Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: MSExchangeIS Mailbox Store|
Error 0x6bb deleting unused restricted view from folder <folder> on database <database>. Microsoft Exchange Information Store will try to delete the view again at the next maintenance interval.
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What is an RPC?
What is the role of the Microsoft Exchange Information Store service?
In theory, this event can be recorded with several types of error codes but in practice only Error code 0x6bb is encountered. Error code 0x6bb (in hex) corresponds to Error code 1723 (decimal) also known as "The RPC server is too busy to complete this operation.". See the link to Error code 1723 for some information about this particular error message.
This problem occurs because a counter is incremented every time that a recurring meeting is modified. This counter eventually reaches a limit. This limit blocks additional modifications. See ME943721 for a hotfix applicable to Microsoft Exchange Server 2003.
See ME913126 for additional information about this event (it states that you can ignore any errors referencing code 0x6bb).
As per Microsoft: "An error resulted during an attempt to delete an unused restricted view. By default, unused views are deleted if not used for a specified amount of time. The folder may be in use by another process, or permissions are prohibiting this action. The view may have already been deleted". See MSEX2K3DB for more details.
From a newsgroup post: "Regarding the event 1173 from source MSExchangeIS, based on my knowledge, it happens when online maintenance is performed. It is not related to an IMAP logon issue.
Basically, we can simply ignore these events. When an Online maintenance is performed, users can still access the Exchange Stores, thus some data in the Store may be locked by these users and cannot be maintained. This is a normal behavior. If no user accesses this data in the next maintenance interval, it will then be maintained at that time. As to the "View", it refers to the detailed database structure of the Mailbox Store. We can also ignore it.
We also recommend you schedule a time to perform an offline defragmentation to maintain your Exchange environment. No user will be able to access the Exchange Server thus this is more effective:
1). In Exchange System Manager, right click the Store, click Properties. Then, copy the "Exchange database" path in the Database tab. For your information, my path is: E:\Program Files\Exchsrvr\mdbdata\priv1.edb.
2). Dismount the Store.
3). Click Start -> Run, type "cmd", and press Enter.
4). Use the "cd" command to enter the following directory "E:\Program Files\Exchsrvr\bin".
5). Enter the following command and press Enter:
esetuil /d "E:\Program Files\Exchsrvr\mdbdata\priv1.edb".
For your information, a successful output is similar to the following information:
Initiating DEFRAGMENTATION mode...
Database: E:\Program Files\Exchsrvr\mdbdata\priv1.edb
Streaming File: E:\Program Files\Exchsrvr\mdbdata\priv1.STM
Temp. Database: TEMPDFRG2880.EDB
Temp. Streaming File: TEMPDFRG2880.STM
Defragmentation Status (% complete).
6). Mount the Store again".
|Private comment: Subscribers only. See example of private comment|
|Links: ME913126, ME943721, MSEX2K3DB, Error code 1723|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated