emsmdb32.dll

[freaktechnique]

Hey everyone,

I'm getting event ids 270 and 290 showing up on all my exchange servers (nt4.o sp6s, exchange 5.5 sp4) Also queues are building in the IMS outbound awaiting conversion que with 0Byte messages on the Bridghead with event id 3038 and 4115.

I've tried several fixes that MS recommends for fixing the 3038 error and the 4115 error.

To fix the 3038 error MS recommends removing the IMS, running isinteg and reinstalling IMS. Event Log and queues were clear for about 15 hours but then the errors and the problem returned.

To fix the 4115 error MS recommends removing the Domain from the Routing tab for SMTP to POP3 routing. The queues looked good for about 30 minutes then resurfaced.

I'm thinking maybe the events are all related and I should address the 270 and 290 messages. Also I'm running out of options here.

For the 270 and 290 events MS recommends applying the post SP4 hot fixes. These are EMSMDB32.DLL (ver. 5.5.2655.18) currently I have 5.52653.22 and STORE.EXE (ver. 5.5.2655.37) currently I have 5.5.26.53.23.

The problem is MS wants you to call their support line to get the fix. This will cost me time and money to get files they should provide for free. KB article 288848 states this is a known issue and Q282533 states this is the known fix.

Does anyone have any advice and can someone please provide me with these files. I've searched the web with no luck and no longer know anyone else running Exchange 5.5.

EMSMDB32.DLL 5.5.2655.18
STORE.EXE 5.5.2655.37

 

[rdroske]

Sorry, dont have the files you are lookin for but I am curious.

The 290 has to do with non-deliveries, are the message in the Q addressed to real people in your org or legitimate outside addresses someone is really trying to reach?

DID MS mention the possibilty of a bat time setting on one of your servers? See below.

Event ID: 290
Source MSExchangeMTA
Type: Warning
Category: X.400 Service
Description: A non-delivery report (reason code unable-to-transfer and diagnostic code maximum-time-expired) is being generated for message C=US;A=NAME1;P=NAME2;L=EXCHANGE-00065E89. It was originally destined for DN:/o=NAME1CORP/ou=NAME2CITY/cn=MS Mail Addresses/n=SMTP: someone@EXAMPLE.COM 2F52A9AC[ASCII 167] (recipient number 1), and was to be redirected to . [MTA DISP:ROUTER 14 136] <12)

In a large organization, this may be the only existing evidence that a message is generating a non-delivery report.
MORE INFORMATION
If the Event ID is generated for messages immediately following their submission, it is usually an indication that one or more of the servers involved has an incorrect system date or time setting.

 

[CSCKone]

I'm getting the 270,290, 2025 evil triumvirate going through my event logs as well. This is only on my servers with a public info though.

I already applied the MS patch (painless to get actually) and the events are just getting worse. It seems that they are occuring when people are trying to post in a public folders (especially a customer complaint one with a homegrown form).

Here are the errors I am getting:
Event 290
A non-delivery report (reason code transfer-failure and diagnostic code Omit any diagnostic code) is being generated for message C=FI;A=XXX;P=XXX;L=Server14-040413091725Z-688. It was originally destined for DN:/o=XXX/ou=XXX/cn=CONFIGURATION/cn=SERVERS/cn=Server13/cn=MICROSOFT PUBLIC MDB§ (recipient number 1), and was to be redirected to . [MTA DISP:RESULT 19 136] (12)

Event 270
A permanent error has occurred with Entity /O=XXX/OU=XXX/CN=CONFIGURATION/CN=SERVERS/CN=Server13/CN=MICROSOFT PUBLIC MDB. Entity is a Message Object is a Normal Priority Message. Object: 0600005C. Message ID: C=FI;A=XXX;P=XXX;L=Server14-040413091725Z-688 Content length: 405917, External Trace information (first 100 bytes) = 308063806180130246490000628013074D41494C4E4554000013044B4F4E450000318080113034303431333034313732352D303530308201008302060000000000, PDU dump reference 109 [MTA SUBMIT 15 74] (14)

Event 2025
The delivery of a message failed due to error FFFFFBFE. A non-delivery report is being sent to the message's originator.

Anyplace it says Server 13, replace with 14 and where it says 14 replace with 13 for the other server. They are identical errors. I have no checked the remote server we have that also has a copy of the pub store, but since it's never mentioned, I doubt it's got the errors.

Anyone have a clue why this is going on? Is it something in the form trying to point them to a non-existant address maybe?