Event ID 9646 Source MSExchangeIS
HelloOn an Exchange Server 2003, I've seen a lot of event regarding MAPI Session I already had a look on http://support.microsoft.com/kb/830836/en-usbut no client are using too manny mapi sessions ( did the following command netstat -ano but everything seems to be ok)Also used tcpview.exe to check store.exe but ok as wellI also check the following registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPChimneyand the value was already set to 0I don't like the way to increase the default thresold so I would like to know if there is a solution to this issueBTW, some users have over 250 Folders within a secondary PST file that have the option of exchange view selectedThank you in advance
September 7th, 2009 6:07pm
I have seen this with some of my servers. Part of our baseline load now is just to increase the MaxObjsPerMapiSession as well as the objtMessage value. Take a look at this KB: Your Exchange Server 2003 computer may stop responding after a MAPI client opens more than the default value of certain server objects http://support.microsoft.com/kb/830829This may be more relevant than KB 830836. Could you post the exact error you are seeing? I'm not sure that netstat -ano or tcpview.exe will actually show you all of the sessions a single client has open with the store. This is because all of the sessions are opened against a single TCP port. Take a look at the User Monitor utility. That gives you a better idea of what your MAPI clients are doing: http://technet.microsoft.com/en-us/exchange/bb288489.aspxAnd, of couse, run the Exchange Best Practices Analyzer on your server and see if it has any recommendations. http://www.exbpa.com
Jim McBee - Blog - http://mostlyexchange.blogspot.com
Free Windows Admin Tool Kit Click here and download it now
September 7th, 2009 9:14pm
On Mon, 7-Sep-09 18:14:13 GMT, Jim McBee - Exchange MVP wrote:ano or tcpview.exe will actually show you all of the sessions a single client has open with the store. This is because all of the sessions are opened against a single TCP port. Take a look at the User Monitor utility. That gives you a better idea of what your MAPI clients are doing: http://technet.microsoft.com/en-us/exchange/bb288489.aspxAnd, of couse, run the Exchange Best Practices Analyzer on your server and see if it has any recommendations. http://www.exbpa.com >> >Jim McBee - Blog - http://mostlyexchange.blogspot.com Just curious, Jim . . . how did you arrive at an appropriate number ofobjects and messages? Initial guess-work followed by adjustments? How'd you draw the line between what's an acceptable number and what'smisuse?---Rich MatheisenMCSE+I, Exchange MVP---
Rich Matheisen
MCSE+I, Exchange MVP
September 8th, 2009 12:09am
hi, According to Microsoft Support, this is a new feature in Exchange 2003 to help prevent any one client from acting "abnormally" and adversely affecting the performance of the server. The recommended fix was to modify the registry to raise the threshold for each one of the object types mentioned in the error message. In this case, I wil have to quadruple the affected values to get this behavior to stop. Create the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem\MaxObjsPerMapiSession. Then create a new DWORD value for each object name appearing in the error (for example, objtMessageView), and set the desired value. In this case, they recommended quadrupling the value mentioned in the error. You should not have to restart any services for this change to take affect.Regards,
Ajaj Desai (India)
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2009 10:49am
Hi,
In addition to Jim, I also suggest you check following configuration:
1. Please ensure following three registry keys are set to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
EnableTCPChimney
EnableRSS
EnableTCPA
Note: You need to restart Server after change the registry key
2. Please adjust the KeepAliveTime key according to KB324270:
Value name: KeepAliveTime
Key: Tcpip\Parameters
Value Type: REG_DWORD-Time in milliseconds
Valid Range: 1-0xFFFFFFFF
Default: 7,200,000 (two hours)
This value controls how frequently TCP tries to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet. Keep-alive packets are not sent by default. You can use a program to configure this value on a connection. The recommended value setting is 300,000 (5 minutes).
3. Please also let me know whether only specific users always encounter the problem. I also suggest you start Outlook in safe mode on the problem client to check whether the issue persists. Please also disable all the third parties searching/indexing utilities on the problem client.
4. Make sure unchecked the option download shared folders in cached mode if the problem client is Outlook 2007.
Mike Shen
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact tngfb@microsoft.com
September 8th, 2009 11:34am
Thank you all for your replies, I already check everything regarding TCPIP parameters and all are okI also seen that after receiving the event id 9646, there are some event 1025 that appearsAn error occurred on database "<Storage Group/Mailbox Store>".
Function name or description of problem: EcGenerateReadReport:
Error: 0x80070005
For more information, click http://www.microsoft.com/contentredirect.asp.The event 9646 isMapi session "<legacyExchangeDN>" exceeded the maximum of 250 objects of type "objtMessage".
For more information, click http://www.microsoft.com/contentredirect.asp.
Regards
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2009 3:50pm
Hi,
Thanks for your response.
At this time, would you please let me know whether the 9646 always indicate specific mailbox or random mailboxes? Whether the issue occurs frequently? Whether the users indicated in the event 9646 encounters any connection problem when using Outlook?
In addition, when the event 9646 is encountered, whether you performed the step listed in KB830836 to determine what user or set of users may be reaching this upper limit. For your convenience, I have provided the steps below:
1. Click Start, point to All Programs, point to Microsoft Exchange, and then click System Manager.
2. If Administrative Groups is listed, expand Administrative Groups, and then expand First Administrative Group. If Administrative Groups does not appear, go to step 3.
3. Expand Servers, expand your Exchange computer, expand First Administrative Group, and then expand Mailbox Store.
4. Click Logons, click the View menu, and then click Add/Remove Columns.
5. In the Available columns dialog box, click Open Messages, and then click Add.
6. In the Available columns dialog box, click Open Attachments, click Add, and then click OK.
7. Click Logons, click the Action menu, click Export list, type the name of the Mailbox Store in the Save As dialog box, and then click Text (Comma Delimited)(*.csv) and Save in the Save as type drop-down box.
8. Repeat this process for each Mailbox Store.
After the data is collected, follow these steps:
1. Open the files in Microsoft Excel.
2. Sort each column.
Then, compare each column with the default values that are listed in Knowledge Base article 830829. If any user is reaching these limits, we recommend that you visit that user's computer to determine what the user may be doing to cause these objects to remain open.
I would like to explain that the event 9646 can be caused by several factors, such as:
1. Outlook Add-ins, third-party program that use MAPI, A script or batch file, Third-party Desktop Search Engine
Exchange 2000 Server and Exchange Server 2003 performance may be affected when desktop search engine software is running on Outlook or other MAPI client computers
http://support.microsoft.com/kb/905184/en-us
2. Network issue:
Network connectivity issue is causing TCP connections to drop forcing the client to create a new connection. If a network device terminated the session prior to the client sending the FIN packet, or did not send FIN packet to the server for the existing session, then these MAPI connections will remain open or orphaned. If a TCP session becomes orphaned, Exchange will keep that session open until TCP session expires, when by default is every hours. Therefore, in my previous post, I suggest you KeepAliveTime to 5 minutes to check whether the issue persists.
Mike Shen
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact tngfb@microsoft.com
September 11th, 2009 11:09am