Share via

Exchange 2019 event 3032

meetoo 21 Reputation points
2020-10-27T16:12:00.113+00:00

We have been running Exch2013 & Exch2019 for about 4 months, but last week began seeing this event on the Exch2019 servers and can find nothing about it:

  • Event Time: 27 Oct 2020 12:00:55 PM
  • Source: MSExchangeApplicationLogic
  • Event Log: Application
  • Type: Error
  • Event ID: 3032
  • Event User: N/A
  • Scenario: ProcessKillBit. App id is missing in the killbit entry.

Has anyone seen this before?

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,662 questions

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yuki Sun-MSFT 41,146 Reputation points Microsoft Vendor
    2020-11-25T05:26:29.01+00:00

    Hi All,

    According to the update from the relevant team, the MSExchangeApplicationLogic 3032 event is recorded continuously due to the lack of "o:pid" attribute in killbit.xml (https://api.addins.omex.office.net/appinfo/query). It has been confirmed that the missing o:pid attribute is published now:
    42562-1.png

    So you may have a check at your end and see if the Event 3032 has stopped.

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    2 people found this answer helpful.
  2. Yuki Sun-MSFT 41,146 Reputation points Microsoft Vendor
    2020-10-28T05:59:34.99+00:00

    Hi @meetoo ,

    As regards to the Event 3032, I did much research but failed to find any exactly same reports. Searching on "ProcessKillBit. App id is missing in the killbit entry." led to no useful information either. Then I did some further research regarding "MSExchangeApplicationLogic", and most of the links I found are similar to what was provided above by Andy which is about Event 3028 or Event 3025 & 3018, like the thread below:
    Event MSExchangeApplicationLogic 3025 & 3018

    Given this, would you please help collect the information below so that we can see if more clues can be found?

    1. Have you notice any problems which could be related to this error?
    2. Please locate the Event 3032 in Event Viewer, go through the list and see if there are any other potentially relevant events there.
    3. Which CU is installed on both servers, you can run the cmdlet below to check the build number: 
    Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
  3. Severin Meyer 6 Reputation points
    2020-10-30T11:44:43.817+00:00

    I see the same error since 25. October 2020 on all my clients installation.

    Exchange Server 2019 CU7 15.2.721.2
    Exchange Server 2016 CU18 15.1.2106.2
    Exchange Server 2013 CU23 15.0.1497.2

    I have tried to overcome the warning 3028 in the past, but there was no reliable fix, so I started to ignore it.

    Event ID: 3028, MSExchangeApplicationLogic, Warning
    Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: Der Prozess kann nicht auf die Datei "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.2.721.3\ext\killbit\killbit.xml" zugreifen, da sie von einem anderen Prozess verwendet wird.
    bei System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
    bei System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
    bei System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
    bei Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

    But now the error 3032 comes in addition (surrounded by the warning 3028):

    Event ID: 3032, MSExchangeApplicationLogic, Error
    Scenario: ProcessKillBit. App id is missing in the killbit entry.

    Deleting the killbit.xml results in a recreated file, but the error is still coming up.

    1 person found this answer helpful.
  4. Khurram Rahim 1,841 Reputation points
    2020-11-04T20:37:19.287+00:00
    1 person found this answer helpful.
    0 comments
  5. Yuki Sun-MSFT 41,146 Reputation points Microsoft Vendor
    2020-11-10T05:52:52.08+00:00

    Hi all,

    The continuously recorded MSExchangeApplicationLogic 3032 event in Application event log has been confirmed to be a known issue which could impact all (Internet connected) OnPremise Exchange Servers. Currently the product team are still investigating on it. I'll keep an eye on it and post back here once I receive any update. Sorry for any inconvenience caused and thank you all for your patience.

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.