ESE event descriptions are missing in Event Viewer when the Eseutil utility is called on an Exchange Server 2010 SP1 server

Symptoms

Consider the following scenario:
  • You have a computer that is running Microsoft Exchange Server 2010 Service Pack 1 (SP1).
  • You run a program that calls the Eseutil utility (Eseutil.exe), or you run the Eseutil utility directly.
  • You view Extensible Storage Engine (ESE) events in Event Viewer on the server.
In this scenario, the descriptions of these ESE events are missing. Additionally the events are not formatted correctly.

Cause

This issue occurs because the following registry subkeys are overwritten incorrectly when the Eseutil utility initializes:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Application\ESE\CategoryMessageFile HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Application\ESE\EventMessageFile
The values of the registry subkeys are changed from ESE.dll to Eseutil.exe.

Resolution

To resolve this issue, install the following update rollup:
2579150 Description of Update Rollup 4 for Exchange Server 2010 Service Pack 1

Workaround

To work around this issue, perform one of the following operations:
  • Change the values of the registry subkeys to ESE.dll after the Eseutil utility is called.
  • Restart the Microsoft Exchange Information Store service on the computer.

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Properties

Article ID: 2446908 - Last Review: Jul 28, 2011 - Revision: 1

Feedback