Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8331 Source: MSExchangeAL

Source
Level
Description
The service threw an unexpected exception which was caught at <path to lservagent.cpp>(<process id>)
Comments
 
In my case, in order to fix the errors, I performed a Recipient Update Service rebuild on a SBS 2003 server.
As per Microsoft: "This event is logged when the Recipient Update Service cannot stamp Exchange attributes on Active Directory objects. When this event is being logged, users may not appear in the Global Address List (GAL). Additionally, users may not be able to access their Exchange mailboxes. These GAL display problems and mailbox access problems may occur if an internal class incorrectly processes certain threads that run at the same time". See MSEX2K3DB for more details.

From a newsgroup post: "My guess is that there are bugs in the Recipient Update Service, that manifest this error when rapid changes are made to a user’s AD attributes. Probably these changes are being made across the RUS update cycle and the attributes get out of sync. After looking at MS KB ME821908, I noticed that some administrator accounts had the “showInAddressBook” attribute out of sync with AD U&C. These were mailboxes that I had toggled the checkbox off and on a few times. Then I did the following:
1) Removed the "Hide From Exchange Address List" attribute of an administrator account that I had previously set.
2) Changed the update interval of "The Recipient Update Service" (which of course is not a real service and thus causes the entire MS SA and IS to have to be restarted) to be only every 4 hours.
3) Restarted SA/Exchange for the settings to take effect.
I then was able to enable the “Hide” function in AD Users & Computers for my account, manually run the Recipient Update Service, and have everything work properly without an error".

Several users stated that installing the Exchange 2003 Service Pack 1 solved this problem for them. From a newsgroup post: "Prior to installing Exchange 2003 SP1, you will need to install hotfix ME831464. Then after installing Exchange 2003 SP1 install ME843539 to get OWA back to where you should; you just need to enter in your username/password for OWA instead of domain\username".
There is a hotfix available for this problem, and is available from Microsoft Product Support Services. Go to http://support.microsoft.com to find the number for your local MS PSS centre - give them a call. The call is free of charge. Details on this error will be appearing under KB article 837444 soon. This hotfix will also be included in the service pack for Exchange 2003.
Note! This hotfix is for Exchange 2003 only. For more info on this event - please see the "E-Bitz - SBS MVP the Official Blog" link. The article is dated March 19, 2004.
See WINSUG SBS 2003 Info link. This has been determined to be a bug for Exchange 2003.
The upcoming MS KnowledgeBase article is ME837444. As of March 23, 2004, the hotfix has been through about 80% of the testing it will get before becoming publicly available.


No need to totally restart the server, or waste time with "setup /forestprep" and "setup /domainprep". Just restart the MSE System Attendant service.
Path: y:\dsa\src\lra\abv_dg\lservagent.cpp - Reported on W2K3 running Exchange 2003 - no additional info

Path: f:\titanium\dsa\src\lra\abv_dg\lservagent.cpp - Reported on Small Business Server 2003.
From a newsgroup post: "Try re-running setup /forestprep and setup /domainprep and then restarting all of the Exchange services."

From a newsgroup post: "Domainprep & ForestPrep perform the following tasks:
1. Extends the Active Directory schema to include Exchange-specific information. This affects the entire forest and, depending on the size of Active Directory, may take a considerable amount of time to complete.
2. Assigns the Exchange Full Administrator role to the account that you specify during the ForestPrep process.
They do not reinstall Exchange, nor will they affect the Exchange Information Store. However, it is strongly recommended restarting the SBS server after performing Domainprep & ForestPrep. On the servers giving the 8331, we have seen the issues like when adding a user or group, you find they are not added in the Global Address list".

Other newsgroup posts suggest a restart but warn that the error will start again after 2-3 days.
Path: "f:\titanium\dsa\src\lra\abv_dg\lservagent.cpp" - In my case, the event was reported 1-2 times per minute and the address lists were not updated. Restarting the server fixed the problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...