microsoft.public.exchange2000.admin

Author

MTA Warning 9297

Trevor Lawrence

2002-10-05, 8:30 pm

The error message:

Event Type: Warning
Event Source: MSExchangeMTA
Event Category: Security
Event ID: 9297
Date: 2/10/2002
Time: 1:20:54 PM
User: N/A
Computer: HERMES
Description:
The user /O=University of
Canberra/OU=MANAGEMENT/cn=Configuration/cn=Servers/cn=THERMES has caused a
security violation. Locality table (LTAB) index: 135. Windows 2000 error
code: 0X80070005. [BASE IL MAIN BASE 1 237] (14)

is occurring at 10 minute intervals in the logs of a new machine that was
added to the site yesterday. The machine it is complaining about (THERMES)
is the only other E2K server in the Admin group.

This is part of a swing upgrade process. HERMES was originally a 5.5 box.
THERMES was introduced and the content moved across. HERMES then was
decommissioned and apparently appropriately removed from the org. It has
had some hardware upgrades and was yesterday added to the system as an E2K
box.

I seem to recall that I saw something similar when THERMES was first
introduced and the problem went away, maybe after some machine reboots.

Anyone any idea what makes this happen, and how to fix it?

(The organisation is still in mixed mode, but there are no 5.5 boxes left
and there are no longer any SRS instances running)

Trevor Lawrence
University of Canberra

Trevor Lawrence

2002-10-05, 8:31 pm

Here is some extra stuff that might help explain what is going on:

When Hermes (5.5) was decommissioned and removed from the org as per
instructions, there were a couple of error messages that seemed to relate
mostly to the virus software that was on it, but there were a couple of
errors of the form "can't load DLL for .....) which in one case related to
the MTA. Now the server seemed to disappera OK. But THermes (the other E2K
server in the site/admin group) kept saying it failed to connect to Hermes
via RPC. Looking on THermes X400 queues there is an odd extra queue simply
labelled "Hermes (Remote Delivery)" which is in a retry state but has no
entries in the queue.

Once Hermes was rebuilt as an E2K box, it appears that THermes is still
trying to contact it, but of course the machine is a different machine now,
just the same name. This appears to explain the error in the earlier email
as well as what we are seeing on THermes.

How does one force this extra queue to go away?

Trevor

"Trevor Lawrence" <TrevorL@ise.canberra.edu.au> wrote in message
news:OPzKXacaCHA.2424@tkmsftngp09...
> The error message:
>
> Event Type: Warning
> Event Source: MSExchangeMTA
> Event Category: Security
> Event ID: 9297
> Date: 2/10/2002
> Time: 1:20:54 PM
> User: N/A
> Computer: HERMES
> Description:
> The user /O=University of
> Canberra/OU=MANAGEMENT/cn=Configuration/cn=Servers/cn=THERMES has caused a
> security violation. Locality table (LTAB) index: 135. Windows 2000 error
> code: 0X80070005. [BASE IL MAIN BASE 1 237] (14)
>
>
> is occurring at 10 minute intervals in the logs of a new machine that was
> added to the site yesterday. The machine it is complaining about
(THERMES)
> is the only other E2K server in the Admin group.
>
> This is part of a swing upgrade process. HERMES was originally a 5.5 box.
> THERMES was introduced and the content moved across. HERMES then was
> decommissioned and apparently appropriately removed from the org. It has
> had some hardware upgrades and was yesterday added to the system as an E2K
> box.
>
> I seem to recall that I saw something similar when THERMES was first
> introduced and the problem went away, maybe after some machine reboots.
>
>
> Anyone any idea what makes this happen, and how to fix it?
>
> (The organisation is still in mixed mode, but there are no 5.5 boxes left
> and there are no longer any SRS instances running)
>
> Trevor Lawrence
> University of Canberra
>
>

Sponsored Links