Kaseya Community

MS Information Store dismounting

  • Hi All,

    Recently we have had a client's IS dismounting.

    Checking the event logs on the server:

    Event Type:	Warning
    Event Source: ESE
    Event Category: Performance
    Event ID: 508
    Date: 6/04/2010
    Time: 8:56:01 AM
    User: N/A
    Computer: SERVER01
    Description:
    Information Store (3008) First Storage Group: A request to write to the file "D:\Exchsrvr\MDBDATA\priv1.edb" at offset 984776704 (0x000000003ab28000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (99 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

    For more information, click http://www.microsoft.com/contentredirect.asp.



    Event Type:	Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Date: 6/04/2010
    Time: 8:56:01 AM
    User: N/A
    Computer: SERVER01
    Description:
    Faulting application store.exe, version 6.5.7654.12, faulting module avgvsapix.dll, version 9.0.0.782, fault address 0x00001193.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 73 74 6f ure sto
    0018: 72 65 2e 65 78 65 20 36 re.exe 6
    0020: 2e 35 2e 37 36 35 34 2e .5.7654.
    0028: 31 32 20 69 6e 20 61 76 12 in av
    0030: 67 76 73 61 70 69 78 2e gvsapix.
    0038: 64 6c 6c 20 39 2e 30 2e dll 9.0.
    0040: 30 2e 37 38 32 20 61 74 0.782 at
    0048: 20 6f 66 66 73 65 74 20 offset
    0050: 30 30 30 30 31 31 39 33 00001193



    As a temp workaround to keep the IS running, I have disabled AVG in the registry, by setting the "Enabled" key to 0:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\

    Has anyone else had the same issue?

    Can anyone provide any advice on what to do?

    Cheers, Nigel.

    Legacy Forum Name: MS Information Store dismounting,
    Legacy Posted By Username: Nigel
  • There have been a few others having similar issues. I havent heard of a resolution, but I would definitely open a support ticket and have it escalated.

    Legacy Forum Name: KES,
    Legacy Posted By Username: Coldfirex
  • Please get a ticket in and get it over to Dominic Walsh - we are following another customer reporting this issue and he's driving it with AVG.

    Legacy Forum Name: KES,
    Legacy Posted By Username: Jeff.Keyes
  • We've been fighting a weird issue with Server Lockups & Exchange Going down on Win 2k3 SBS Servers... I came across this post this morning and although not entirely the same, I checked one this morning and got this:

    Event Type:	Warning
    Event Source: ESE
    Event Category: Performance
    Event ID: 507
    Date: 4/8/2010
    Time: 8:06:32 AM
    User: N/A
    Computer: LADSBS
    Description:
    Information Store (10704) First Storage Group: A request to read from the file "D:\Program Files\Exchsrvr\mdbdata\priv1.edb" at offset 16425877504 (0x00000003d30f0000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (155 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

    For more information, click http://www.microsoft.com/contentredirect.asp.


    Has Anything beed discovered regarding this?

    Andy

    Legacy Forum Name: KES,
    Legacy Posted By Username: GradonSilverton
  • I've seen a couple issues recently where the store crashed because of the AVG Dll, but it came right back up.

    Legacy Forum Name: KES,
    Legacy Posted By Username: drodden
  • We have seen this issue sporadically.

    We have now setup event monitor set for these events and trigger a script to change the registry setting and email to ticketing software about the change.

    The worst part is that it mostly happens during scan at nights so when user come in morning they find their emails down!!! Eek

    Legacy Forum Name: KES,
    Legacy Posted By Username: mnagra
  • The logical step would be to exclude that folder from Virus Scanning ...

    Legacy Forum Name: KES,
    Legacy Posted By Username: Lmhansen
  • We already exclude all Exchange directories.. still happens. This is the error we see when it happens:

    Event Type: Error
    Event Source: MSExchangeIS
    Event Category: Virus Scanning
    Event ID: 9565
    Date: 4/7/2010
    Time: 10:28:28 PM
    User: N/A
    Computer: EXCH-01
    Description:
    Invalid virus scanner configuration. Unable to start virus scanner.
    Check the following parameter: Library.

    For more information, click http://www.microsoft.com/contentredirect.asp.


    Legacy Forum Name: KES,
    Legacy Posted By Username: jasonrdavis
  • POTENTIAL FIX:

    I noticed that on our servers with AVG that are not experiencing this issue, the key

    HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan

    does not exist at all.

    On the servers where I see this issue, the key exists, and the value Enabled=0 keeps reverting to Enabled=1. So to solve this, I deleted the ENTIRE VirusScan key. Afterwards I rebooted twice, IS came up every time.

    Obviously back up your registry before trying it. This worked on three servers so far. Too bad we can't get an "official" fix, but this definitely works in the mean time.

    Jason

    Legacy Forum Name: KES,
    Legacy Posted By Username: jasonrdavis
  • We have this issue as well with our installation and for 1 other client. The registry fix is only temporary and it will happen again.

    Legacy Forum Name: KES,
    Legacy Posted By Username: networkconsultant01
  • Have yall opened a support ticket yet?

    Legacy Forum Name: KES,
    Legacy Posted By Username: Coldfirex
  • I've Had a ticket open with kaseya and AVG for almost a month now.
    What you can do is change permissions on the Registry key and set it to read only after changing it to 0. this seems to be a decent work around for NOW

    Legacy Forum Name: KES,
    Legacy Posted By Username: ahana@axcelltech.com
  • Does anyone have a further update on this situation?

    Thanks,

    Gavin