Store.exe issues 1

[Shirky]

Mid day I lost access to our Exchange server with Outlook. Upon investigation I found that store.exe was at 100% CPU utilization. At this time we are only able to access the server via OWA while store.exe is still at 100% CPU utilization.

I had the following error messages:
Event Type: Error
Event Source: MSExchangeSA
Event Category: MAPI Session
Event ID: 9175
Date: 6/17/2004
Time: 3:47:26 AM
User: N/A
Computer: Server
Description:
The MAPI call 'OpenMsgStore' failed with the following error:
The attempt to log on to the Microsoft Exchange Server computer has failed.
The MAPI provider failed.
Microsoft Exchange Server Information Store
ID no: 8004011d-0512-00000000

Event Type: Error
Event Source: MSExchangeFBPublish
Event Category: General
Event ID: 8197
Date: 6/17/2004
Time: 3:34:54 AM
User: N/A
Computer: Server
Description:
Error initializing session for virtual machine Server. The error number is 0x8004011d. Make sure Microsoft Exchange Store is running.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/17/2004
Time: 3:11:34 AM
User: N/A
Computer: server
Description:
The McAfee GroupShield On-Line Update service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Schannel
Event Category: None
Event ID: 36871
Date: 6/17/2004
Time: 3:08:09 AM
User: N/A
Computer: Server
Description:
A fatal error occurred while creating an SSL server credential.


I set my 5 data stores to not mount on start up and rebooted. I started with our smallest stores and mounted them one at a time. Public folder store didn't really seem to make any change in the store.exe utilization. I then added my smallest mailbox store and connected with outlook, after a minute or two the utilization went up to about 25% and outlook went into the eternal "Requesting data from Microsoft Exchange Server". I added another mailbox store and the utilization went to 50%, and so on up to 100% on my 4th. If I try to unmount the store Exchange System Manager locks up, after I force ESM to close the store appears unmounted but trying to run an integrity says that it is still in use. If I mount my largest store first the CPU will go to 100% after a couple of minutes.

I ran isinteg.exe -s server -fix -test testall on all the data stores. There were a few errors that were fixed. I then ran a soft recovery with eseutil /r and did a couple integrity checks.

At this point I can run my Public folder store and my two smallest data stores and everything seems to work just fine. When I add either of the two larger data store, 7GB and 30GB, store.exe CPU utilization shoots up to 100% and Outlook is shutout again.

I know I should probably just try to do a restore but I have a feeling that would end up loosing a lot of data. I use ArcServer Exchange backup to get the data stores. I'd like to do as much as possible to not loose the entire days emails.

I'm running Windows 2000 Server SP4 and Exchange 2000 SP3 with the latest roll-up applied. I'm also running Groupshield 5.2 with Hotfix 2 (I'm currently re-applying hotfix 2 since I've had Groupshied cause processes to go out of control in the past). I'm also running McAfee VirusScan Enterprise 7.0.0, yes my M drive is excluded as well as my exchsrvr folders.

So to recap, Store.exe is at 100% utilization. I can mount data stores but they don't seem to unmount cleanly. I've run integrity checks.

Has anyone out there seen store.exe act like this before? Am I on the right track in suspecting corrupt data and if so why does OWA work just fine? Is this just a matter of doing a soft recovery and then a repair?

 

[Evilbart]

the answeris in post :

http://www.tek-tips.com/viewthread.cfm?SQID=862498&SPID=858&page=1

 

[bartibog]

Hi, thanks for the fix....what was the cause???

 

[Shirky]

HOLLY CRAP!

I've been in the office for 22 hours. 14 of them trying to fix this and all I had to do was run that stupid superdat. I should have known but I couldn't figure out why at one point the problem was on one data store and then went away after I ran isinteg.

My Network Asscociates account exec is about to get a big earful for this one. She's lucky I don't have her home phone number and that we just got our new grant letter last month.

 

[Evilbart]

FYI:
the cause of this issue being that your engine isn't up to date.

while servers are doing auto-update they only update DATvirussignature files but not the engine.

superdat's upgrade the engine too.....

glad it helped you guys out (and all of my customers 2 )
//Bart

 

[rwieting]

//Bart,
Glad I looked one last time for some information about this. We've been having trouble w/ our email server since yesterday afternoon. Your post is a huge sign of relief, now I can finally relax. I owe you one!
Thanks again!

 

[Msharkey]

I responded on the other thread but I want to do it here also.

Bart,

Thank you VERY much for the help. We are chasing this issue also all day until I saw your post.

Matt

 

[Evilbart]

glad i could be of some help, no other sources including newsgroups had this problem listed so i came overhere.

This is a good community.....

//Bart