XADM: Event ID 9100, 9101, 9102, and 9104 Messages Are Logged in the Application Event Log (810861)

SYMPTOMS

Although Exchange 2000 appears to be functioning correctly, one or more of the following event ID messages is logged in the Application event log:

Event Type: Error
Event Source: MSExchangeSA
Event Category: Monitoring Event
ID: 9100
Description: The MAD Monitoring thread was unable to read the queue information, error '0xc00402be'.

-or-

Event Type: Error
Event Source: MSExchangeSA
Event Category: (2)
Event ID: 9100
Description: The MAD Monitoring thread was unable to read the queue information, error ''0x800706a6''.

-or-

Event Type: Error
Event Source: MSExchangeSA
Event Category: Monitoring
Event ID: 9100
Description: The MAD Monitoring thread was unable to read the queue information, error ''0x80041001''.

-or-

Event Type: Error
Event Source: MSExchangeSA
Event Category: (2)
Event ID: 9101
Description: The MAD Monitoring thread was unable to read disk information, error '0x80010108'.

-or-

Event ID: 9102
Source: MSExchangeSA
Type: Error
Category: Monitoring
Description: The MAD Monitoring thread was unable to read the state of cluster resources, error '0x80010108'.

-or-

Event ID: 9104
Event Type: Error
Event Source: MSExchangeSA
Event Category: (2) Description: The MAD Monitoring thread was unable to read the CPU usage information, error '0x80010108'.

CAUSE

This issue occurs because the monitoring thread that is run by the System Attendant service (Mad.exe) cannot query Microsoft Windows Management Instrumentation (WMI) for the state of any of the following items:

Cluster resources
CPU usage information
Instances of the ExchangeLink class or other classes provided by the Exchange WMI provider (Exwmi.dll)

The errors may be caused by one of the following issues:

Corruption in the WMI infrastructure
Transient problems with the WMI infrastructure
Network connectivity issues

To identify the exact cause of the event, see the error code in the "Description" section of the event. For example, event ID 9102 with the error 0x80010108 translates to RPC_E_DISCONNECTED. This error means that the remote procedure call (RPC) connection was lost, possibly because of network connectivity issues. For more information, see the "Error Codes" section in this article.

RESOLUTION

If these events occur occasionally, they can be safely ignored. However, if they occur frequently (for example, every five minutes), you should investigate the cause of the event. To do so, follow these steps:

Make sure that WMI is installed correctly. For additional information about WMI, see Windows 2000 Online Help.
Use the Windows Management Instrumentation Tester (Wbemtest.exe) to make sure that WMI is responding, the Exchange 2000 namespace still exists, the appropriate class exists, and the Exchange WMI provider can enumerate instances of that class. Wbemtest.exe is installed in the %windir%\system32\Wbem folder in your Windows system folder. For more information about how to use Wbemtest, see Windows 2000 Online Help.
Check network connectivity.

MORE INFORMATION

For additional information about interpreting WMI error codes, click the following article numbers to view the articles in the Microsoft Knowledge Base:

295821 XGEN: Windows Management Instrumentation Error Return Codes

278952 WMI Sink Interface Methods May Return Invalid Error Codes

Related Events

Event ID: 9098
Event Source: MSExchangeSA
Event Type: Error
Event Category: Monitoring
Description: The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'

Event ID: 9099
Event Source: MSExchangeSA
Type: Error
Event Category: Monitoring
Description: The MAD Monitoring thread was unable to read the state of the services, error '0x80010108'.

Error Codes

0x80041010 = WBEM_E_INVALID_CLASS
0x80010108 = RPC_E_DISCONNECTED
0x800706a6 = RPC_S_INVALID_BINDING
0x80041001 = WBEM_E_FAILED