| Event Id | 2011 |
| Source | MSExchangeISPriv |
| Description | Error 0x80040115 occurred while writing delivery log information to the Microsoft Exchange System Attendant. |
| Event Information | According to Microsoft: CAUSE : The computer running Exchange Server is missing a file necessary for decoding message tracking information from the Message Transfer Agent (MTA). The Exchsrvr\Tracking.log directory may be filled with thousands of ASNxxxx.tmp files, and the Acse.arc file may be missing from the Exchsrvr\Bin directory of the Exchange Server computer. This undoubtedly is the cause of the Event 5007 errors. The Event 2011 errors are most likely caused by invalid data being written to the message tracking log. This data, when parsed, causes the System Attendant to hang, which halts all other Exchange Server services, including the information store, which is the actual source of the error. WORKAROUND: This problem can be resolved by copying a valid Acse.arc from another computer running Exchange Server 4.0. After copying this file, the Exchange Server services will all need to be restarted. |
| Reference Links | XADM: MSExchangeISPriv Event ID 2011 Causes Information Store To Stop |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.