Troubleshooting the Recipient Update Service (RUS) using Event Logs – Part 3


(Please go here for Part 1 of this series and here for Part 2)


Question 4 when troubleshooting the RUS – Which policies match the user?


If you got this far, then you know that the RUS queried for the changes, and the query returned the expected result. The next question is what happened when the RUS processed that user.


When the RUS picks up one of the objects queued for processing, you’ll see this event:


Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8163
Description:
Thread #12b8: received next Address List Transaction. DC=bilong,DC=test


After that the RUS begins evaluating the object against each address list and policy. Each evaluation generates an event 8129:


Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8129
Description:
Evaluating directory object ‘CN=e2kuser7,CN=Users,DC=bilong,DC=test’ against address list ‘CN=All Users,CN=All Address Lists,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test’ rule ‘(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(!(homeMDB=*))(!(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*))) ))’.  DC=bilong,DC=test


If the address list or policy matches the object, you’ll also get an 8130:


Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8130
Description:
‘CN=All Users,CN=All Address Lists,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test’ added to ‘CN=e2kuser7,CN=Users,DC=bilong,DC=test’. DC=bilong,DC=test


By reading the 8129 and 8130 events, you can determine which policies and address lists the RUS determined match the user. Note that just because you see an 8130 for more than one recipient policy does not mean that multiple policies will be applied to the user. Out of all the matching policies, the policy with the highest priority is the only one that will affect this recipient. Address lists, on the other hand, are cumulative. All matching address lists will be added to the recipient.


You should see an 8129 event for every existing address list and policy. If you are not seeing an 8129 event for the address lists or recipient policies you’re expecting, then the RUS does not see those objects. This is typically due to a permissions issue, especially in a hosting scenario where permissions on individual address lists have been modified. The same behavior could occur if those objects have not replicated to the DC the Exchange server has chosen as the config DC. Exchange will be reading the address lists and recipient policies from the config DC – not from the DC that the RUS points to. To see which DC has been chosen as the config DC, get properties on the Exchange server in question and look at the Directory Access tab in Exchange System Manager.


In some cases, the RUS will have to query the active directory to see if a policy applies. In that case you may see a series of events like this:


Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8129
Description:
Evaluating directory object ‘CN=e2kuser7,CN=Users,DC=bilong,DC=test’ against address list ‘CN=NewPolicy,CN=Recipient Policies,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test’ rule ‘(&(extensionAttribute1=mySpecialValue))’.  DC=bilong,DC=test


Event Type: Information
Event Source: MSExchangeAL
Event Category: LDAP Operations
Event ID: 8011
Description:
Searching directory bilongexch1.bilong.test at base ‘<GUID=F56238A9720BA14FBBD786F9CC847A45>’ using filter ‘(&(extensionAttribute1=mySpecialValue))’ and requesting attributes ObjectClass; ReplPropertyMetaData. DC=bilong,DC=test


Event Type: Information
Event Source: MSExchangeAL
Event Category: LDAP Operations
Event ID: 8012
Description:
Search of directory bilongexch1.bilong.test at base ‘<GUID=F56238A9720BA14FBBD786F9CC847A45>’ returned 0 objects. DC=bilong,DC=test


In order to determine if this policy matched the user, the RUS issued a search against the DC using the objectGUID of the user as the base of the search and the filter from the policy as the filter. In this case the search returned 0 results, which tells the RUS that the policy does not match this user.


By reading the 8130 events, you can note all 8130 events that correspond to recipient policies. Then, out of each recipient policy shown in an 8130, you can identify the one among them that has a higher priority than all the others. That is the policy which the RUS should generate addresses for, assuming it’s appropriate for the RUS to generate addresses for the given recipient. For more information on how the RUS decides to generate addresses, see KB:328738.


Bill Long

Comments (3)
  1. Frank Carius says:

    Great article bill.

    I expect your white paper some weeks later :-) but how can we troubleshoot the rus, if everything is setup fine, diagnostic logging is enabled and there is still nothing in the eventlog. An the RUS is not doing anything. ?

    It looks like it does not start at all.

    Frank

  2. Bill Long says:

    Good question – I’ll be sure to add this info before we make it a KB article.

    When you start the System Attendant service, it loads a series of DLLs. One of these DLLs will be ABV_DG.DLL. Look for this series of events:

    Event Type: Information

    Event Source: MSExchangeSA

    Event Category: General

    Event ID: 1000

    Date: 7/23/2004

    Time: 9:44:49 AM

    User: N/A

    Computer: BILONGEXCH1

    Description:

    Microsoft Exchange System Attendant is starting. Microsoft Exchange Server System Attendant, service startup complete, version 6.5 (build 7226.0).

    … then some other stuff, probably DSACCESS initializing and such… then:

    Event Type: Information

    Event Source: MSExchangeSA

    Event Category: General

    Event ID: 9006

    Date: 7/23/2004

    Time: 9:44:49 AM

    User: N/A

    Computer: BILONGEXCH1

    Description:

    Microsoft Exchange System Attendant is loading ‘ABV_DG.DLL’.

    Event Type: Information

    Event Source: MSExchangeSA

    Event Category: General

    Event ID: 9008

    Date: 7/23/2004

    Time: 9:44:50 AM

    User: N/A

    Computer: BILONGEXCH1

    Description:

    Microsoft Exchange System Attendant is starting ‘ABV_DG.DLL’.

    Right after the 9008 indicating that ABV_DG.DLL is starting, you should begin seeing 8011 and 8012 events as it searches for the existing RUS’s. If you see the 9006 but not the 9008, the RUS server thinks it’s a front-end server. ABV_DG.DLL does not start on a front-end server, so you’ll never see any 8011 or 8012 events on a front-end. The RUS needs to be pointed to a back-end.

    If you see the 9008, you should see some 8011’s and 8012’s just after it. After a few of these, you should see it actually search for the existing RUS objects:

    Event Type: Information

    Event Source: MSExchangeAL

    Event Category: LDAP Operations

    Event ID: 8011

    Date: 7/23/2004

    Time: 9:44:50 AM

    User: N/A

    Computer: BILONGEXCH1

    Description:

    Searching directory bilongexch1.bilong.test at base ‘CN=Recipient Update Services,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test’ using filter ‘(&(objectCategory=msExchAddressListService)(!(IsDeleted=TRUE)))’ and requesting attributes distinguishedName; objectGUID; LegacyExchangeDN; msExchADCGlobalNames; ObjectSID; ObjectClass; msExchMasterServiceBL; activationSchedule; activationStyle; msExchAddressListServiceLink; msExchDomainLink; msExchServer1AuthenticationCredentials; msExchServer1AuthenticationPassword; msExchEncryptedPassword; msExchServer1NetworkAddress; msExchExportContainers; msExchReplicateNow; msExchDoFullReplication; msExchServer1LastUpdateTime; msExchServer1HighestUSN; msExchServer1PageSize; msExchPollInterval; msExchServer1Flags; VersionNumber; msExchServer1HighestUSNVector; msExchProcessedSids; msExchDomainGlobalGroupSid; msExchDomainLocalGroupSid; msExchDomainGlobalGroupGuid; msExchDomainLocalGroupGuid; gatewayProxy.

    Notice the filter in that event. It’s looking for any objects of class msExchAddressListService where isDeleted is not TRUE – basically, any RUS objects that aren’t tombstoned. This search should return a number of results equal to the number of RUS’s you have:

    Event Type: Information

    Event Source: MSExchangeAL

    Event Category: LDAP Operations

    Event ID: 8012

    Date: 7/23/2004

    Time: 9:44:50 AM

    User: N/A

    Computer: BILONGEXCH1

    Description:

    Search of directory bilongexch1.bilong.test at base ‘CN=Recipient Update Services,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test’ returned 2 objects.

    In my case I have only my Enterprise RUS and one domain RUS, so the search returns 2 objects as expected. If this search doesn’t return any results, your Exchange server doesn’t see the RUS objects, probably due to a permissions problem. If it can’t see them, it can’t see that it’s responsible for any of them, so the RUS will never kick off. But even if it doesn’t see them you should periodically see 8011’s and 8012’s as it checks for the existence of any RUS’s. If you’re not seeing any 8011’s and 8012’s at all, then ABV_DG.DLL probably was not started because the server is a front-end.

    Hope this helps! Now I need to figure out where to add this info in the doc… :-)

  3. Anonymous says:

    &amp;nbsp;

    Recipient Update Service en Exchange 2000 y Exchange 2003

    Parte II – Seguimiento de problemas…

Comments are closed.

Skip to main content