Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9175 Source: MSExchangeSA

The MAPI call 'OpenMsgStore' failed with the following error: The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. The MAPI provider failed. Microsoft Exchange Server Information Store
ID no: 8004011d-0526-00000000.
We received this error when our Trans Log Drive filled causing Storage Group 3 to dismount itself. It was due to an EMC Networker issue. We remounted the Storage group and everything was fine.
In my case (SBS 2003, Exchange SP2) the limit of the Exchange database was reached (18GB). Solution: Create D-Word with Name "Database Size Limit in GB" in [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<SERVER NAME>\Private-<GUID of the database>] and set the value to 75 (e.g. new size = 75GB). See the link to “Exchange Server 2003Database Size Limit Configuration and Management” for more details on this issue.
Does the drive that contains the database files have enough space available? I received this error when it ran out of space.
This can also occur after installing Windows 2003 SP2 on SBS 2003 servers. Information store database limits are reset. This event is preceded by "EventID 9689 from source MSExchangeIS Mailbox Store" and "EventID 9690 from source MSExchangeIS Mailbox Store". “Database Size Limit Configuration and Management” documents the registry changes you need to implement.
I had this error on a freshly installed Win 2003 R2. I tried many things like re-creating stores, MDBdata, reinstalling Exchange + SP2 for no result. The problem was that the "%systemroot%\system32\mapi32.dll" file was corrupted. After this DLL was replaced with a copy from a working server, all was fine.

This problem occurs if the mailbox store that contains the System Attendant mailbox is not mounted. See ME924730 for information on fixing this issue.

This event can occur if you modify the default permissions on Microsoft Exchange Server 2003 mailbox stores and public folder stores. See the link to "Working with Store Permissions" for details.

This event can occur when you try to restart the Microsoft Exchange Information Store service because the streaming file (.stm) for the Exchange store is damaged. See ME320705 for a way to resolve this issue.

See ME905802 and ME918006 for additional information about this problem.
As per Microsoft: "In essence, this message indicates that the System Attendant process has been unable to log on to the Mailbox Store or Public Store. This event can have several causes and the ID number in the Description section of the event will be the only difference between the events. Depending on what the underlying cause of the problem is, the ID number will vary". See MSEX2K3DB for more details on this event.

As per Microsoft: "This issue may occur if the System Attendant and the Information Store services are not using the local system account". See ME327352, ME274534, ME288700, ME290215, ME296933, ME313184, ME315250, ME321102, ME329685, ME823022, ME888179, ME896143, and ME896703 to fix this problem.

ME288894 provides information on how to disable MAPI client access to an Exchange Server 2003 computer or to an Exchange 2000 Server computer.
This message will occur repeatedly whenever the Info Store is not mounted. This would occur naturally if you are running an offline defrag or have set the Info Store to "Do not mount this store at startup" in System Manager.
Why would you have an Info Store set to not mount at start up? Because you have just done a restore of a server and you have more current data files than the restore for one reason.
Check to see if E00.log is missing or is no longer in the Exchsrvr\Mdbdata folder or in the log file folder. According to Microsoft’s ME895856 article: "This condition may occur if a file-based virus scanner moves the E00.log file to the Quarantine folder. File-level antivirus scanners sometimes locate data that matches a known virus signature in an Exchange log file. Therefore, the virus scanner may determine that the log file contains a virus and then move the log file to the Quarantine folder". KB article ME313184 offers detailed steps to test and repair this situation.
Error received along with EventID 9518 from source MSExchangeIS. Attempting to mount mail stores may terminate with message, that store cannot be mounted due to corruption. Before attempting any repair/restoration, I checked the store properties/permissions. Everyone account was granted no permissions. Granting the Everyone account standard user permissions and applying, then attempting to remount the stores, resulted in a successful mount without any further action required. I am not personally sure at this time whether changing Everyone account permissions for the stores is strictly by-the-book, but it did the trick in this case.
I got this error when the information store service went to a stopped state. I could simply reboot the server or start the service and it would run for a couple of hours. The error was due to me running a beta version of Exchange 2003 that expired.
I saw this event when I removed “Everyone” from the permissions on the root of my hard drive. The Exchange Store was located on the drive and apparently the installation did not set explicit permissions on the exchange folders. Reinstating “Everyone: Full control” on the root of the drive cured the problem, though obviously this is a security vulnerability.
The error can occur if you try to mount the Mailbox Store or the Public Folder Store. This issue may occur if the Microsoft Windows 2000 Group Policy Object has been deleted or modified. See ME316709 link below.
As per Microsoft: "This issue can occur if the information store is not running. When the information store is stopped and the System Attendant is still running, the System Attendant keeps the MAPI session active. This issue can also occur if a mailbox store failed to mount. ". See ME262456 link below for more details.

This event also may occur if the disk holding the log files runs out of disk space.
I was getting this on a Cluster Server. Make sure the name of the virtual server is NOT in AD's Users And computers. See ME288598.
This event can also happen if you use the "Reinstall" option for Exchange 2000 Server on a server that's running a service pack (any service pack). Since the mail stores are updated with service packs, previous versions of Exchange don't understand and can't mount them. If you have reinstalled Exchange on top of itself, don't forget to apply the same SP level that the server had before you reinstalled it.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.