XADM: IS Stops Responding Due to Critical Section Leak, Event ID 1160s Are Generated in the Application Log

ID: Q216259

The information in this article applies to:

Microsoft Exchange Server, version 5.5

SYMPTOMS

During normal operation of the Microsoft Exchange Information store, users may report that response to client operations is very slow or results in a "Client Operation Failed" error message. Reviewing the Windows NT Event Viewer Application log, the following event IDs will be generated in succession:

Event ID: 1160
Source: MSExchangeIS
Type: Error
Category: General
Description: Database resource failure error Out of memory occurred in function 'JTAB_BASE::EcCreateIndex' while accessing the database.

NOTE: The string enclosed in single quotes above may differ in some events. However, the description will always read Out of memory.

If the store is left in this state for a long period of time, the Information Store (Store.exe) may terminate unexpectedly with an RPC exception. If the correct Windows NT and Exchange Server debug symbols are installed, the resulting Dr. Watson log may display a stack dump similar to the following:


FramePtr  RetAddr   Param1   Param2   Param3   Function Name
4c41f498  77e20f68  0000000e 2cf93cf0 4a4a7a10 RPCRT4!RpcRaiseException
4c41f4ac  6fc433e9  4c41f500 4a77d8dc 77f1d1f6
rpcrt4!NdrConformantStructMemorySize
4c41f5d0  6fc4e540  4a4a7a10 014b46b0 014b74a0 LIBXDS!ds_read+0x139
4c41f624  0047ab96  00000000 014b7008 00000000 LIBXDS!ds_read+0x260
4c41f664  0047adfd  0000001f 00000001 4c41f698 STORE!EcGetDSValues+0xa9
4c41f808  00479a57  00000018 3d60b340 3d60b360 STORE!EcGetMailboxInfo+0x5a
4c41f84c  0047961b  0149e020 3d60b340 3d60b360 STORE!EcLookupMBICache+0x326
4c41f910  0049d763  3d60b360 00000001 3d60b350 STORE!EcGetSdpermAndMbi+0x52
4c41f940  004d2dfd  4a7e4494 00000000 5afe2c89 STORE!SESS::EcConfig+0x182
4c41f98c  004d2d12  4a7e4494 0149e020 00000000
STORE!MAPISESS::EcConfig+0x59
4c41f9dc  004d2b51  00000000 5afe2c89 000004e4 STORE!EcCreateCxh+0x80
4c41fa28  004d2a7a  0149e020 00000000 5afe2c89 STORE!EcConnect+0xcb
4c41fa88  004d2900  76726174 316f6369 004d2900 STORE!EcDoConnect+0x215
31304d4f  09000802  02000000 8ea95a01 00000402 STORE!EcDoConnect+0x9b
8d31454b  00000000  00000000 00000000 00000000 0x09000802

NOTE: The item to look for in the resulting Dr. Watson log or User.dmp file is the first parameter to the RPCRT4!RpcRaiseException call, it will be 0x0000000e. This maps to a decimal value of 14 which then maps to the error: "Not enough storage is available to complete this operation". The rest of the call stack may vary.

CAUSE

Any logon operation to the Information Store process results in initialization of a Windows NT critical section and any logoff operation will result in the de-initialization (or deletion of the critical section). A critical section reserves virtual memory when it is initialized and releases it when deleted.

A problem in a post-Service Pack 1 hotfix to Store.exe (starting with builds 2365.0 through build 2448.7) introduced a leak in critical sections that results in the Store process eventually using up all 2 GB of virtual address space available to a user-mode process. With no virtual memory available, operations between the Information Store and Exchange Database Engine will fail, as seen by the Event ID 1160 error in the Windows NT Application log.

This leak would occur for every logon operation to the Information Store. Servers that have a high number of POP3 or IMAP clients would encounter this problem more often because every connection to the server would require a logon operation and therefore, leak a critical section.

RESOLUTION

To resolve this problem, obtain the latest service pack for Exchange Server version 5.5. For more information, please see the following article in the Microsoft Knowledge Base:

Q191014 XGEN: How to Obtain the Latest Exchange Server 5.5 Service Pack

The English version of this fix should have the following file attributes or later:

Component: Information Store

File name	Version
Store.exe	5.5.2448.8

STATUS

Microsoft has confirmed this to be a problem in Microsoft Exchange Server version 5.5. This problem was first corrected in Exchange Server 5.5 Service Pack 2.

Keywords : exc55sp2fix
Version : winnt:5.5
Platform : winnt
Issue type : kbbug