Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, February 26, 2020 4:22 PM
Hello -- Running exchange 2016 latest CU and it's been working great. 2 weeks ago I started to get the errors below and can't figure out what it is. I trying fully updating windows and rebooting the server. Anyone know what is going on?
___________
3025
Scenario: GetKillBit. Failed to download killbit list from OMEX server. Exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. > System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. > System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
End of inner exception stack trace
at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
End of inner exception stack trace
at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at Microsoft.Exchange.Data.ApplicationLogic.Extension.BaseAsyncOmexCommand.<>c__DisplayClass18_0.<EndGetResponseCallback>b__0()
_______________
3018
Scenario[ServiceHealth]: GetKillBit. CorrelationId: 767882a3-396f-4e1a-ad1b-28995d0a3b97. The request failed. Mailbox: Url: https://store.office.com/appinfo/query?rt=XML&corr=767882a3-396f-4e1a-ad1b-28995d0a3b97 Exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. > System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. > System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
End of inner exception stack trace
at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
End of inner exception stack trace
at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at Microsoft.Exchange.Data.ApplicationLogic.Extension.BaseAsyncOmexCommand.<>c__DisplayClass18_0.<EndGetResponseCallback>b__0()
dom
All replies (24)
Thursday, February 27, 2020 2:15 AM
Hi dom,
Do you have any issues about Exchange daily work?
Do you have any other error logs?
You can try to reset IIS then check again. If there are on issues in your organization, you can monitor these events for several days. Based on my research, if everything works well, you can safely ignore the errors logged.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Thursday, February 27, 2020 1:11 PM
No Exchange issues -- This comes every hour and those are the only 2 messages. I did reset IIS and it still comes back. What's odd is this just stated 2 weeks ago and nothing changed.
tks
dom
Thursday, February 27, 2020 7:47 PM
We are seeing the same thing -- beginning 2/20 the frequency of these two errors increased (to many per day) -- prior to then it was logged intermittently (a few per week).
Friday, February 28, 2020 7:18 AM
Based on my knowledge, these event logs can be caused when EWS tries to contact the app source store since some Outlook Add-ins.
I did some research, and found an article about the similar MSExchangeApplicationLogic Event 3018 issue. You can check this for more information: MSExchangeApplicationLogic Event 3018 in Exchange Server 2013 and 2016.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Friday, February 28, 2020 8:41 AM
I pasted the URL in the error in a browser on the Exchange Server and received an error.
You have to change the settings in IE Options - Advanced and Enable 'Use TLS 1.2'.
When you do a refresh it opens a XML file so that works now.
Just made the change myself, now waiting if the errors are over.
EDIT: Wasn't the solution.
Friday, February 28, 2020 7:39 PM
I was just about to post something similar. A packet capture shows the client handshake with TLS 1.0 followed by a RST, and a scan shows TLS 1.0 is disabled on store.office.com (or whatever CDN node we're hitting).
I'm guessing we need to apply these changes: techcommunity.microsoft.com/t5/exchange-team-blog/exchange-server-tls-guidance-part-2-enabling-tls-1-2-and/ba-p/607761 -- and in our case it appears we're missing a few (.NET default and schannel CLIENT).
I was under the impression this change (for O365 at least) was postponed until June 2020: docs.microsoft.com/en-us/office365/troubleshoot/security/prepare-tls-1.2-in-office-365 . Does anyone know if a similar move has been announced for all of Microsoft's web properties, or why store.office.com seems to have disabled TLS 1.0 early?
Friday, February 28, 2020 10:41 PM
Having same issue in our environment as well as a customer environment.
We are running three Exchange 2016 CU15 servers on 2012 R2, and an Exchange 2019 on server 2019. The 2019 server does not receive the error, but the 2012 R2 servers do.
These errors started happening every 6 hours, right after the last round of patches deployed on 2/20/2020. I don't believe patches are related, but listing them anway:
KB4536987 (Security Update for Exchange Server 2016 CU15)
KB4537821
KB4537803
KB4537767
& Security Update for Adobe Flash Player
I've checked TLS settings and verified I can actually reach the XML URL the error message refers to from each Exchange server.
In checking our customer environment, it also started 2/20/2020, and server could also reach the XML URL.
Server 2008 R2 with Exchange Server 2013 SP1
This server did not receive any recent patches.
I think this could be some kind of service issue or config change on the Microsoft end. It can't be a patch (I initially thought it was), and both environments started having the events same day. In reading the thread I believe another user also said it started 2/20/20 for them.
Thanks team
Sunday, March 1, 2020 4:31 AM
Same here. New Exchange 2016 install (CU 14), new Windows 2016 install. Errors 3018 and 3025 started about a week ago.
Service health is good, other than these messages filling up the event log.
Been searching all over for people talking about this error, this is the first thread with any relevant info.
Has anyone enabled TLS 1.2 yet? I'll keep everyone updated on my progress.
Tuesday, March 3, 2020 10:10 AM
That's not a solution.
Our Exchange Server has internet connection, I can retrieve the XML file in a browser on the server.
Also no proxy settings defined, default internet access.
The rest of the solution is to change the interval, that will mitigate the errors in the eventlog but the problem isn't solved that way.
And it only talks about event 3018, what about 3025?
Tuesday, March 3, 2020 12:18 PM
We are seeing this exact same issue on both of our Exchange 2016 CU 15 servers. Each server is in a separate site. No proxy configured, direct internet access. Checked the history, and the first instance of this issue showing up was on 2/20/2020, as others have mentioned as well.
In addition to this issue, we also have users that can't add office add-ins. We observed this when some sales users attempted to add the Salesforce for Outlook add-in. These issues appear to be related as they both attempt to access the same remote endpoint. Has anyone else experiencing this problem tried adding Outlook add-ins via the office store to see if that's a problem too?
I'm starting to wonder if this is an issue on the Microsoft side.
Tuesday, March 3, 2020 2:27 PM
This has been an issue farther back than Feb. updates though. In my searches, I've seen as far back as 2015 for others and in our env. I can see this in error emails as far back as Oct. 2018. We're using Exchange 2016 but in the past couple of years, we migrated all of our users' mailboxes to Exchange in the cloud. The only On Prem mailboxes we have left are the shared ones which should be going away soon.
Tuesday, March 3, 2020 4:04 PM | 1 vote
We also started seeing these errors on 2/20/2020 and we cannot install Apps from the Office Store. I started a similar thread, but so far no resolution. I will provide the link below, as it contains instructions on how to install Apps manually with the XML file, in case anyone experiences the same issue as us.
Wednesday, March 4, 2020 1:00 PM
My response is in no way an answer. It is a Band Aid that allows people to install Office Apps in a much harder and less efficient way than how it is supposed to work. Also the original poster of this thread was seeking a solution for all of the 3018 and 3025 error logs being generated, they made no mention of issues installing Apps.
Thursday, March 5, 2020 7:40 AM
Hi All,
Thanks for the information you provided above. I will do more research and consult with other engineers for more suggestions about Event ID 3018 and 3025. I will post back if there are any updates.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Friday, March 6, 2020 10:55 AM
As can be seen here, store.office.com only supports TLS 1.2 at the moment: https://www.ssllabs.com/ssltest/analyze.html?d=store.office.com
I followed "Exchange: Getting ready for TLS 1.2" here:
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" didn't exist at all. I have created the key and dword entries, afterwards restartet the server.
No more entries since yesterday so far.
Friday, March 6, 2020 4:31 PM
My Windows TLS settings were setup correctly, but applying the registry settings under the "Enable TLS 1.2 for .NET 4.x" section, of the link below, fixed the issue where we could not download Apps from the Office Store. This was a link off of the webpage atlantismedia posted. I will monitor my logs to see if those errors return.
These are the specific registry settings I applied:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
Monday, March 9, 2020 11:14 AM
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
These registry setting fixed our issues both with the MSExchangeApplicationLogic 3025 & 3018 event spamming and installing apps in Outlook.
Tuesday, March 10, 2020 6:44 AM
Hi Joe,
Thanks for your sharing. Hope your resolution can be helpful to other forum members.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Wednesday, March 11, 2020 2:13 AM
Hi again, I followed the instructions from the blog on the weekend and resolved this issue. Thanks to everyone for this thread.
Wednesday, March 11, 2020 9:13 AM
Hi again, I followed the instructions from the blog on the weekend and resolved this issue. Thanks to everyone for this thread.
That's great. Glad to hear that.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Sunday, March 15, 2020 3:12 PM
Worked for me too!
Wednesday, March 18, 2020 3:16 AM
Here is a brief summary for useful suggestions above. Hope more people can get help from them.
Issue Symptom:
Get Event ID 3018 & 3025.
Event 3018:
Scenario[ServiceHealth]: GetKillBit. CorrelationId: 767882a3-396f-4e1a-ad1b-28995d0a3b97. The request failed. Mailbox: Url: https://store.office.com/appinfo/query?rt=XML&corr=767882a3-396f-4e1a-ad1b-28995d0a3b97 Exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. > System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. > System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
Event 3025:
Scenario: GetKillBit. Failed to download killbit list from OMEX server. Exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. > System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. > System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
Suggestions:
1. Try to use these registry settings to fix issues with the MSExchangeApplicationLogic 3025 & 3018 event spamming and installing apps in Outlook.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
2. This an article about the similar MSExchangeApplicationLogic Event 3018 issue: MSExchangeApplicationLogic Event 3018 in Exchange Server 2013 and 2016.
If the server that's running Exchange Server has an internet connection, check the proxy server to see whether the URL mentioned is enabled for access.
If the server does not have an internet connection, you can safely ignore this error message. Or, you can reduce the probability of the error occurring in the future.
Regards,
Lydia Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Monday, March 23, 2020 3:05 PM
Just wanted to thank all you guys. Your answers worked and helped a lot! :D
Thursday, April 9, 2020 3:45 AM
Thank you all, registry key SystemDefaultTlsVersions really did the trick!
Moving to the next task to get rid off annoying MSExchangeIS event id 9646 where "client type AirSync exceeded the maximum of X objects of type Message" where X is of any size :)