Failed to download killbit list from OMEX server

Question

_{Sunday, May 17, 2020 1:08 PM}

Hi

EX 2016 CU16

There's not much information available in the web regarding the following error:

Event 3025, MSExchangeApplicationLog:

Scenario: GetKillBit. Failed to download killbit list from OMEX server. Exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. > System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. > System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
   at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
   at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
    End of inner exception stack trace
   at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
   at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
    End of inner exception stack trace
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.BaseAsyncOmexCommand.<>c__DisplayClass18_0.<EndGetResponseCallback>b__0()

Any ideas what could be wrong?

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help.

All replies (5)

_{Monday, May 18, 2020 6:56 AM ✅Answered}

Hi Sven J,

Do you have any issues about the Exchange server?

During my research, there is a possible solution for this event log. Adding the following registry values and rebooting the server to fix issue with MSExchangeApplicationLog Event 3025 :

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001

If there are no Exchange server performance issues or if the server doesn’t have an internet connection, you can safely ignore the error message.

You can refer to this similar thread: Event MSExchangeApplicationLogic 3025 & 3018

Regards,

Vincy Cao

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, May 18, 2020 5:37 AM}

Hello Sven

You really shoud discard this error message.
Indeed every 6 hours your IIS servers will try to check an Online Link (Microsoft Office store).

The local folder (i.e. C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\Owa\prem\Your Exchange version>\ext\killbit) may have a killbit.xml file.
And your IIS cannot find it.

Florent

_{Monday, May 18, 2020 7:20 AM}

Hi

I don't see any issues at the moment, I'm just curious.

Thank You. Will try if the next maintenance window will open.

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help.

_{Monday, July 6, 2020 8:32 PM}

Hi

I don't see any issues at the moment, I'm just curious.

Thank You. Will try if the next maintenance window will open.

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help.

Hello there,

I am seeing the same in one of our servers, did you find anything out? 

_{Friday, July 10, 2020 6:09 PM}

Have same issue.  Don't think ignoring ERROR level logs is best practice.  Did anyone find a solution.