Topic Last Modified: 2006-10-05
The Microsoft® Exchange Server Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows® Management Instrumentation (WMI) class to determine whether an Event 6004 warning has been logged for MSExchangeTransport within the last 24 hours.
If the Exchange Server Analyzer finds that an Event 6004 warning has been logged for MSExchangeTransport within the last 24 hours, the Exchange Server Analyzer displays a warning.
This warning indicates that the categorizer encountered an error when it tried to process a message.
The message categorizer examines messages that come to a Simple Mail Transfer Protocol (SMTP) server and determines what to do with the messages. The messages may be destined for the local information store, for a remote host by using the message transfer agent (MTA), or for a remote host by using SMTP. The categorizer also handles distribution list expansion. The categorizer is a plug-in to the advanced queuing engine that performs Lightweight Directory Access Protocol (LDAP) queries against global catalog servers on TCP port 3268. The categorizer is basically a collection of event sinks that perform advanced address resolution on every message that travels through the advanced queuing engine. The categorizer performs address resolution and mail forwarding, sets content conversion flags, expands distribution lists, enforces global settings, and generates delivery status notifications. The categorizer also detects alternative recipient routes and performs bifurcation, journaling, and many other functions.
As soon as a message enters the message categorizer, the categorizer resolves the envelope sender by searching for the address in the proxy address attributes in the Active Directory® directory service. The categorizer also resolves the envelope recipient by searching for each address in the proxy addresses attribute in Active Directory. For example, if the list includes a distribution list, it expands the list to include those members if distribution list expansion is allowed on the server.
Possible causes of MSExchangeTransport Warning event 6004 include the following:
- Directory Service Access (DSAccess) problems.
- Directory replication latency or failures.
- Overloaded global catalog servers
- DNS problems.
To address this warning:
- Verify that Exchange Server has connectivity to one or more
global catalog servers. The Network Monitor tool in Windows is very
useful for this.
- Examine any delivery status notification (DSN) messages that
are generated. DSNs can include non-delivery reports (NDRs). DSNs
describe permanent failure messages and transient failure messages
that frequently end as permanent delivery errors.
- Use Message Tracking to troubleshoot messages that are stuck in
- Use the Archive Sink tool to archive and analyze messages that
enter and exit Exchange Server.
- Monitor the categorizer performance counters by using System
For more information about Exchange Server 2003 events and errors, see the "Events and Errors Message Center" (http://go.microsoft.com/fwlink/?LinkId=34258).
For a listing of the DSNs and NDRs generated by Exchange Server and Microsoft Windows Small Business Server, see Microsoft Knowledge Base article 284204, "Delivery status notifications in Exchange Server and in Small Business Server" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=284204).
For information about how to use the Message Tracking Center in Exchange Server, see the following Microsoft Knowledge Base articles:
- 262162, "XADM: Using the Message Tracking Center to Track a
- 246856, "XADM: How to Enable Message Tracking in
Exchange 2000 Server and in Exchange Server 2003"
- 821905, "Message Tracking Event IDs in Exchange
Server 2003" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=821905).
- 823864, "Improved Message Tracking Features in Exchange
Server 2003" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=823864).
For more information about how to troubleshoot message categorizer issues, see the Microsoft Support WebCast, "Exchange 2000 Server: Message Categorizer and NDR Troubleshooting" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=329137).
For more information about the Archive Sink tool, see Microsoft Knowledge Base article 307798, "The Archive Sink utility is available in Service Pack 2" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=307798).
For general information about how to troubleshoot transport-related problems, see the following Microsoft Knowledge Base articles and resources:
- 821910, "How To Troubleshoot for Exchange Server 2003
Transport Issues" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=821910).
- 257265, "General troubleshooting for transport issues in
Exchange 2000 Server and in Exchange Server 2003"
- 895853, "How to troubleshoot mail relay issues in Exchange
Server 2003 and in Exchange 2000 Server" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=895853).
- "Troubleshooting Mail Flow and SMTP" in the Exchange Server
and Transport Routing Guide (http://go.microsoft.com/fwlink/?LinkID=67875).
The message categorizer performance counters are published separately for each SMTP virtual server instance. For a list of the available performance counters related to the message categorizer, see Microsoft Knowledge Base article 231734, "XCON: Performance Monitor Counters for Message Categorizer" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=231734).