Monitor unlimited number of servers
Filter log events
Create email and web-based reports
Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content
Event ID: 1173 Source: MSExchangeISMailboxStore
Source
Level
Description
Error 0x6bb deleting unused restricted view from folder <folder> on database <database>. Microsoft Exchange Information Store will try to delete the view again at the next maintenance interval.
English
This information is only available to
subscribers. An example of English, please!
Concepts to understand
Comments
In theory, this event can be recorded with several types of error codes but in practice only Error code 0x6bb is encountered. Error code 0x6bb (in hex) corresponds to Error code 1723 (decimal) also known as "The RPC server is too busy to complete this operation.". See the link to Error code 1723 for some information about this particular error message.
This problem occurs because a counter is incremented every time that a recurring meeting is modified. This counter eventually reaches a limit. This limit blocks additional modifications. See ME943721 for a hotfix applicable to Microsoft Exchange Server 2003.
See ME913126 for additional information about this event (it states that you can ignore any errors referencing code 0x6bb).
See ME913126 for additional information about this event (it states that you can ignore any errors referencing code 0x6bb).
As per Microsoft: "An error resulted during an attempt to delete an unused restricted view. By default, unused views are deleted if not used for a specified amount of time. The folder may be in use by another process, or permissions are prohibiting this action. The view may have already been deleted". See MSEX2K3DB for more details.
From a newsgroup post: "Regarding the event 1173 from source MSExchangeIS, based on my knowledge, it happens when online maintenance is performed. It is not related to an IMAP logon issue.
Basically, we can simply ignore these events. When an Online maintenance is performed, users can still access the Exchange Stores, thus some data in the Store may be locked by these users and cannot be maintained. This is a normal behavior. If no user accesses this data in the next maintenance interval, it will then be maintained at that time. As to the "View", it refers to the detailed database structure of the Mailbox Store. We can also ignore it.
We also recommend you schedule a time to perform an offline defragmentation to maintain your Exchange environment. No user will be able to access the Exchange Server thus this is more effective:
1). In Exchange System Manager, right click the Store, click Properties. Then, copy the "Exchange database" path in the Database tab. For your information, my path is: E:\Program Files\Exchsrvr\mdbdata\priv1.edb.
2). Dismount the Store.
3). Click Start -> Run, type "cmd", and press Enter.
4). Use the "cd" command to enter the following directory "E:\Program Files\Exchsrvr\bin".
5). Enter the following command and press Enter:
esetuil /d "E:\Program Files\Exchsrvr\mdbdata\priv1.edb".
For your information, a successful output is similar to the following information:
Initiating DEFRAGMENTATION mode...
Database: E:\Program Files\Exchsrvr\mdbdata\priv1.edb
Streaming File: E:\Program Files\Exchsrvr\mdbdata\priv1.STM
Temp. Database: TEMPDFRG2880.EDB
Temp. Streaming File: TEMPDFRG2880.STM
Defragmentation Status (% complete).
6). Mount the Store again".
From a newsgroup post: "Regarding the event 1173 from source MSExchangeIS, based on my knowledge, it happens when online maintenance is performed. It is not related to an IMAP logon issue.
Basically, we can simply ignore these events. When an Online maintenance is performed, users can still access the Exchange Stores, thus some data in the Store may be locked by these users and cannot be maintained. This is a normal behavior. If no user accesses this data in the next maintenance interval, it will then be maintained at that time. As to the "View", it refers to the detailed database structure of the Mailbox Store. We can also ignore it.
We also recommend you schedule a time to perform an offline defragmentation to maintain your Exchange environment. No user will be able to access the Exchange Server thus this is more effective:
1). In Exchange System Manager, right click the Store, click Properties. Then, copy the "Exchange database" path in the Database tab. For your information, my path is: E:\Program Files\Exchsrvr\mdbdata\priv1.edb.
2). Dismount the Store.
3). Click Start -> Run, type "cmd", and press Enter.
4). Use the "cd" command to enter the following directory "E:\Program Files\Exchsrvr\bin".
5). Enter the following command and press Enter:
esetuil /d "E:\Program Files\Exchsrvr\mdbdata\priv1.edb".
For your information, a successful output is similar to the following information:
Initiating DEFRAGMENTATION mode...
Database: E:\Program Files\Exchsrvr\mdbdata\priv1.edb
Streaming File: E:\Program Files\Exchsrvr\mdbdata\priv1.STM
Temp. Database: TEMPDFRG2880.EDB
Temp. Streaming File: TEMPDFRG2880.STM
Defragmentation Status (% complete).
6). Mount the Store again".
Windows Event Log Analysis Splunk App
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Cisco ASA Log Analyzer Splunk App
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.