none
Event ID 3028 MSExchangeApplicationLogic RRS feed

  • Question

  • Hi,

    I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

    I can't seem to find any articles or blogs relating to this issue.

    Thanks for any help.

    Monday, November 3, 2014 9:16 AM

All replies

  • What cumulative update is installed?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

    • Proposed as answer by WieseLD Thursday, July 26, 2018 6:34 PM
    Monday, November 3, 2014 5:42 PM
    Moderator
  • Hi,

    Please delete the file killbit.xml and then perform IIS reset to check result.

    Here is a related thread for your reference.

    https://social.technet.microsoft.com/Forums/en-US/feff98cb-5b48-4537-b86b-8dcf41cb9992/event-id-3028-msexchangeapplcationlogic

    Hope this is helpful to you.

    Best regards,


    Belinda Ma
    TechNet Community Support

    Tuesday, November 4, 2014 5:15 AM
    Moderator
  • Thank you for your reply.

    The Exchange is 15.0.995.29 which is CU6


    Atis Smits

    Tuesday, November 4, 2014 3:03 PM
  • I tried to delete the killbit.xml file and reset the IIS. First no event was recorded and I thought that the issue has been solved but unfortunately the event was logged again with re-occurrence after 12 hours this time instead of every 6 hours as it was earlier and is now.

    Atis Smits

    Thursday, November 6, 2014 9:19 AM
  • Hi,

    Please run handle.exe on killbit.xml and check if there is any process using it.

    And please check if there is Antivirus scan running. If there is, please disable it temporarily to check result.

    Best regards,


    Belinda Ma
    TechNet Community Support

    Monday, November 10, 2014 2:07 AM
    Moderator
  • Hello, same problem here.

    Fresh install of Win 2012 R2 + Exchange 2013 SP1 updated to CU7 in the VM, no antivirus.

    I've got six times per day ID 3028 Warning

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1044.25\ext\killbit\killbit.xml' because it is being used by another process.

    I have already tried to delete killbit.xml and restart IIS but the problem persists.

    Handle.exe doesn't show anything.

    Do you have any suggestion?

    Regards,
    M.

    Monday, December 22, 2014 8:19 AM
  • I also see this about 6 to 8 times a day.  Also a fresh install of EX2013 CU7. No AV.
    Friday, January 2, 2015 6:05 PM
  • Exactly the same problem here (fresh install EX2013 CU7, no AV)

    Anyone found a solution meanwhile?

    Monday, February 23, 2015 9:51 AM
  • Same issue, new install Ex2013 CU6 no AV on VM.
    Every 6 hours

    Saturday, February 28, 2015 9:22 PM
  • @Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!

    I kindly ask you to remove that tagging.

    Saturday, February 28, 2015 9:49 PM
  • Hi all,

    Any update about this KillBit issue ?

    I have the same issue also after upgrading to CU7 of Exchange 2013.

    Thx,

    Michaël

    Friday, March 13, 2015 11:14 AM
  • Did not help

    Atis Smits

    Friday, March 13, 2015 11:46 AM
  • Did not help

    Atis Smits

    Friday, March 13, 2015 11:47 AM
  • Have done that

    Atis Smits

    Friday, March 13, 2015 11:47 AM
  • Same issue here.  Fresh install CU7 no AV.
    Friday, March 13, 2015 8:34 PM
  • Same thing for me on CU7. 
    Monday, March 23, 2015 4:43 PM
  • Same problem. Fresh install of Exchange 2013 on Windows 2008 R2 SP1. All updates and pre-req performed correctly and in order. CU7 applied. No AV.

    Rob Holmes


    Friday, March 27, 2015 12:36 PM
  • Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

    and regarding
    "@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

    I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!




    Wednesday, April 1, 2015 10:00 AM
  • You are so right about this. This seems to be a growing trend among the moderators and Microsoft staff here. The best thing you can do is report them to customer service and be sure to talk to someone outside their department.

    Rob Holmes

    Wednesday, April 1, 2015 10:54 AM
  • I'm encountering the same issue(s).  In short:

    1. We upgraded to Exchange 2013 CU7 and started seeing the same errors.
    2. As pointed out, they errors ONLY happen on Mailbox servers and not CAS servers.
    3. They appear to happen every 12 hours.  (The time moves by a minute or two each day.)

    Thanks,

    Robert
    Monday, April 13, 2015 3:50 PM
  • I have pointed out the hippocracy of the Microsoft tech's marking their own non-answers as answers for years. Nothing seems to change, they do it all the time and it is a shame. I don't have time for threads marked with answers only to find (like this one) nothing is solved.

    That said, we are using Exchange 2013 CU8 with both mailbox roles and CAS roles installed on the same machine. The full error is below.

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'E:\Exchange2013-v15\ClientAccess\owa\prem\15.0.1076.9\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    Thursday, April 23, 2015 11:27 AM
  • This issue seems to hitting many.

    We have 2 X Exchange 2013 Enterprise CAS and Mailbox roles on same servers operating under Hyper-v 2012R2.

    This issue is only occurring on the 1 Exchange node not on both.  The 2 Exchange servers are configured in a DAG.

    It does not appear to be impacting operations as far as I cal tell but would like to have a clean log.

    Hopefully this additional information can forward this topic and someone can determine the root cause.

    Rometheis Wize
    Senior ISE & Microsoft Solutions Architect
    (Direct) 416-849-2946
    rwize@it911.ca
    rsw@rometheis.com 


    Hi,

    I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

    I can't seem to find any articles or blogs relating to this issue.

    Thanks for any help.


    Thursday, April 30, 2015 8:21 PM
  • Seeing the same thing here - single 2013CU8 server with MB and CAS roles.  Operations seem OK, but I'm skeptical long term.  FWIW, this server also had an issue installing CU8 - the update kept disabling all Exchange services, I had to re-enable them at each step of installation manually via PowerShell.  Not sure if there's a relationship there?
    Friday, May 1, 2015 12:28 PM
  • Hello,

    Have this problem since CU1 (currently CU7). And don't think updating to CU8 will resolve the issue.

    Before putting this server in production, I had a support ticket at microsoft to explain those warnings and errors we already had before the server actually did something so here's the reply I had for this error :

    1. 3028 MSExchangeApplicationLogic Extension N/A Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException

    Un problème de reporting qui a apparu sur Exchange 2010, par contre, cela n’a pas été corrigé dans E15 (Exchange 2013) – il me reste à valider avec la personne en charge quelle est la suite à donner;

    (translate : A reporting problem that appeared in Exchange 2010, it was not corrected in E15)

    So I think we should stop worrying about it : another "bug" microsoft won't care to resolve.

    A good ol' "safe to ignore"

    -  


    • Edited by Splawinski Monday, May 4, 2015 2:25 PM
    Monday, May 4, 2015 2:24 PM
  • I have the same issue..
    Tuesday, September 29, 2015 8:44 PM
  • Looks like I have similar/same issue: Ex13, CU9

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1104.5\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    ALSO: 

    Scenario: GetKillBit. Failed to download killbit list from OMEX server. Exception: System.Net.WebException: The remote name could not be resolved: 'store.office.com'
       at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.BaseAsyncOmexCommand.<>c__DisplayClass2.<EndGetResponseCallback>b__1()

    Note: Yes, I can browse to store.office.com just fine.

    • Edited by Josh.Thayer Tuesday, November 10, 2015 1:22 AM
    Tuesday, November 10, 2015 1:17 AM
  • I installed Exchange 2016 and this event is still there.

    Leo

    Monday, January 18, 2016 9:22 PM
  • I can confirm that this same problem still exists in Exchange 2013 CU11.
    Tuesday, January 19, 2016 5:09 PM
  • Also confirm it is still occurring in Exchange 2016. Unbelievable.
    Wednesday, January 20, 2016 1:48 AM
  • Just got hit with this as well.  Exchange 2016 on 2012.  Nice to see Microsoft's commit to consistent results is still alive and well. :(
    Thursday, January 21, 2016 4:44 PM
  • I managed to run Handle.exe while this killbit.xml was in use. Most of the time the file is not in use, so no handles are found.

    The processes that used this killbit.xml file at the same time were w3wp.exe of these Application pools: MSExchangeOwaAppPool and MSExchangeServicesAppPool.

    Maybe someone can shed some light with this knowledge?

    Leo


    Leo

    Tuesday, January 26, 2016 10:09 AM
  • After each event 3028 you get the 3026 event: "Scenario: GetKillBit. Successfully download killbit list from OMEX server."

    Leo

    Tuesday, January 26, 2016 10:30 AM
  • So what does that mean?
    Tuesday, January 26, 2016 3:31 PM
  • If Exchange can't get it from the killbit.xml file, it will fetch it from the Omex server and - if the file doesn't exist - create a new killbit.xml.

    Contents of the killbit.xml:

    <?xml version="1.0" encoding="UTF-8"?>
    <o:assets xmlns:o="urn:schemas-microsoft-com:office:office" o:host="weu-zzz.retailer.osi.office.net,OmexStorefront_IN_1" o:corrid="b6884a4a-30b7-42b2-8a79-04634016a779" o:rr="6"/>


    Leo


    • Edited by leof Tuesday, January 26, 2016 5:05 PM
    Tuesday, January 26, 2016 5:02 PM
  • I think, value of "o:corrid ..." can be different from computer to computer ...

    =STAS=

    Tuesday, January 26, 2016 6:50 PM
  • I'm getting the same error. Happens at 4:29PM and 10:29AM each day

    Running Exchange 2013 SP1, 2012R2. I won' t bother looking at the CU version - seems to not matter

    Thursday, February 4, 2016 12:03 AM
  • Exchange 2016:

    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 17:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 11:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 11:48:52 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 16-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 23:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 23:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 17:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 11:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 11:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 15-2-2016 5:48:51 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 23:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 11:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 14-2-2016 5:48:50 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 23:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 17:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 11:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 13-2-2016 5:48:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 23:48:48 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 23:48:48 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension
    Warning 12-2-2016 6:39:49 MSExchangeApplicationLogic 3028 Extension

    It never stops...


    Leo

    Tuesday, February 16, 2016 6:03 PM
  • Same issue here. - every 6 hours

    standalone exchange 2013 Version 15.0 (Build 1130.7) no DAG

    Monday, February 22, 2016 9:44 AM
  • I too have the same problem every 6 hours. I have scoured the internet, tried the delete and restart the service fix, restarted the server, and tried everything but powdered bat wings and still no solution. It is amazing to me that MSFT will let this problem remain through three iterations of one of their prestige products,
    Wednesday, February 24, 2016 10:36 PM
  • Wow I can't believe this is still a problem in the recent Exchange CU's and even in 2016!!!!

    I use an event monitoring system called Event Sentry so I guess I will just create a filter and exclude this one.  Our Exchange 2013 CU6 is running fine.  I know its a little behind in the CU updates, but if it ain't broke, don't fix it.

    Tuesday, March 15, 2016 5:41 PM
  • I updated my exchange 2013 to CU 12 still I have the same problem, I open a ticket with Microsoft support I will keep you update it.
    Wednesday, April 6, 2016 6:41 AM
  • I also just updated an Exchange 2013 server to CU 12 and continue to have the problem. All eyes are on you Simssa
    Thursday, April 7, 2016 8:51 PM
  • "Hippocracy."  Is that a government fun by hippopotamuses?


    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Thursday, April 7, 2016 11:47 PM
    Moderator
  • @Simsaa: Any news on your ticket?
    Wednesday, April 20, 2016 8:11 AM
  • Hey Simssa,You still awake out there. It's been 3 weeks. Those boys at Redmond come up with anything??

    Wednesday, April 27, 2016 7:37 PM
  • It's been over a month since Simssa opened his ticket and nothing. Anyone else had any success in clearing this error?
    Tuesday, May 10, 2016 1:49 PM
  • I'd check your AV exclusions.  Again, look at the error.  The file is in use by another process. 

    You could also take a look at process explorer, see what process is accessing that file. 

    Any time we see files which are locked and cannot be accessed by another process, the key is finding out what file(s) are accessing it and why. 


    Tuesday, June 7, 2016 3:54 PM
  • All Exchange locations are excluded on my Exchange server.
    And, as I stated before:

    "I managed to run Handle.exe while this killbit.xml was in use. Most of the time the file is not in use, so no handles are found.   The processes that used this killbit.xml file at the same time were w3wp.exe of these Application pools: MSExchangeOwaAppPool and MSExchangeServicesAppPool""

    I have no idea why they would want to access killbit.xml.


    Leo

    Tuesday, June 7, 2016 5:04 PM
  • I just applied CU13 to Exchange 2013 and the problem still exists! Drat!
    Sunday, June 26, 2016 4:21 PM
  • I noticed the same thing on windows 2012 with Exchange 2013.  this event is logged every 6 hours

    chanwingkai

    Thursday, August 25, 2016 1:51 AM
  • The upgrade to CU14 didn't help either. Double drat. I wonder what the average lifetime is for a Microsoft "non-critical" error.
    Sunday, October 23, 2016 8:38 PM
  • Installed CU3 on Exchange 2016. Warnings 3028 still occur.

    Leo

    Saturday, November 12, 2016 9:44 AM
  • I have tried all the suggestions but still have this error coming up as well.  Adding this thread to my alerts, hopefully someone will come up with some info one day.
    Tuesday, November 22, 2016 11:08 PM
  • Exchange 2013 CU15 on 2012 R2.. still happening

    Norman Schlorke

    • Proposed as answer by Norman Scorpion Wednesday, December 28, 2016 7:31 PM
    • Unproposed as answer by Norman Scorpion Wednesday, December 28, 2016 7:31 PM
    Wednesday, December 28, 2016 6:33 PM
  • Same here, and I had such great hopes for this update!
    Wednesday, December 28, 2016 10:22 PM
  • Same problem here, clean new installation of Ex2016 CU2.

    Monday, January 2, 2017 4:46 PM
  • Thank god some of you have a sense of humour, otherwise this thread would have been tedious to read.

    Ex2016 CU4 - can report same issue as some of my frustrated peers above =)

    "please fix" 


    Wednesday, January 11, 2017 2:53 PM
  • I can't believe this thread won't die.  Is this still a problem?
    Thursday, January 12, 2017 12:30 AM
  • Yepp, Exchange 2013 CU15.

    -Ray.

    Tuesday, January 17, 2017 10:05 AM
  • Same problem here, clean new installation of ex2016 cu4 and got event 14005 too....

    Wednesday, March 15, 2017 3:02 AM
  • Same problem here. Exchange 2016 cu4 new installation...
    Monday, March 27, 2017 2:01 PM
  • Using Exchange 2016 CU 5 and it still is happening.  This is ridiculous.
    Thursday, April 6, 2017 6:00 PM
  • I just applied Exchange 2013 CU16 and the error messages are still happening. The saga continues....
    Monday, April 10, 2017 8:31 PM
  • Same with Exchange 2013 CU17
    Saturday, July 8, 2017 4:12 PM
  • Fresh install Exchange Server 2016 CU on Windows Server 2016 Standard;

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.1.1034.26\ext\killbit\killbit.xml' because it is being used by another process.
       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)


    Hello!

    Tuesday, July 25, 2017 1:44 PM
  • Hi there,

    also having the same issue with Exchange 2013 und CU17 on Win Server 2012 R2.

    I can see 2 reasons for this:

    1) Microsoft doesn't care about it.
    or
    2) Microsoft is not able to solve the problem.

    Both of them are absolutely embarrassing.
    The time I need to google all these problems takes hours and hours without getting any solution.
    I'll never use Exchange-Server again!

    Tuesday, August 1, 2017 2:03 AM
  • Still there with 2013 CU18
    Sunday, October 22, 2017 5:55 PM
  • I have Exchange 2016 CU7 installed. Same issue....

    Any progress from Microsoft?

    Tuesday, October 24, 2017 4:02 PM
  • Exchange 2016 CU 7 problem still exists!
    Friday, November 24, 2017 11:11 PM
  • I've installed Exchange 2016 CU7 on Server 2016 Standard. The problem still exists!
    Saturday, November 25, 2017 8:34 AM
  • Hi

    Same problem 2016 CU 7 2012 R2 Standelone No AV

    Thursday, December 7, 2017 1:02 PM
  • I notice that the errors appear in groups of 3 at exactly the same time right to the second. Then there is a 4th entry where the killbit file is downloaded from the Microsoft OMEX server.
    Sunday, December 24, 2017 7:44 PM
  • I will say this for Microsoft, they are consistent. I just installed CU19 and there is my little Application Logic 3028 buddy again. I will probably miss it when it's gone, but there is probably no chance of that.
    Thursday, January 11, 2018 10:05 PM
  • NO CHANGE ON EXCH 2016 CU8
    Monday, March 5, 2018 1:07 PM
  • I just applied CU20 to Exchange 2013. Once the update was applied I had a critical error because of a certificate problem with ipport 444. I fixed that and I haven't had a 3028 since. Was it the cert problem or was it fixed in CU20? I have no idea but I sure like the looks of my logs now! It's only been one day so I will feel better after a week with no errors.
    Monday, April 16, 2018 9:44 PM
  • Installed CU20 yesterday, but the problem persists.

    @NMCowboy: What did you change regarding your certificate problem?

    Thursday, April 19, 2018 7:45 AM
  • First, let me revise my message as of the 16th. I did not get rid of the 3028's entirely. I have reduced the number of occurrences, and stretched out the interval time, but there are still some there. Drat, I thought I had it.

    As to the certificate problem on port 444 I had a thumbprint specified for a certificate that no longer existed. Why didn't I get an error with CU19? I have no idea, but there was probably some logic changes in CU20 that made it boil to the top. But once I saw the error in the event logs I ran netsh http show sslcert and the first 2 listings were for ports 443 and 444. I saw right away that the thumbprint for the cert specified for port 444 did not exist. So I just copied the thumbprint specified for port 443 and did a netsh http add sslcert ipport=0.0.0.0:444 using the certhash and appid from 443 and the error disappeared.  I didn't even have to restart.

    Monday, April 23, 2018 4:10 PM
  • This has actually started happening with increased frequency on my Exchange 2016 CU9 system....  right around the time my backups kick off....

    Tim Magnuson | MCTS, MCITP | MCCA 2011 |
    Ok, so I changed my name...you can still call me Tom if you like. It's a...jump...to conclusions...mat.
    My Blog Site: http://tmagnuson.wordpress.com

    Tuesday, May 1, 2018 3:11 PM
  • Windows 2016 DataCenter Fresh Install

    Exchange 2016 Enterprise DAG Two Nodes

    I get the same event over and over.

    If this can be ignored then when preset the message we have enough events to review

    Can someone please come up with a solution

    Thank you,


    Thomas R Grassi Jr

    Friday, June 8, 2018 8:46 PM
  • After all this time I can't believe it. Last Sunday I rolled on Exchange 2013 CU21. I had to install VC++2103 before I could pass the prerequisite step, but then everything completed ok. I checked the next morning and I had 2 instances of Event ID:3028 from the day before, but get this! I haven't had one since. I used to get 5 or 6 a day, but the last 3 days, Nothing!! My error log is clean.
    Wednesday, July 11, 2018 6:46 PM
  • We still get 4 entries every 6 hours (Exchange 2013 CU21).
    Tuesday, July 17, 2018 8:28 AM
  • The same here. Exchange 2016 on Windows 2016.
    Friday, August 24, 2018 3:40 PM
  • Same issue here - Exchange 2013 CU19.
    Friday, September 14, 2018 1:11 PM
  • Same event on ONE server in two-node dag Exchange 2013 CU21

    As NMCowboy wrote, really during the update to latest cu (21) I installed VC++2013 as a prerequisite, while the other server updated without any prompts and got only VC++ 2008 and 2012 installed with no error 3028 in log.

    Monday, September 17, 2018 7:38 AM
  • Same error here with Server 2016 and Exchange Server 2016 still CU10. If there is a possible solution based by VC++, I would be interested in which versions on the systems without error are installed.

    Our system has installed

    2010 x86 + x64
    2012 x86 + x64
    2013 only x64 (!)
    2015 x86 + x64

    Regards
    Jo


    • Edited by joschl Monday, December 10, 2018 1:57 PM
    Monday, December 10, 2018 1:33 PM
  • This problem has existed for 4+ years. It has existed through 3 versions of Exchange. We are just banging our heads against a stone wall,  searching for solutions, trading symptoms, etc. It is now obvious to the most casual observer that Microsoft has no interest in solving this  problem. 20 or 30 years ago Microsoft would never say "Just ignore that error, it's  not important." Really! What if we have 20 or 30 warning errors? Should  we just ignore them all? Why do we have an event log if the advise we get from Microsoft is "Just ignore the messages"? I personally am fed up with this attitude.  I guess that there is not anything I can do about it, but I am really disappointed with their attitude.
    Sunday, January 27, 2019 8:38 PM
  • 2013 CU 21 here, issue with all 4 events occurring every 6 hours
    Tuesday, February 5, 2019 2:40 PM
  • I am getting this event right before the server bluescreens and reboots.   It happened to correspond with Unintrends backup agent beginning a full backup.  also, the volume shadow copy service started was the last event log message before the blue screen... anyone else seeing a correlation between backups and this error?  Similarly, our virtual exchange server crashes when being checkpointed unless it's in maintenance mode.  Anyone else seeing a correlation between backups and this error? we are on exchange 2016 RTM.

    Tuesday, February 5, 2019 9:50 PM
  • Exchange 2016 CU 11 German DAG servers, same odd problem.

    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: Der Prozess kann nicht auf die Datei "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.1.1591.12\ext\killbit\killbit.xml" zugreifen, da sie von einem anderen Prozess verwendet wird.

    What I can see, is that just before the error is occouring every 6 hours, there is this eventlog everytime:

    Informationen	05.03.2019 07:34:05	MSExchangeIS	1041	General
    Microsoft Exchange Information Store service has completed an internal schema upgrade on (Folder) (b10bb4fc-3b16-4a4a-864e-2287c3abf244[1]-128108630). The upgrade has brought the version from (0.143) to (0.174).

    And afterwards i can see:

    Informationen	05.03.2019 07:34:25	MSExchange Mid-Tier Storage	9000	(9)
    [Process:w3wp PID:19892 Thread:19] Successfully populated ServiceTopology. Reason to populate ServiceTopology = RefreshTimeout

    I wonder, if this does would not have someting to to with the issue.

    For the case it is to be narrowed down to Visual C++ Runtimes, here is, what is installed on our Exchange Servers:

    Name                                                                                  Version         
    7-Zip 9.20 (x64 edition)                                                              9.20.00.0       
    IIS-URL-Rewrite-Modul 2                                                               7.2.1980        
    Microsoft Exchange 2007 Enterprise Anti-spam Signatures                               3.3.4604.600    
    Microsoft Exchange 2007 Enterprise Block List Updates                                 3.3.4604.001    
    Microsoft Exchange 2007 Standard Anti-spam Filter Updates                             3.3.4604.600    
    Microsoft Exchange Server                                                             15.1.1591.10  
    *** dozends of Language packs                                                                
    Microsoft Exchange Client Language Pack - xxx                                         15.1.1591.10
    Microsoft Exchange Server Language Pack - xxx                                         15.1.1591.10    
    Microsoft Lync Server 2013, Bootstrapper Prerequisites Installer Package              5.0.8308.0      
    Microsoft Server Speech Platform Runtime (x64)                                        11.0.7400.345   
    *** dozends of Microsoft Server Speech Recognition Languages
    Microsoft Server Speech Recognition Language - TELE xxx                               11.0.7400.345
    Microsoft Server Speech Text to Speech Voice (en-US, Helen)                           11.0.7400.345   
    Microsoft Speech Platform VXML Runtime (x64)                                          11.0.7400.345   
    Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit                 5.0.8308.0      
    Microsoft Unified Communications Managed API 4.0, Runtime                             5.0.8308.0      
    Microsoft Unified Communications Managed API 4.0, SSP Runtime                         5.0.8308.0      
    Microsoft Visual C++ 2005 Redistributable                                             8.0.61001       
    Microsoft Visual C++ 2005 Redistributable (x64)                                       8.0.61000       
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161                        9.0.30729.6161  
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161                        9.0.30729.6161  
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219                           10.0.40219      
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219                           10.0.40219      
    Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610                         11.0.60610      
    Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610                            11.0.60610      
    Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005                         12.0.21005      
    Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005                            12.0.21005      
    Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.23918                         14.0.23918      
    Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.23918                            14.0.23918      
    Microsoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325                        14.11.25325     
    Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.11.25325                           14.11.25325     
    Microsoft Web Platform Installer 5.0  
    Nutanix Checks & Prereqs                                                              1.2.2.0         
    Nutanix Guest Agent                                                                   1.2.2.0         
    Nutanix Guest Tools Infrastructure Components Package 1                               1.2.2.0         
    Nutanix Guest Tools Infrastructure Components Package 2                               1.2.2.0         
    Nutanix Self Service Restore                                                          1.2.2.0         
    Nutanix VM Mobility                                                                   1.1.1.0         
    Nutanix VSS Modules 1.1.0                                                             1.1.0.0         
    Symantec Endpoint Protection                                                          14.2.770.0000   
    Universal Agent Framework                                                             1.0.21.0   

    AV exclusions exist.

    All Warnings of yesterday:

    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 19:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 13:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 07:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028
    Warning	05.03.2019 01:34	MSExchangeApplicationLogic	3028








    • Edited by L_Herzog Wednesday, March 6, 2019 9:04 AM
    Wednesday, March 6, 2019 8:47 AM
  • I am getting this event right before the server bluescreens and reboots.   It happened to correspond with Unintrends backup agent beginning a full backup.  also, the volume shadow copy service started was the last event log message before the blue screen... anyone else seeing a correlation between backups and this error?  Similarly, our virtual exchange server crashes when being checkpointed unless it's in maintenance mode.  Anyone else seeing a correlation between backups and this error? we are on exchange 2016 RTM.


    Sorry, I cannot see a correlation between backup and the killbit eventlog here. Even though we are taking a (HyCU) backup every 6 hours of the servers, the eventlog appears about one hour after the backup is finished.



    • Edited by L_Herzog Wednesday, March 6, 2019 10:03 AM
    Wednesday, March 6, 2019 9:08 AM
  • as stated by others: "safe to ignore"

    Why? The file is actually downloaded. In our case from jpe-001.retailer.osi.office.net

    In Process Monitor and by the filestamp we can say that the file is modified / updated despite of the Warning in eventlog that the file is permanently in use by the w3wp.exe processes.

    to reduce the ammount of Warnings in eventlog, you can change the killbit refresh rate from every 6 hours to once per day as described here:

    https://support.microsoft.com/en-us/help/3110766/msexchangeapplicationlogic-event-3018-in-exchange-server-2013

    process monitor killbit download


    • Edited by L_Herzog Wednesday, March 20, 2019 3:11 PM url change
    • Proposed as answer by L_Herzog Wednesday, March 20, 2019 3:11 PM
    Wednesday, March 20, 2019 3:08 PM
  • try to enable internet connectivity for the Exchange servers (port 80 and 443) and/or configure Exchange server proxy settings with "Set-ExchangeServer -InternetWebProxy"

    You have to wait afterwards. Not sure if an IISRESET /noforce /timeout:120 might help but i did not tested this since i was working in a productive environment.

    at least this solved this issue in my case after waiting a few hours.

    would be nice to hear if this helps others too.

    Regards


    • Edited by PrayingMoses Wednesday, April 17, 2019 7:24 AM
    • Proposed as answer by PrayingMoses Wednesday, April 17, 2019 7:36 AM
    Wednesday, April 17, 2019 7:24 AM
  • Installed CU22 yesterday and since then, I only get one entry every 6 hours instead of four before. Woohoo progress, Microsoft...
    Thursday, April 25, 2019 9:35 AM
  • Aaaaand it's back to four entries again.
    Friday, April 26, 2019 10:15 AM
  • I find the answer proposed by L_HERZOG (a couple of messages up) does the trick.
    Tuesday, June 25, 2019 2:56 PM
  • Not the best way and more a dirty hack, but you can try to suppress these warnings in "Administrative Events" by using the <suppress>  XML filter statement till MS has fixed this issue (if they do so anytime).

    Copy the write protected "Administrative Events" to "Filtered Administrative Events" and there insert the following line

    <Suppress Path="Application">*[System[(EventID=3028)]] and *[EventData[Data='ProcessKillBit']]</Suppress>

    into the filter xml statement like this:

    <QueryList>

      <Query Id="0" Path="Application">

        <Select Path="Application">*[System[(Level=1  or Level=2 or Level=3)]]</Select>

        <Suppress Path="Application">*[System[(EventID=3028)]] and *[EventData[Data='ProcessKillBit']]</Suppress>

    ...

    ...

      </Query>

    </QueryList>

    This way these events are not longer shown in this specific view.

    Tuesday, September 3, 2019 11:18 AM
  • What cumulative update is installed?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

    This is not solved, <style></style>

    Knut W

    Friday, October 18, 2019 10:24 AM
  • I had this error from first day when we have installed Exchange 2013 4 years ago and now on latest CU23 is still there. Every 6 hours same error. This is so disappointing Microsoft
    Sunday, November 24, 2019 8:51 AM
  • just felt need to post, that the issue is still happening in Exchange 2016 CU15 from late December 2019  :-(

    In
    C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\exchweb\ews\web.config
    they also removed the previously added line
    <add key = "KillBitRefreshTimeInSeconds" value = "86400" />

    On the other hand, they added it to
    C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\Owa\web.config


    • Edited by L_Herzog Friday, January 3, 2020 9:47 AM
    Friday, January 3, 2020 9:34 AM
  • Can confirm this happens in exchange server 2019 fresh install as well. 3 Entries or so per day all the same thing as everyone else has described so even on exchange 2019 this is still an issue. Running in VM on hyper V and only role it has. Standalone mailbox server only.

    Just as en edit there are other errors that crop up on this fresh install as well of exchange 2019 from schannel errors to 6004 error failing to write to log files etc etc. Just a slew of warnings or errors that did not occur until installing exchange. All servers running server 2019 as well and with the latest OPS, Updates, and version of Exchange and still have the "safe to ignore" errors and warnings that fill up the event viewer.


    • Edited by JDickson1972 Wednesday, January 8, 2020 12:42 AM
    Wednesday, January 8, 2020 12:37 AM