Potential Message Journaling and Store Service Problems Found

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2006-05-17

The Microsoft® Exchange Server Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows® Management Instrumentation (WMI) class to determine whether the Categorizer Warning event 9004 has occurred in the past 24 hours.

The Exchange Server Analyzer also queries the Win32_Service WMI class to determine whether the Microsoft Exchange Information Store service (MSExchangeIS) is started or stopped. A value of anything other than Started for the MSExchangeIS instance means that the MSExchangeIS service is stopped.

The Exchange Server Analyzer displays an error if the following conditions are true:

  • The server has logged a Categorizer Warning event 9003 in the past 24 hours.

  • The MSExchangeIS service is stopped.

This error indicates that there is a problem with Message Journaling or the Microsoft Exchange Information Store service (Store.exe) that may cause messages to queue.

This issue may occur if one of the following conditions is true:

  • The journaling recipient object has been deleted from the Active Directory® directory service.

  • The Information Store service is not running or has been disabled on the Exchange Server computer that is the SMTP bridgehead server.

  • One or more mailbox stores on the SMTP bridgehead server are dismounted.

To resolve this issue:

  • Make sure that the SMTP bridgehead server has the Information Store service enabled and running. Make sure that the mailbox stores on the SMTP bridgehead server are mounted.

  • Make sure that the journaling recipient object for mailbox stores has not been deleted from Active Directory.

To determine the journaling recipient for a mailbox store

  1. Start Exchange System Manager.

  2. Expand Servers, expand <your Exchange server>, expand <storage group>, and then right-click the mailbox store and select Properties.

  3. On the General tab, view the account that appears immediately under the Archive all messages sent or received by mailboxes on this store check box. This is the account that is being used as the journal recipient.

    Note

    Make sure that you verify the journal recipient for each mailbox store object.

To nominate a new user mailbox as the journaling recipient

  1. Start Exchange System Manager.

  2. Expand Servers, expand <your Exchange server>, expand <storage group>, and then right-click the mailbox store and select Properties.

  3. On the General tab, click Browse, to the right of the Archive all messages sent or received by mailboxes on this store text, to specify a mailbox as the journaling mailbox.

    Note

    All journalized messages for senders on this mailbox store are sent to the mailbox you specify.

For information about this issue see Journaling recipient points to a deleted object.

For more information about Exchange Server 2003 events and errors, see the "Events and Errors Message Center" (https://go.microsoft.com/fwlink/?LinkId=34258).

For more information about how to deploy a journaling solution, see "Journaling with Exchange Server" (https://go.microsoft.com/fwlink/?LinkId=47581).