Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9564 Source: MSExchangeIS

Error <error code> starting the Microsoft Exchange Information Store.
<error description>.
In my case I installed Computer Associates Etrust Antivirus 8.1 with the Exchange Mail Option on a 2003 Exchange Server SP2. The error "Failed to init VSERVER" came along with a second one from MSExchangeFBPublish (event id 8197) "Error initializing session for virtual machine <virtual machine name>. The error number is <error>. Make sure Microsoft Exchange Store is running."

From CA technical Hotline I've got an Email with some missing DLL's attached. Copying these into the ITM directory and rebooting the server fixed the problem.
- Error code: 0x8004010f, error description: "Failed to load Storage Group data" - This event is logged on Exchange Server 2007 when the Information Store service is starting but there are no storage groups. As soon as there is one SG (even an empty one), the IS can be started.
See the link to "Symantec Knowledge Base Document ID: 2002011016124454" for information about this event.
As per Microsoft: "This behavior may occur when you have an antivirus program installed and the antivirus program is damaged. This may occur for one or more of the following reasons:
1. You reinstall or restore Exchange 2000 Server from backup, but you do not reinstall the antivirus program.
2. You remove the antivirus program, but the removal of the program is incomplete or damaged.

You may also experience this behavior if you install an Exchange 2000 Server service pack that is incompatible with the antivirus program". See ME316650, ME319754, ME323664, and ME839115 for more details.

From a newsgroup post: "A tip for anyone upgrading from Exchange beta2 to RC1. Symantec Antivirus/Filtering for Exchange 2000 worked on exchange 2003 beta2, but fails on RC1 and will cause your “Infostor” not to load. Everything will work fine after initial install, but if you reboot "as suppose to" or restart services, many services will fail to load. This event is logged in your event log".

From a newsgroup post: "I encountered the same error with GFI MailSecurity, which is supposed to support Exchange 2003".
Look for the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan and set "Enabled" to a value of 0. Stop and restart the exchange services.

If the information store comes up after the change, then the following explanation should take care of the problem. I came across this error on a server where the antivirus software was installed prior to Exchange service pack 1 on a new server build. Exchange SP1 adds the hooks for the antivirus scanning software. Before SP1, antivirus software didn't have a way to properly scan the information store. In this situation, it is best to uninstall the antivirus software for the exchange services, install SP1 at a minimum or SP3 if possible, then reinstall the antivirus software.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.