locked
Event ID 4001 MSExchange System Attendant Mailbox

    Question

  • Hi Exchange experts,

    I having this event id 4001 on all my exchange server (10 E2K7 servers). It's happen only on weekday(Mon-Fri). This event ID will trigger the on call phone. When we check from the monitoring tools, one of the server store are dismounted, actually not. The server is healthy and store never dismounted. The problem may resolve itself in awhile. The service will retry in 56 seconds. The weird thing is it only happen weekday.

    Do you have any idea of this event 4001 in my current situation?
    Please advise.

    Thanks.
    Wednesday, October 14, 2009 5:43 AM

Answers

All replies

  • hi,
    4001 can happen for many reasons. are there any other events in the event logs, that you can post here? Also as you say, not stores get dismounted. what happens when you create a new mailbox database? does that get mounted on creation? can you try that and see if there are any event logs generated?
    this generally happens when the SA service fails or goes into a retry state. since you say this happens only on weekdays, check if you have issues connecting to AD or if any clients are doing something un-obvious.

    Wednesday, October 14, 2009 6:01 AM
  • Also run EXBPA to make sure the Configurations Looks Ok.

    EXBPA
    Vinod |CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|
    • Proposed as answer by emma.yoyo Monday, October 19, 2009 1:51 AM
    • Marked as answer by emma.yoyo Tuesday, October 20, 2009 2:58 AM
    Wednesday, October 14, 2009 12:02 PM
  • Hi,

    our exchange servers are dedicated server, not Domain Controller servers.
    do you think if disabling the checksum offloading can help?

    Please advise.

    Wednesday, October 14, 2009 2:50 PM
  • sure. If you have checksum offloading enabled, disable that and see if that resolves it for you. Also check to see if the SNP patch is installed, if this is Windows 2003. looking at a netmon could help as well.
    • Proposed as answer by emma.yoyo Monday, October 19, 2009 1:51 AM
    • Marked as answer by emma.yoyo Tuesday, October 20, 2009 2:58 AM
    Thursday, October 15, 2009 5:44 AM
  • Hi,

    About checksum offloading, please have a look at these two posts.

    Error - 4001, Source - MSExchange System Attendant Mailbox
    http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/5cb79acf-6fed-4e99-b092-6e3f923e325b/
    Information Store is stopped, 4001 logged in Eventviewer
    http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/2a9e0fde-ea91-46f9-a113-82c870aee609

    Frank Wang
    • Proposed as answer by emma.yoyo Monday, October 19, 2009 1:51 AM
    • Marked as answer by emma.yoyo Tuesday, October 20, 2009 2:58 AM
    Friday, October 16, 2009 3:21 AM