Troubleshooting Microsoft Exchange Error Codes

Chicago Area Laptop for rent: $35 per day plus $10 for additional day

Troubleshooting Microsoft Exchange Error Codes

As with most server products, Microsoft Exchange produces some very useful log entries in the Event Logs of the server running Exchange. Like most server admins, you probably never find the time to check those logs until there is a problem, and then you spend time trying to find the needle in the haystack, and if you finally find what’s causing the issue, you spend even more time trying to decipher what you’ve found.

This post goes over some commonly encountered Microsoft Exchange warning and error events that you will find in your logs that deal with administration, Active Directory, connectivity, resources, and certificates. We’ll look at what they mean, and when action is required, what you should do to address the errors. Exchange can create log entries in several locations, including the Application Log, the MSExchange Management log, and in three sub categories of Exchange: High Availability, MailboxDatabaseFailureItem, and Troubleshooter.

Log: MSExchangeManagement

Source:MSExchange CmdletLogs

Type: Warning

Event ID: 5

This tells you a cmdlet was run but cancelled before completion, as well as what the cmdlet was. It doesn’t replace administrator auditing, but does give you an idea of what happened.

Log: MSExchangeManagement

Source:MSExchange CmdletLogs

Type: Error

Event ID: 6

This tells you a cmdlet was run but failed, as well as what the cmdlet was. It doesn’t replace administrator auditing, but does give you an idea of what happened.

Log: Application

Source: MSExchange Autodiscover

Type: Error

Event ID: 1

Your Exchange server cannot find a domain controller. Make sure your DC is running, your AD Sites are properly defined, and no firewalls (Windows built-in or other) are blocking connections from the Exchange server to domain controllers in the site. Remember how dependent upon Global Catalog servers Exchange is; you should have a GC in every site in which you have an Exchange server.

Log: Application

Source: MSExchangeFDS, RPC, POP3, or IMAP4

Type: Warning or Error

Event ID: 1003

Each of these services needs to communicate with Active Directory, and is reporting that it cannot. Make sure each Exchange server has a domain controller in its site, and consider adding a second for redundancy. When patching, consider patching the Exchange servers and the domain controllers at opposite ends of the process so that when Exchange starts up, it doesn’t look for AD while the DC is still rebooting.

Log: Application

Source: MSExchangeIMAP4, POP3

Type: Error

Event ID: 2007

The services cannot handle TLS connections because no suitable certificate is installed on the server. Install a certificate using the New Certificate Wizard that includes the server’s hostname and FQDN and is set up to support POP3 and IMAP.

Log: Application

Source: MSExchangeTransport

Type: Error

Event ID: 12014

Your Exchange server does not have a certificate that it can use for SMTP/TLS. Create a new certificate using the New Certificate Wizard and make sure to specify the FQDN of your server.

Log: Application

Source: MSExchange ADAccess

Type: Error

Event ID: 2104

Your Exchange server cannot query all the domain controllers it needs for topology information. If you are in a multi-domain environment, remember that Exchange will need to query DCs in all domains which contain user accounts with mailboxes in the Exchange Organization. Check routing and firewalls to ensure you have full connectivity.

Log: Microsoft, Exchange, HighAvailability, Operational

Source: HighAvailability

Type: Warning

Event ID: 127

This logs when a database is forcefully dismounted. It’s usually because of a shutdown/reboot, so nothing to worry about unless you cannot correlate it to a planned reboot for patching or maintenance.

Log: Microsoft, Exchange, HighAvailability, Operational

Source: HighAvailability

Type: Error

Event ID: 252

When this event is logged, an inconsistent event record has been found in the database. Check for free disk space or network connectivity issues.

Log: Application

Source: MSExchangeRepl

Type: Error

Event ID: 4113

If you have a DAG that has no redundant copies on any other server, 4113s are logged every twenty minutes until a replica is generated on another server. If you have just created a DAG, look for the 4114 that means a copy of the DAG exists on another server. If you see this on an existing DAG, check the replica server for other errors.

Log: Application

Source: MSExchange ActiveSync

Type: Warning

Event ID: 1022

Your CAS server cannot connect to your Mailbox server. Check network connectivity between these servers, especially any software or hardware firewalls, and that neither server has problems authenticating to AD.

Log: Application

Source: MSExchange EdgeSync

Type: Error

Event ID: 1004

There is a problem with your Edge Transport server’s attempts to authenticate to your Hub Transport server. Make sure that the Edge Subscription is working correctly and the certificate is not expired.

Log: Application

Source: MSExchange EdgeSync0

Type: Error

Event ID: 1024

Your Hub Transport server cannot connect to your Edge Transport server’s ADAM instance. Verify ADAM is running, and then, since your Edge Transport server is in the DMZ and your Hub Transport server is not, confirm that no changes to the firewall have been made.

Log: Application

Source: MSExchangeTransport

Type: Warning

Event ID: 15004

This is a warning that your Exchange server is running out of some resource, this will almost always be free disk space. It is the start of back pressure. You need to expand your volume, or move your database to a larger volume, soon.

Log: Application

Source: MSExchangeTransport

Type: Error

Event ID: 15006

This is what happens when you have run out of that resource you were warned about in the 15004. The Transport service will reject all mail until you resolve the resource constraint.

Keeping a watch out for the above error messages will help you respond to issues with your Exchange servers, usually before your users notice there is a problem. Consider implementing a log monitoring and management solution so that you can be notified automatically, rather than having to manually parse logs on each of your Exchange servers. These types of errors should be checked for daily, which makes a log management application even more important. By catching these errors and responding quickly, you can keep your Exchange system responsive and ready to service user requests.

This guest post was provided by Ed Fisher on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. More information: Event log management.

All product and company names herein may be trademarks of their respective owners.

Post your questions, comments, feedbacks and suggestions

Contact a consultant