time will provide reduced bandwidth, and increased battery life.

    That being said, I don't think this is your main issue. This will not result in the errors you are seeing on the device, it would instead increase network usage and reduce battery life significantly. Although these issues should be addressed for better performance, I think your main issues are not related to this event ID. As you may have already guessed, the firewall might be incorrectly handling the traffic, which is causing the issue.

    Even though the firewall doesn't have a HTTP/S session timeout that you can configure, you could always increase the firewalls global session timeout. If your customer doesn't want to do that, then it's their choice not to fix the issue.

    My recommendation would be to install and ISA server in the DMZ, which can have specific session timeouts configured. This would fix the errors you are seeing, reducing network bandwidth, and increasing Windows Mobile Battery life.

    Cheers Wayne
    Airloom

    • Proposed as answer by Cedric Ch Wednesday, April 13, 2016 7:56 AM
    Monday, April 13, 2009 3:12 AM
  • Hello,

    I am seeing this error too.  About every 15 minutes I am getting the 1040 warning.  Has anyone else solved this one?  Our firewall is set for a 60 minute ttl on sessions.

    -Patrick
    Thursday, November 19, 2009 3:49 PM
  • Hello guys,

    The MSExchange ActiveSync 1040 warning is been shown repeatedly with interval 15 min, along with it MSExchange RPC Over HTTP Autoconfig error event id 2007. am facing problems in configuring Active sync for windows mobile and mail for exchange for mobile users. I checked the ISA server timeout values and its been set to normal.

    Did anyone get the solution for this issue.

    sreejith

     

     

    Friday, May 28, 2010 11:22 AM
  • Hi guys,

    Did you ever get an answer/solution for this? I'm seeing this on my EX2010 SP1 CAS Server.

    Log is as below:

    Log Name:      Application
    Source:        MSExchange ActiveSync
    Date:          17/01/2011 21:40:57
    Event ID:      1040
    Task Category: Requests
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      EX2010CAS.domain.com
    Description:
    The average of the most recent heartbeat intervals [540] for request [Ping] used by clients is less than or equal to [540].
    Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

    For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&amp;kbid=905013).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchange ActiveSync" />
        <EventID Qualifiers="32772">1040</EventID>
        <Level>3</Level>
        <Task>1</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-01-17T21:40:57.000000000Z" />
        <EventRecordID>13871</EventRecordID>
        <Channel>Application</Channel>
        <Computer>EX2010CAS.domain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>540</Data>
        <Data>Ping</Data>
        <Data>540</Data>
      </EventData>
    </Event>

     

    Thanks

    Monday, January 17, 2011 10:52 PM
  • I never got a firm answer as to why this was happening, but it did go away on my Exch 2007 environment.
    Wednesday, January 19, 2011 1:05 PM
  • i got event like that in Exchange Server 2010, Event ID 1040 Microsoft Exchange Activesnyc.

    How to change hearbeat interval ? and where because i don't have web listener in my ISA server ?

    Thursday, January 20, 2011 5:32 AM
  • First check your Router/ Firewall Heartbit interval config then go for the below Solution

    Change Mini and MaxHeartbeatInterval on your Exchange 2007/2010 server to "0"

      • In Notepad, open the Sync web.config file on the Client Access Server. By default, that location is under \Program Files\Microsoft\Exchange Server\ClientAccess\Sync.
      • Search for and modify the following values as needed:
        <add key="MinHeartbeatInterval" value="60"></add> <add key="MaxHeartbeatInterval" value="3540"></add>

    cheer's Enjoy

    • Proposed as answer by Cedric Ch Wednesday, April 13, 2016 7:56 AM
    Friday, September 7, 2012 7:26 AM