Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.

What cumulative update is installed?

Hi,

Please delete the file killbit.xml and then perform IIS reset to check result.

Here is a related thread for your reference.

https://social.technet.microsoft.com/Forums/en-US/feff98cb-5b48-4537-b86b-8dcf41cb9992/event-id-3028-msexchangeapplcationlogic

Hope this is helpful to you.

Best regards,

Thank you for your reply.

The Exchange is 15.0.995.29 which is CU6

I tried to delete the killbit.xml file and reset the IIS. First no event was recorded and I thought that the issue has been solved but unfortunately the event was logged again with re-occurrence after 12 hours this time instead of every 6 hours as it was earlier and is now.

Hi,

Please run handle.exe on killbit.xml and check if there is any process using it.

And please check if there is Antivirus scan running. If there is, please disable it temporarily to check result.

Best regards,

Hello, same problem here.

Fresh install of Win 2012 R2 + Exchange 2013 SP1 updated to CU7 in the VM, no antivirus.

I've got six times per day ID 3028 Warning

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1044.25\ext\killbit\killbit.xml' because it is being used by another process.

I have already tried to delete killbit.xml and restart IIS but the problem persists.

Handle.exe doesn't show anything.

Do you have any suggestion?

Regards,
M.

I also see this about 6 to 8 times a day.  Also a fresh install of EX2013 CU7. No AV.

Exactly the same problem here (fresh install EX2013 CU7, no AV)

Anyone found a solution meanwhile?

Same issue, new install Ex2013 CU6 no AV on VM.
Every 6 hours

• Edited by Brad Christie Saturday, February 28, 2015 9:27 PM

Same issue, new install Ex2013 CU6 no AV on VM.
Every 6 hours

• Edited by Brad Christie Saturday, February 28, 2015 9:27 PM

@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!

I kindly ask you to remove that tagging.

Hi all,

Any update about this KillBit issue ?

I have the same issue also after upgrading to CU7 of Exchange 2013.

Thx,

Michal

Did not help

Have done that

Same issue here.  Fresh install CU7 no AV.

Same thing for me on CU7. 

Same problem. Fresh install of Exchange 2013 on Windows 2008 R2 SP1. All updates and pre-req performed correctly and in order. CU7 appli

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!

• Edited by Erik Nettekoven 21 hours 23 minutes ago

You are so right about this. This seems to be a growing trend among the moderators and Microsoft staff here. The best thing you can do is report them to customer service and be sure to talk to someone outside their department.

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!

• Edited by Erik Nettekoven Wednesday, April 01, 2015 10:01 AM

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!

• Edited by Erik Nettekoven Wednesday, April 01, 2015 10:01 AM

I'm encountering the same issue(s).  In short:

1. We upgraded to Exchange 2013 CU7 and started seeing the same errors.
2. As pointed out, they errors ONLY happen on Mailbox servers and not CAS servers.
3. They appear to happen every 12 hours.  (The time moves by a minute or two each day.)

Thanks,

Robert

I have pointed out the hippocracy of the Microsoft tech's marking their own non-answers as answers for years. Nothing seems to change, they do it all the time and it is a shame. I don't have time for threads marked with answers only to find (like this one) nothing is solved.

That said, we are using Exchange 2013 CU8 with both mailbox roles and CAS roles installed on the same machine. The full error is below.

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'E:\Exchange2013-v15\ClientAccess\owa\prem\15.0.1076.9\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

This issue seems to hitting many.

We have 2 X Exchange 2013 Enterprise CAS and Mailbox roles on same servers operating under Hyper-v 2012R2.

This issue is only occurring on the 1 Exchange node not on both.  The 2 Exchange servers are configured in a DAG.

It does not appear to be impacting operations as far as I cal tell but would like to have a clean log.

Hopefully this additional information can forward this topic and someone can determine the root cause.

Rometheis Wize
Senior ISE & Microsoft Solutions Architect
(Direct) 416-849-2946
rwize@it911.ca
rsw@rometheis.com 

Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.

Seeing the same thing here - single 2013CU8 server with MB and CAS roles.  Operations seem OK, but I'm skeptical long term.  FWIW, this server also had an issue installing CU8 - the update kept disabling all Exchange services, I had to re-enable them at each step of installation manually via PowerShell.  Not sure if there's a relationship there?

Hello,

Have this problem since CU1 (currently CU7). And don't think updating to CU8 will resolve the issue.

Before putting this server in production, I had a support ticket at microsoft to explain those warnings and errors we already had before the server actually did something so here's the reply I had for this error :

1. 3028 MSExchangeApplicationLogic Extension N/A Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException

Un problme de reporting qui a apparu sur Exchange 2010, par contre, cela na pas t corrig dans E15 (Exchange 2013) il me reste valider avec la personne en charge quelle est la suite donner;

(translate : A reporting problem that appeared in Exchange 2010, it was not corrected in E15)

So I think we should stop worrying about it : another "bug" microsoft won't care to resolve.

A good ol' "safe to ignore"

-  

• Edited by Splawinski 17 hours 0 minutes ago