Event ID: 1173 Source: MSExchangeIS Mailbox Store

Event ID/Source search

Keyword search

Example: Windows cannot unload your registry file

EventID.Net Splunk Add-on

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.

Event ID: 1173 Source: MSExchangeIS Mailbox Store

Source: MSExchangeIS Mailbox Store

Type: Error

Description:
Error 0x6bb deleting unused restricted view from folder <folder> on database <database>. Microsoft Exchange Information Store will try to delete the view again at the next maintenance interval.

English: This information is only available to subscribers. An example of English, please!

Concepts to understand:
What is an RPC?
What is the role of the Microsoft Exchange Information Store service?

Comments:
EventID.Net
In theory, this event can be recorded with several types of error codes but in practice only Error code 0x6bb is encountered. Error code 0x6bb (in hex) corresponds to Error code 1723 (decimal) also known as "The RPC server is too busy to complete this operation.". See the link to Error code 1723 for some information about this particular error message.
Click if the comment is good!

^{x
8}

EventID.Net
This problem occurs because a counter is incremented every time that a recurring meeting is modified. This counter eventually reaches a limit. This limit blocks additional modifications. See ME943721 for a hotfix applicable to Microsoft Exchange Server 2003.

See ME913126 for additional information about this event (it states that you can ignore any errors referencing code 0x6bb).
Click if the comment is good!

^{x
7}

EventID.Net
As per Microsoft: "An error resulted during an attempt to delete an unused restricted view. By default, unused views are deleted if not used for a specified amount of time. The folder may be in use by another process, or permissions are prohibiting this action. The view may have already been deleted". See MSEX2K3DB for more details.

From a newsgroup post: "Regarding the event 1173 from source MSExchangeIS, based on my knowledge, it happens when online maintenance is performed. It is not related to an IMAP logon issue.
Basically, we can simply ignore these events. When an Online maintenance is performed, users can still access the Exchange Stores, thus some data in the Store may be locked by these users and cannot be maintained. This is a normal behavior. If no user accesses this data in the next maintenance interval, it will then be maintained at that time. As to the "View", it refers to the detailed database structure of the Mailbox Store. We can also ignore it.
We also recommend you schedule a time to perform an offline defragmentation to maintain your Exchange environment. No user will be able to access the Exchange Server thus this is more effective:
1). In Exchange System Manager, right click the Store, click Properties. Then, copy the "Exchange database" path in the Database tab. For your information, my path is: E:\Program Files\Exchsrvr\mdbdata\priv1.edb.
2). Dismount the Store.
3). Click Start -> Run, type "cmd", and press Enter.
4). Use the "cd" command to enter the following directory "E:\Program Files\Exchsrvr\bin".
5). Enter the following command and press Enter:
esetuil /d "E:\Program Files\Exchsrvr\mdbdata\priv1.edb".
For your information, a successful output is similar to the following information:
   Initiating DEFRAGMENTATION mode...
   Database: E:\Program Files\Exchsrvr\mdbdata\priv1.edb
   Streaming File: E:\Program Files\Exchsrvr\mdbdata\priv1.STM
   Temp. Database: TEMPDFRG2880.EDB
   Temp. Streaming File: TEMPDFRG2880.STM
   Defragmentation Status (% complete).
6). Mount the Store again".
Click if the comment is good!

^{x
13}

Private comment: Subscribers only. See example of private comment

Links: ME913126, ME943721, MSEX2K3DB, Error code 1723

Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...

Custom search for *****: Google - Bing - Microsoft - Yahoo

Feedback: Send comments or solutions - Notify me when updated

Printer friendly