Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
Summary
If you use Microsoft Office Outlook in Cached Exchange Mode, the Offline Address Book is used for common address book operations, such as name lookups or browsing the Global Address List. In Outlook in Cached Exchange Mode, more users use the Offline Address Book compared to users who use earlier versions of Microsoft Outlook.The full set of .oab files is the single largest file that is downloaded from the Microsoft Exchange server apart from the synchronization of your mailbox. Excessive downloading of the full .oab files can occur in Outlook because of known conditions or because of conditions that are unique to an organizations' deployment.Microsoft Office has client-side logging for the full .oab file download available. The client-side logging provides information that you can use to determine whether the full .oab file download was expected (in the specific context), or whether it occurred because of a problem (known or unknown) in either Microsoft Outlook or Microsoft Exchange. If the full .oab file download occurred because of an unknown problem in Outlook or Exchange, the client-side logging information might be useful in the determination of a possible resolution. Note The client-side logging information will not tell you how to resolve the problem. The client-side logging information will tell you the general cause for the full .oab file download. You may have to perform additional advanced troubleshooting or open a support case with Microsoft Product Support Services to find a resolution to the problem.
INTRODUCTION
This article describes the Offline Address Book log details in Microsoft Office Outlook. Offline Address Book log details can be obtained for both Outlook client-side and Exchange server-side.This article discusses the following topics:
Application Event ID 27
By default, Outlook always generates an application event whenever Microsoft Outlook performs a full .oab file download from the Microsoft Exchange server. If you have the OAB logging feature enabled (the default setting), Outlook uses the application event log to track full .oab file downloads. To identify the Offline Address Book downloads, look for items with the following criteria in the application event log:
Event Source: OutlookEvent ID: 27Event Type: Description:Depending on the type of application event, the information that is in the Event Type line will be error messages, warnings, or information. The following sequence of events is an example of the descriptions that might appear in the Description line for this application event in the application event log (in chronological order):
-
Error Event ID 27 event with a description that is similar to "OAB ModDif failed. (Details record in event data)." or "OAB (Offline Address Book) files are invalid. Replaced with stub. (Last errors in event data)."
-
Information Event ID 27 with a description of "Starting OAB Download." This kind of application event contains most of the information for the download cause, and it is the most important application event. This application event signals the beginning of a full .oab file download by Outlook.
-
Information Event ID 27 with a description of "OAB Download Succeeded." This application event signals a successful full .oab file download by Outlook.
Note If the full .oab file download failed, a warning Event ID 27 with a description of "OAB Download Failed" appears instead of "OAB Download Succeeded."back to top
Analyzing Offline Address Book log entries
You can analyze the application event log file information by using the following techniques:
-
Sort the log by Event ID line.
-
Locate events with the following criteria:
Event ID: 27Source: Outlook
-
If the first Event 27 is an "error" type application event, you can expect that the next Event 27 will be an "information" application event. This informs you that a full .oab file download will be started.
-
Open the Event 27 whose description starts with the following text:
"Starting OAB download (See event data)"Note You do not have to have an "error" type application event in to trigger a full .oab file download. For example, if you manually force a full .oab file download, the first Event 27 in the application event log will be the "Information" Event 27 (with a description that contains the "Starting OAB download …" description).
After you have identified the application event that triggered the full .oab file download, you can use the data from the "information" Event 27 to determine the cause of the full .oab file download.The following sample data is from an application event log entry where Outlook downloaded the Offline Address Book because the user started Outlook for the first time in Cached Exchange Mode:
0000: 01 00 00 00 00 00 00 00 ........0008: 00 00 00 00 75 00 00 00 ....u...0010: 75 00 00 00 00 00 00 00 u.......0018: 00 00 00 00 00 00 00 00 ........0020: e9 fd 00 00 02 a3 48 9b éý...£H?0028: ba 12 c4 01 00 00 00 00 º.Ä.....0030: 00 00 00 00 00 00 00 00 ........0038: 00 00 00 00 00 00 00 00 ........0040: 00 00 00 00 00 00 00 00 ........0048: 00 00 00 00 00 00 00 00 ........0050: 00 00 00 00 00 00 00 00 ........0058: 00 00 00 00 00 00 00 00 ........0060: 00 00 00 00 00 00 00 00 ........0068: 00 00 00 00 00 00 00 00 ........0070: 00 00 00 00 00 00 00 00 ........0078: 00 00 00 00 00 00 00 00 ........0080: 00 00 00 00 00 00 00 00 ........0088: 00 00 00 00 00 00 00 00 ........0090: 5c 00 47 00 6c 00 6f 00 \.G.l.o.0098: 62 00 61 00 6c 00 20 00 b.a.l. .00a0: 41 00 64 00 64 00 72 00 A.d.d.r.00a8: 65 00 73 00 73 00 20 00 e.s.s. .00b0: 4c 00 69 00 73 00 74 00 L.i.s.t.00b8: 00 00 00 00 65 38 31 30 ....e81000c0: 35 35 61 38 2d 62 64 38 55a8-bd800c8: 38 2d 34 33 34 62 2d 39 8-434b-900d0: 37 31 37 2d 64 34 33 37 717-d43700d8: 61 62 34 35 31 35 36 39 ab45156900e0: 00 65 38 31 30 35 35 61 .e81055a00e8: 38 2d 62 64 38 38 2d 34 8-bd88-400f0: 33 34 62 2d 39 37 31 37 34b-971700f8: 2d 64 34 33 37 61 62 34 -d437ab40100: 35 31 35 36 39 00 51569In any Offline Address Book application event entry, the first byte of data contains the error code in hexadecimal. It is the error code that tells you the cause of the full .oab file download. The following data is extracted from the complete data set from the previous application event log:
0000: 01 00 00 00 00 00 00 00 ........In this sample data, the first byte is 01. To interpret the 01 code or another code in Offline Address Book application event logs, use the following table to make the correlation between the code number and the cause for the full .oab file download:
|
Result code |
Description |
|---|---|
|
1 |
You do not have any Offline Address Book files on your computer, or the Offline Address Book files could not be opened for some other reason. |
|
2 |
You forced a full .oab file download manually. |
|
3 |
The name of the Offline Address Book could not be obtained on the client. This behavior occurs when you create a new profile. |
|
4 |
The GUID of the Offline Address Book could not be obtained on the client. |
|
5 |
The name of the Offline Address Book was missing from the server. In this case, a full .oab file download is not expected to start or succeed, but it is logged anyway. |
|
6 |
The GUID of the Offline Address Book was missing from the server. In this case, the full .oab file download is not expected to start or succeed, but it is logged anyway. |
|
7 |
The server's Offline Address Book name and the client's Offline Address Book name are different. |
|
8 |
The server's GUID and the client's GUID are different. This behavior can occur if the server had to regenerate a whole new Offline Address Book with the same name and then discarded the old set. Or, the client was moved between different forests. |
|
9 |
The client's sequence number is bigger than the server. |
|
0a (10) |
You want detailed information in the Offline Address Book, but there is no detailed .oab file on your client. This behavior may occur if you manually force a download of the Offline Address Book, and then you click to clear the Download changes since last Send/Receive check box. |
|
0b (11) |
At least one .diff file was missing from the server. |
|
0c (12) |
The sum total of the .diff files to download may not be greater than 1/8 of the full .oab file. |
|
0d (13) |
You have the Allow SRS Full OAB Download registry key set to 1, and your Send/Receive setting was set to always do a full download. |
|
0e (14) |
You do not have the locale of the Offline Address Book installed on your system, and you did a manual full .oab file download. Typically, Outlook updates the address book either once a month, when a conditions hits for such users, or when you download manually. Outlook uses these three methods to update the address book to avoid a condition that would cause a full download every day. |
|
0f (15) |
Applying the .diff file to the .oab file failed for some reason. Sometimes, Event #4 is triggered in this situation. |
The following list contains three other pieces of information that you can gather from the application event log data:
-
the OAB sequence number
-
the server-side address list name that is being used to populate the Offline Address List
-
the GUID for the full .oab file download
You can use error values to determine why an 0f error occurred. To do this, follow these steps:
-
Locate Event ID 27 in the Application Event Log with Starting OAB Download (see event data). in the Description: section.
-
Locate the reason codes in the Description: section of the event that may contain some or all the following asserts:
-
0050: 7a 65 61 7a 61 74 61 7a zeazataz
-
0058: 70 69 61 7a 7a 65 61 7a piazzeaz
-
0060: 61 74 61 7a 70 69 61 7a atazpiaz
-
-
Interpret these reason codes by using the following:
-
"zaez" is an assert for "signature mismatch."
-
"zata" is an assert for MAPI_E_UNEXPECTED_ID.
-
"zaip" means "HrApplyOABDiffs failed. Must download full."
-
-
Depending on the data in the event log, you might need to install the Exchange hotfix that is mentioned in the following Microsoft Knowledge Base article:
895476 Outlook may receive a full download instead of an incremental download when Outlook downloads the offline address book in Exchange Server 2003
OAB sequence number
Both Outlook and Exchange use the OAB sequence number to determine the collection of the .oab files from the server to download to the client. Depending on the sequence number that is found on the client and on the cumulative size of the .diff files, either a differential download or a full download of the Offline Address Book occurs. You can verify the sequence numbers by using the following data.
Client application event log
Starting at offset 0008, you can see that the OAB sequence numbers for the client and the server (in hexadecimal). Offset 0008 is the second line in the following log example:
0000: 09 00 00 00 00 00 00 00 ........0008: 9b 00 00 00 9a 00 00 00 ........The client sequence number is that is contained in the first four bytes (9b in this example) and the server sequence number is in the second four bytes (9a in this example).In the previous sample data, the client's sequence number is bigger than the server's sequence number, and the generated Offline Address Book error code is 9 (this is obtained from the first byte at offset 0000).back to top
Server-side Address List Name
In the scenario where the client and the server Offline Address Book (address list) names are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 3, 5, or 7. You can verify the Offline Address Book (address list) name by using the following data.
Client application event log
Starting at offset 0090 in the following event log example, you can see the name of the server-side address list used to populate the Offline Address List on the server. Additionally, the name that is stored client-side can be found starting at offset 00b8.
0090: 5c 00 47 00 6c 00 6f 00 \.G.l.o.0098: 62 00 61 00 6c 00 20 00 b.a.l. .00a0: 41 00 64 00 64 00 72 00 A.d.d.r.00a8: 65 00 73 00 73 00 20 00 e.s.s. .00b0: 4c 00 69 00 73 00 74 00 L.i.s.t.00b8: 00 00 5c 00 47 00 6c 00 .\.G.l.00c0: 6f 00 62 00 61 00 6c 00 o.b.a.l.00c8: 20 00 41 00 64 00 64 00 .A.d.d.00d0: 72 00 65 00 73 00 73 00 r.e.s.s.00d8: 20 00 4c 00 69 00 73 00 .L.i.s.00e0: 74 00 00 00 38 62 32 61 t...e810In this sample data, the default Global Address List is being used for the Offline Address List. To confirm this is the correct address list, follow these steps in Exchange System Manager:
-
Locate the name of the Offline Address List for your mailbox store on the General tab in the Properties dialog box for the store.
-
Expand the Offline Address Lists container, and then right-click the Offline Address List to view the properties.
-
On the General tab, note the list of address lists that are under Address Lists.
OAB GUID
Both the Exchange server and Outlook use a matching GUID to make sure that they stay synchronized. In the scenario where the client and the server OAB GUIDs are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 4, 6, or 8. You can verify the OAB GUID using the following data.
Client application event log
The GUIDs can be found in the Offline Address Book log data starting at offset 00b8.Offset 00b8 is the first line in the following log example:
00b8: 00 00 00 00 65 38 31 30 ....e81000c0: 35 35 61 38 2d 62 64 38 55a8-bd800c8: 38 2d 34 33 34 62 2d 39 8-434b-900d0: 37 31 37 2d 64 34 33 37 717-d43700d8: 61 62 34 35 31 35 36 39 ab45156900e0: 00 65 38 31 30 35 35 61 .e81055a00e8: 38 2d 62 64 38 38 2d 34 8-bd88-400f0: 33 34 62 2d 39 37 31 37 34b-971700f8: 2d 64 34 33 37 61 62 34 -d437ab40100: 35 31 35 36 39 00 51569The first GUID is for the server and the second GUID (starting at offset 00e0) is for the client.back to top
Administration
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.The following system policy (registry key) can be used to turn off the OAB logging feature if it is not required:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Exchange\Exchange Provider
|
Setting |
Value |
|---|---|
|
Registry Value |
DisableLogging |
|
Registry Type |
REG_DWORD |
|
Registry Data |
1: Disable the OAB logging feature0: (default) If not present or set to 0, Outlook will generate Offline Address Book logs |
If you have both the OAB logging feature and the Allow Full OAB prompt registry key enabled, Outlook will still create the Offline Address Book log entries, even if you click No to the prompt to download the full Offline Address Book.For more information about the "Allow Full OAB prompt" registry key, click the following article number to view the article in the Microsoft Knowledge Base:
841273 Administering the Offline Address Book in Outlook 2003back to top
Privacy issues
The Offline Address Book ModDif failed event contains the complete .diff record that caused a failure. The ModDif event failure occurs when Outlook encounters a failure when it tries to apply a .diff to a file. The details of the .diff record are output to the event data. The ModDif event data might contain phone numbers, e-mail addresses, proxy addresses, and aliases for a particular user. Therefore, you must take this under consideration before you share this data or upload this data to Microsoft Product Support Services.back to top
