Microsoft KB Archive/161935

= XADM: Message Tracking Error 5007 Caused by Missing *.Arc Files =

Article ID: 161935

Article Last Modified on 10/28/2006

-

APPLIES TO


 * Microsoft Exchange Server 4.0 Standard Edition

-



This article was previously published under Q161935



SYMPTOMS
The Microsoft Exchange Server version 4.0 System attendant (SA) may rapidly generate many ASNxxxx.tmp files in the Exchsrvr\Tracking.log directory. At the same time, it will be reporting numerous events similar to the following in the Windows NT Event Viewer application log when message tracking has been enabled:

Event ID: 5007

Source: MSExchangeSA

Description: An error occurred during the message tracking decode operation.

The SA processor utilization may be very high while the Microsoft Exchange Message Transfer Agent (MTA) throughput seems low.



CAUSE
There are several possible reasons for this behavior. The most likely cause is when one or more of the *.Arc files are missing or corrupt. In Microsoft Exchange Server version 4.0, the SA uses the *.Arc files to decode the message tracking log data passed to the SA by the MTA. The *.Arc files are a set of templates that describe the structure of ASN.1 encoding used in the logging data passed by the MTA to the SA. Without the *.Arc files, the SA is unable to proceed with the decoding of message tracking data, and thus logs the 5007 events.



RESOLUTION
Verify that all eleven of the *.Arc files are present in the Exchsrvr\Bin directory. The file names are:

  Directory of :\exchsrvr\bin

07/15/96 12:30a                40,900 ACSE.ARC 07/15/96 12:30a                 7,560 BIND.ARC 07/15/96 12:30a                 2,704 COMMON.ARC 07/15/96 12:30a                91,970 EAI.ARC 07/15/96 12:30a                17,577 P1.ARC 07/15/96 12:30a                24,005 P3.ARC 07/15/96 12:30a                43,795 P7.ARC 07/15/96 12:30a                20,979 RDI.ARC 07/15/96 12:30a                11,007 ROSE.ARC 07/15/96 12:30a                23,790 X400COM.ARC 07/15/96 12:30a                 1,301 X500DUM.ARC

These files are static and should not change in size or date. If any of the files are missing, you can replace them by copying the necessary *.Arc files from another Microsoft Exchange Server. In addition, if any of the file sizes do not match, or the files appear to have become corrupted, they should be copied from a Server that is not logging the 5007 events.

Another possible reason for this behavior is heap corruption caused by the SA. This was a problem in the original release of Microsoft Exchange Server version 4.0 but has been fixed in the latest Microsoft Exchange Server 4.0 U.S. Service Pack. For information on obtaining the Service Pack, query on the following word in the Microsoft Knowledge Base (without the spaces):

S E R V P A C K

Keywords: kbusage KB161935

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.