Microsoft KB Archive/843483

= Description of Offline Address Book logging in Outlook =

Article ID: 843483

Article Last Modified on 1/30/2007

-

APPLIES TO


 * Microsoft Office Outlook 2003, Service Pack 1 (SP1)
 * Microsoft Office Outlook 2007

-



Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SUMMARY


''If you use Microsoft Office Outlook in Cached Exchange Mode, the Offline Address Book is used for common address book operations, such as name lookups or browsing the Global Address List. In Outlook in Cached Exchange Mode, more users use the Offline Address Book compared to users who use earlier versions of Microsoft Outlook.

The full set of .oab files is the single largest file that is downloaded from the Microsoft Exchange server apart from the synchronization of your mailbox. Excessive downloading of the full .oab files can occur in Outlook because of known conditions or because of conditions that are unique to an organizations' deployment.

Microsoft Office has client-side logging for the full .oab file download available. The client-side logging provides information that you can use to determine whether the full .oab file download was expected (in the specific context), or whether it occurred because of a problem (known or unknown) in either Microsoft Outlook or Microsoft Exchange. If the full .oab file download occurred because of an unknown problem in Outlook or Exchange, the client-side logging information might be useful in the determination of a possible resolution.

Note The client-side logging information will not tell you how to resolve the problem. The client-side logging information will tell you the general cause for the full .oab file download. You may have to perform additional advanced troubleshooting or open a support case with Microsoft Product Support Services to find a resolution to the problem.''



INTRODUCTION
This article describes the Offline Address Book log details in Microsoft Office Outlook. Offline Address Book log details can be obtained for both Outlook client-side and Exchange server-side.

This article discusses the following topics:
 * Application Event ID 27
 * Analyzing Offline Address Book log entries
 * OAB sequence number
 * Server-side Address List Name
 * OAB GUID
 * Administration
 * Privacy issues



Application Event ID 27
By default, Outlook always generates an application event whenever Microsoft Outlook performs a full .oab file download from the Microsoft Exchange server. If you have the OAB logging feature enabled (the default setting), Outlook uses the application event log to track full .oab file downloads. To identify the Offline Address Book downloads, look for items with the following criteria in the application event log:

Event Source: Outlook

Event ID: 27

Event Type:

Description:

Depending on the type of application event, the information that is in the Event Type line will be error messages, warnings, or information. The following sequence of events is an example of the descriptions that might appear in the Description line for this application event in the application event log (in chronological order):
 * 1) Error Event ID 27 event with a description that is similar to &quot;OAB ModDif failed. (Details record in event data).&quot; or &quot;OAB (Offline Address Book) files are invalid. Replaced with stub. (Last errors in event data).&quot;
 * 2) Information Event ID 27 with a description of &quot;Starting OAB Download.&quot; This kind of application event contains most of the information for the download cause, and it is the most important application event. This application event signals the beginning of a full .oab file download by Outlook.
 * 3) Information Event ID 27 with a description of &quot;OAB Download Succeeded.&quot; This application event signals a successful full .oab file download by Outlook.

Note If the full .oab file download failed, a warning Event ID 27 with a description of &quot;OAB Download Failed&quot; appears instead of &quot;OAB Download Succeeded.&quot;

back to top



Analyzing Offline Address Book log entries
You can analyze the application event log file information by using the following techniques:  Sort the log by Event ID line. Locate events with the following criteria:

Event ID: 27

Source: Outlook

 If the first Event 27 is an &quot;error&quot; type application event, you can expect that the next Event 27 will be an &quot;information&quot; application event. This informs you that a full .oab file download will be started. Open the Event 27 whose description starts with the following text:

&quot;Starting OAB download (See event data)&quot;

Note You do not have to have an &quot;error&quot; type application event in to trigger a full .oab file download. For example, if you manually force a full .oab file download, the first Event 27 in the application event log will be the &quot;Information&quot; Event 27 (with a description that contains the &quot;Starting OAB download …&quot; description).

After you have identified the application event that triggered the full .oab file download, you can use the data from the &quot;information&quot; Event 27 to determine the cause of the full .oab file download.

The following sample data is from an application event log entry where Outlook downloaded the Offline Address Book because the user started Outlook for the first time in Cached Exchange Mode:

0000: 01 00 00 00 00 00 00 00  ........ 0008: 00 00 00 00 75 00 00 00  ....u... 0010: 75 00 00 00 00 00 00 00  u....... 0018: 00 00 00 00 00 00 00 00  ........ 0020: e9 fd 00 00 02 a3 48 9b   éý...£H? 0028: ba 12 c4 01 00 00 00 00  º.Ä..... 0030: 00 00 00 00 00 00 00 00  ........ 0038: 00 00 00 00 00 00 00 00   ........ 0040: 00 00 00 00 00 00 00 00   ........ 0048: 00 00 00 00 00 00 00 00   ........ 0050: 00 00 00 00 00 00 00 00   ........ 0058: 00 00 00 00 00 00 00 00   ........ 0060: 00 00 00 00 00 00 00 00   ........ 0068: 00 00 00 00 00 00 00 00   ........ 0070: 00 00 00 00 00 00 00 00   ........ 0078: 00 00 00 00 00 00 00 00   ........ 0080: 00 00 00 00 00 00 00 00   ........ 0088: 00 00 00 00 00 00 00 00   ........ 0090: 5c 00 47 00 6c 00 6f 00   \.G.l.o. 0098: 62 00 61 00 6c 00 20 00   b.a.l.. 00a0: 41 00 64 00 64 00 72 00  A.d.d.r. 00a8: 65 00 73 00 73 00 20 00   e.s.s.. 00b0: 4c 00 69 00 73 00 74 00  L.i.s.t. 00b8: 00 00 00 00 65 38 31 30   ....e810 00c0: 35 35 61 38 2d 62 64 38  55a8-bd8 00c8: 38 2d 34 33 34 62 2d 39  8-434b-9 00d0: 37 31 37 2d 64 34 33 37  717-d437 00d8: 61 62 34 35 31 35 36 39  ab451569 00e0: 00 65 38 31 30 35 35 61  .e81055a 00e8: 38 2d 62 64 38 38 2d 34  8-bd88-4 00f0: 33 34 62 2d 39 37 31 37  34b-9717 00f8: 2d 64 34 33 37 61 62 34  -d437ab4 0100: 35 31 35 36 39 00        51569

In any Offline Address Book application event entry, the first byte of data contains the error code in hexadecimal. It is the error code that tells you the cause of the full .oab file download. The following data is extracted from the complete data set from the previous application event log:

<pre class="fixed_text">0000: 01 00 00 00 00 00 00 00  ........

In this sample data, the first byte is 01. To interpret the 01 code or another code in Offline Address Book application event logs, use the following table to make the correlation between the code number and the cause for the full .oab file download:

The following list contains three other pieces of information that you can gather from the application event log data:
 * the OAB sequence number
 * the server-side address list name that is being used to populate the Offline Address List
 * the GUID for the full .oab file download

You can use error values to determine why an 0f error occurred. To do this, follow these steps:  Locate Event ID 27 in the Application Event Log with Starting OAB Download (see event data). in the Description: section.</li> Locate the reason codes in the Description: section of the event that may contain some or all the following asserts: <ul> 0050: 7a 65 61 7a 61 74 61 7a zeazataz</li> 0058: 70 69 61 7a 7a 65 61 7a piazzeaz</li> 0060: 61 74 61 7a 70 69 61 7a atazpiaz</li></ul> </li> Interpret these reason codes by using the following: <ul> &quot;zaez&quot; is an assert for &quot;signature mismatch.&quot;</li> &quot;zata&quot; is an assert for MAPI_E_UNEXPECTED_ID.</li> &quot;zaip&quot; means &quot;HrApplyOABDiffs failed. Must download full.&quot;</li></ul> </li> Depending on the data in the event log, you might need to install the Exchange hotfix that is mentioned in the following Microsoft Knowledge Base article:

895476 Outlook may receive a full download instead of an incremental download when Outlook downloads the offline address book in Exchange Server 2003

</li></ol>

back to top

<div class="moreinformation_section">

OAB sequence number
Both Outlook and Exchange use the OAB sequence number to determine the collection of the .oab files from the server to download to the client. Depending on the sequence number that is found on the client and on the cumulative size of the .diff files, either a differential download or a full download of the Offline Address Book occurs. You can verify the sequence numbers by using the following data.

Client application event log
Starting at offset 0008, you can see that the OAB sequence numbers for the client and the server (in hexadecimal). Offset 0008 is the second line in the following log example:

<pre class="fixed_text">0000: 09 00 00 00 00 00 00 00  ........ 0008: 9b 00 00 00 9a 00 00 00  ........

The client sequence number is that is contained in the first four bytes (9b in this example) and the server sequence number is in the second four bytes (9a in this example).

In the previous sample data, the client's sequence number is bigger than the server's sequence number, and the generated Offline Address Book error code is 9 (this is obtained from the first byte at offset 0000).

back to top

<div class="moreinformation_section">

Server-side Address List Name
In the scenario where the client and the server Offline Address Book (address list) names are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 3, 5, or 7. You can verify the Offline Address Book (address list) name by using the following data.

Client application event log
Starting at offset 0090 in the following event log example, you can see the name of the server-side address list used to populate the Offline Address List on the server. Additionally, the name that is stored client-side can be found starting at offset 00b8.

<pre class="fixed_text">0090: 5c 00 47 00 6c 00 6f 00  \.G.l.o. 0098: 62 00 61 00 6c 00 20 00   b.a.l.. 00a0: 41 00 64 00 64 00 72 00  A.d.d.r. 00a8: 65 00 73 00 73 00 20 00   e.s.s.. 00b0: 4c 00 69 00 73 00 74 00  L.i.s.t. 00b8: 00 00 5c 00 47 00 6c 00   .\.G.l. 00c0: 6f 00 62 00 61 00 6c 00    o.b.a.l. 00c8: 20 00 41 00 64 00 64 00   .A.d.d. 00d0: 72 00 65 00 73 00 73 00   r.e.s.s. 00d8: 20 00 4c 00 69 00 73 00   .L.i.s. 00e0: 74 00 00 00 38 62 32 61   t...e810

In this sample data, the default Global Address List is being used for the Offline Address List. To confirm this is the correct address list, follow these steps in Exchange System Manager:
 * 1) Locate the name of the Offline Address List for your mailbox store on the General tab in the Properties dialog box for the store.
 * 2) Expand the Offline Address Lists container, and then right-click the Offline Address List to view the properties.
 * 3) On the General tab, note the list of address lists that are under Address Lists.

back to top

<div class="moreinformation_section">

OAB GUID
Both the Exchange server and Outlook use a matching GUID to make sure that they stay synchronized. In the scenario where the client and the server OAB GUIDs are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 4, 6, or 8. You can verify the OAB GUID using the following data.

Client application event log
The GUIDs can be found in the Offline Address Book log data starting at offset 00b8.Offset 00b8 is the first line in the following log example:

<pre class="fixed_text">00b8: 00 00 00 00 65 38 31 30  ....e810 00c0: 35 35 61 38 2d 62 64 38  55a8-bd8 00c8: 38 2d 34 33 34 62 2d 39  8-434b-9 00d0: 37 31 37 2d 64 34 33 37  717-d437 00d8: 61 62 34 35 31 35 36 39  ab451569 00e0: 00 65 38 31 30 35 35 61  .e81055a 00e8: 38 2d 62 64 38 38 2d 34  8-bd88-4 00f0: 33 34 62 2d 39 37 31 37  34b-9717 00f8: 2d 64 34 33 37 61 62 34  -d437ab4 0100: 35 31 35 36 39 00           51569

The first GUID is for the server and the second GUID (starting at offset 00e0) is for the client.back to top

<div class="moreinformation_section">

Administration
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

The following system policy (registry key) can be used to turn off the OAB logging feature if it is not required:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Exchange\Exchange Provider

If you have both the OAB logging feature and the  registry key enabled, Outlook will still create the Offline Address Book log entries, even if you click No to the prompt to download the full Offline Address Book.

For more information about the &quot;Allow Full OAB prompt&quot; registry key, click the following article number to view the article in the Microsoft Knowledge Base:

841273 Administering the Offline Address Book in Outlook 2003

back to top

<div class="moreinformation_section">

Privacy issues
The Offline Address Book ModDif failed event contains the complete .diff record that caused a failure. The ModDif event failure occurs when Outlook encounters a failure when it tries to apply a .diff to a file. The details of the .diff record are output to the event data. The ModDif event data might contain phone numbers, e-mail addresses, proxy addresses, and aliases for a particular user. Therefore, you must take this under consideration before you share this data or upload this data to Microsoft Product Support Services.

back to top

Additional query words: OL2007

Keywords: kbaddressbook kbtshoot kbinfo KB843483

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.