Microsoft KB Archive/810861

= XADM: Event ID 9100, 9101, 9102, and 9104 Messages Are Logged in the Application Event Log =

Article ID: 810861

Article Last Modified on 2/28/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange 2000 Enterprise Server

-



SYMPTOMS
Although Exchange 2000 appears to be functioning correctly, one or more of the following event ID messages is logged in the Application event log:

Event Type: Error

Event Source: MSExchangeSA

Event Category: Monitoring Event

ID: 9100

Description: The MAD Monitoring thread was unable to read the queue information, error '0xc00402be'.

-or-

Event Type: Error

Event Source: MSExchangeSA

Event Category: (2)

Event ID: 9100

Description: The MAD Monitoring thread was unable to read the queue information, error 0x800706a6.

-or-

Event Type: Error

Event Source: MSExchangeSA

Event Category: Monitoring

Event ID: 9100

Description: The MAD Monitoring thread was unable to read the queue information, error 0x80041001.

-or-

Event Type: Error

Event Source: MSExchangeSA

Event Category: (2)

Event ID: 9101

Description: The MAD Monitoring thread was unable to read disk information, error '0x80010108'.

-or-

Event ID: 9102

Source: MSExchangeSA

Type: Error

Category: Monitoring

Description: The MAD Monitoring thread was unable to read the state of cluster resources, error '0x80010108'.

-or-

Event ID: 9104

Event Type: Error

Event Source: MSExchangeSA

Event Category: (2) Description: The MAD Monitoring thread was unable to read the CPU usage information, error '0x80010108'.



CAUSE
This issue occurs because the monitoring thread that is run by the System Attendant service (Mad.exe) cannot query Microsoft Windows Management Instrumentation (WMI) for the state of any of the following items:
 * Cluster resources
 * CPU usage information
 * Instances of the ExchangeLink class or other classes provided by the Exchange WMI provider (Exwmi.dll)

The errors may be caused by one of the following issues:
 * Corruption in the WMI infrastructure
 * Transient problems with the WMI infrastructure
 * Network connectivity issues

To identify the exact cause of the event, see the error code in the &quot;Description&quot; section of the event. For example, event ID 9102 with the error 0x80010108 translates to RPC_E_DISCONNECTED. This error means that the remote procedure call (RPC) connection was lost, possibly because of network connectivity issues. For more information, see the &quot;Error Codes&quot; section in this article.



RESOLUTION
If these events occur occasionally, they can be safely ignored. However, if they occur frequently (for example, every five minutes), you should investigate the cause of the event. To do so, follow these steps:
 * 1) Make sure that WMI is installed correctly. For additional information about WMI, see Windows 2000 Online Help.
 * 2) Use the Windows Management Instrumentation Tester (Wbemtest.exe) to make sure that WMI is responding, the Exchange 2000 namespace still exists, the appropriate class exists, and the Exchange WMI provider can enumerate instances of that class. Wbemtest.exe is installed in the %windir%\system32\Wbem folder in your Windows system folder. For more information about how to use Wbemtest, see Windows 2000 Online Help.
 * 3) Check network connectivity.



MORE INFORMATION
For additional information about interpreting WMI error codes, click the following article numbers to view the articles in the Microsoft Knowledge Base:

295821 XGEN: Windows Management Instrumentation Error Return Codes

278952 WMI Sink Interface Methods May Return Invalid Error Codes

Related Events
Event ID: 9098

Event Source: MSExchangeSA

Event Type: Error

Event Category: Monitoring

Description: The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'

Event ID: 9099

Event Source: MSExchangeSA

Type: Error

Event Category: Monitoring

Description: The MAD Monitoring thread was unable to read the state of the services, error '0x80010108'.

Error Codes

 * 0x80041010 = WBEM_E_INVALID_CLASS
 * 0x80010108 = RPC_E_DISCONNECTED
 * 0x800706a6 = RPC_S_INVALID_BINDING
 * 0x80041001 = WBEM_E_FAILED

Keywords: KB810861

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.