| Event Id | 5007 |
| Source | System Attendant |
| Description | An error occurred during the message tracking decode operation. Function:ScWriteLog:ScWriteField. <<0xc0020021 - The process cannot access the file because another process has locked a portion of the file.>> |
| Event Information | The System Attendant (SA) may log the following event in the application for a brief period of time. The SA and the other Exchange Server services do not stop, and mail flow is unaffected. CAUSE: Event ID 5007 indicates that the current message tracking log file was locked by another process. The System Attendant must be able to write to the current message tracking log file that is found in the Exchsrvr\Tracking.log file. The Event ID 3016 from the Internet Mail Service is logged because the Internet Mail Service is dependent on the System Attendant to actually write to the message tracking log file. The same is true for the MTA. WORKAROUND: Determine what process has the message tracking log file open. Then have that process release the log file so that the System Attendant can successfully write to it. Processes that may lock the message tracking log file can include backup software. Another cause for the log file to be locked is that someone currently has the file open with an editor of some sort |
| Reference Links | System Attendant Logs an Event ID 5007 with Message Tracking Enabled |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.