Pingatwork-4773 avatar image
0 Votes"
Pingatwork-4773 asked KaelYao-MSFT commented

unexpected shutdown Windows 2012 R2 exchange 2016 - event ID 1003, 6027, 1325, 4018

Hi experts,

an unexpected shutdown happened on my Windows 2012 R2 running exchange 2016 standard CU19 Version 15.1 ‎(Build 2176.2)‎
there are Application log Event ID : 1325, 9646, 4999, 4018, 3018, 3025, 6027, 1003, 1008 when i searched for the last 12 hours events.

event source: FIPFS
event ID: 6027
the description :
MS Filtering Engine Update process was unsuccessful to download the engine update for Microsoft from Primary Update Path.
Update Path:
Reason:"There was a catastrophic error while attempting to update the engine. Error: DownloadEngine failed and there are no further update paths available.Engine Id: 1 Engine Name: Microsoft"

event source: MSExchange Front End HTTP Proxy
event ID: 1003
the description :
[Ecp] An internal server error occurred. The unhandled exception was: System.ArgumentException: Invalid value

at Microsoft.Exchange.HttpProxy.ServerInfoAnchorMailbox..ctor(BackEndServer backendServer, IRequestContext requestContext)
at Microsoft.Exchange.HttpProxy.BEResourceRequestHandler.ResolveAnchorMailbox()
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.InternalBeginCalculateTargetBackEnd(AnchorMailbox& anchorMailbox)
at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.<BeginCalculateTargetBackEnd>b__280_0()
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func`2 filterDelegate, Action`1 catchDelegate)

there're a few event ID in the system log, Event ID: 5011, 36874, 36888, 36887.

So many events need to troubleshoot, I am in need of lots of brilliant heads, trying to fix this asap.

Thanks for your time.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

KaelYao-MSFT avatar image
0 Votes"
KaelYao-MSFT answered KaelYao-MSFT commented

Hi, pingatwork.

Please note that not all these events are related to Exchange server health.

For example, event 6027 indicates the server failed to update MS Filtering Engine, it may be caused by temporary network problems.
While event 1003 indicates EAC/OWA cannot be accessed.

Do you currently have any actual problems with the Exchange server?
Is mail flow, client access and EAC/EMS working fine?

If any actual problems, I suggest that we focus on them.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi KaelYao,
since the last unexpected shutdown 24 hours ago, there is no noticeable issues. but I'd like to find out the root cause of the crash, as the up time of production server is very important for us. i am searching for these event ID trying to learn the solutions from others, what would you suggest for a better way to fix it.
thanks and regards,

0 Votes 0 ·


Sorry I am not very familiar with windows server.

To my knowledge, I would suggest to mainly focus on the system log and check if there are some events related to the unexpected shutdown.
For example, event 6008 would record the detailed shutdown time.
event 41 would indicate the cause of the restart(may be power supply failed or Stop error).

And If you can find event ID 1001, please also check if there are some dump files generated under the path C:\Windows\MEMORY.DMP.
It would be helpful for troubleshooting the root cause.

0 Votes 0 ·

Hi, @Pingatwork-4773

I am writing here to confirm with you how thing going now?
Did you find the root cause?

0 Votes 0 ·