Troubleshooting Offline Address Book Downloads with Outlook Diagnostic Logging (Event ID 27)
This blog covers how to troubleshoot problems that are related to offline address book downloads.
I will go in to detail on how to read the event log entries. This can be done by examining the error code and offline address book sequence number, and by comparing the name of address lists on the Exchange server and the Outlook client.
Office 2003 Service Pack 1 (SP1) and Outlook 2003 SP2 will always generate an event in the Application event log whenever Outlook performs a full offline address book download. If such a download fails for any reason, Outlook will log an event ID 27 with an event type of error and a description that contains information about the failure. In this case, the logged event also includes a result error code that you can use to help isolate the problem.
The following is an example of the hexadecimal data portion of an event log entry logged when the user started Outlook 2003 for the first time in Cached Exchange Mode:
0000: 01 00 00 00 00 00 00 00 ........
0008: 00 00 00 00 75 00 00 00 ....u...
0010: 75 00 00 00 00 00 00 00 u.......
0018: 00 00 00 00 00 00 00 00 ........
0020: e9 fd 00 00 02 a3 48 9b éý...£H?
0028: ba 12 c4 01 00 00 00 00 º.Ä.....
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 00 00 00 00 00 00 00 00 ........
0048: 00 00 00 00 00 00 00 00 ........
0050: 00 00 00 00 00 00 00 00 ........
0058: 00 00 00 00 00 00 00 00 ........
0060: 00 00 00 00 00 00 00 00 ........
0068: 00 00 00 00 00 00 00 00 ........
0070: 00 00 00 00 00 00 00 00 ........
0078: 00 00 00 00 00 00 00 00 ........
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........
0090: 5c 00 47 00 6c 00 6f 00 \.G.l.o.
0098: 62 00 61 00 6c 00 20 00 b.a.l. .
00a0: 41 00 64 00 64 00 72 00 A.d.d.r.
00a8: 65 00 73 00 73 00 20 00 e.s.s. .
00b0: 4c 00 69 00 73 00 74 00 L.i.s.t.
00b8: 00 00 00 00 65 38 31 30 ....e810
00c0: 35 35 61 38 2d 62 64 38 55a8-bd8
00c8: 38 2d 34 33 34 62 2d 39 8-434b-9
00d0: 37 31 37 2d 64 34 33 37 717-d437
00d8: 61 62 34 35 31 35 36 39 ab451569
00e0: 00 65 38 31 30 35 35 61 .e81055a
00e8: 38 2d 62 64 38 38 2d 34 8-bd88-4
00f0: 33 34 62 2d 39 37 31 37 34b-9717
00f8: 2d 64 34 33 37 61 62 34 -d437ab4
0100: 35 31 35 36 39 00 51569
In all offline address book event log entries, the first byte of data contains the error code in hexadecimal. The error code indicates the cause of the full download. In the previous example, the first byte of data is contained in:
0000: 01 00 00 00 00 00 00 00 ........
In this example, the first byte is 01. The following table provides a description of the error codes.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In addition to the result error code, you can gather the following information from the Application event log data:
- The offline address book sequence number
- The server-side address list name that is being used to populate the offline address list.
- The GUID for the full offline address book file download.
There following list contains three other pieces of information that you can gather from the application event log data:
• the OAB sequence number
• the server-side address list name that is being used to populate the Offline Address List
• the GUID for the full .oab file download
You can use error values to determine why an 0f error occurred. To do this, follow these steps: 1. Locate Event ID 27 in the Application Event Log with Starting OAB Download (see event data). in the Description: section.
2. Locate the reason codes in the Description: section of the event that may contain some or all the following asserts:
• 0050: 7a 65 61 7a 61 74 61 7a zeazataz
• 0058: 70 69 61 7a 7a 65 61 7a piazzeaz
• 0060: 61 74 61 7a 70 69 61 7a atazpiaz
3. Interpret these reason codes by using the following:
• "zaez" is an assert for "signature mismatch."
• "zata" is an assert for MAPI_E_UNEXPECTED_ID.
• "zaip" means "HrApplyOABDiffs failed. Must download full."
4. Depending on the data in the event log, you might need to install the Exchange hotfix that is mentioned in the following Microsoft Knowledge Base article: 895476 (https://support.microsoft.com/kb/895476/) Outlook may receive a full download instead of an incremental download when Outlook downloads the offline address book in Exchange Server 2003
The following table provides examples of some of the descriptions that might appear in these events.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
Offline Address Book Sequence Number
Both Outlook and Exchange Server use the offline address book sequence number to determine the offline address book files to be downloaded to Outlook. Depending on the sequence number that is found on the client and on the cumulative size of the differential files, either a differential download or a full download of the offline address book occurs. You can verify the sequence numbers by examining the data portion of the logged event.
The offline address book error code is found on the first line of the event data (offset 0001). The offline address book sequence numbers for the client and the server are found on the second line of the event log data (offset 0008). The following is an example of such data:
0000: 09 00 00 00 00 00 00 00 ........
0008: 9b 00 00 00 9a 00 00 00 ........
In this example, the address book error code is 09, or simply 9. As shown in the first table in this topic, this error code indicates that the client's sequence number is larger than the server's sequence number. The client sequence number is contained in the first four bytes (9b in this example), and the server sequence number is in the second four bytes (9a in this example).
Server-Side Address List Name
In a scenario where the client's offline address book and Exchange Server computer's offline address list names are mismatched or missing, a full offline address book download occurs. In this case, the generated result error code is 3, 5, or 7. You can verify the offline address book (and offline address list) name by examining the data portion of the logged event.
The name of the list that the Exchange Server is using to populate the offline address list on the server can be found starting on the nineteenth line of the event data (offset 0090). The name of the list that Outlook is using can be found starting on the twenty-fourth line of the event data (offset 00b8). The following is an example of such data:
0090: 5c 00 47 00 6c 00 6f 00 \.G.l.o.
0098: 62 00 61 00 6c 00 20 00 b.a.l. .
00a0: 41 00 64 00 64 00 72 00 A.d.d.r.
00a8: 65 00 73 00 73 00 20 00 e.s.s. .
00b0: 4c 00 69 00 73 00 74 00 L.i.s.t.
00b8: 00 00 5c 00 47 00 6c 00 .\.G.l.
00c0: 6f 00 62 00 61 00 6c 00 o.b.a.l.
00c8: 20 00 41 00 64 00 64 00 .A.d.d.
00d0: 72 00 65 00 73 00 73 00 r.e.s.s.
00d8: 20 00 4c 00 69 00 73 00 .L.i.s.
00e0: 74 00 00 00 38 62 32 61 t...e810
In this example, the default global address list (GAL) is being used for the offline address list.
Offline Address Book GUID
In addition to using matched address list names, both Exchange and Outlook use a matching GUID to make sure that they stay synchronized. In the scenario where Outlook's offline address book GUID does not match the GUID used by the Exchange Server computer, a full offline address book download occurs. The generated offline address book result error code is 4, 6, or 8. You can verify the offline address book GUID by examining the event data.
The GUID used by the Exchange Server starts at offset 00b8. The GUID used by Outlook starts at offset 00e0. The following is an example of such data:
00b8: 00 00 00 00 65 38 31 30 ....e810
00c0: 35 35 61 38 2d 62 64 38 55a8-bd8
00c8: 38 2d 34 33 34 62 2d 39 8-434b-9
00d0: 37 31 37 2d 64 34 33 37 717-d437
00d8: 61 62 34 35 31 35 36 39 ab451569
00e0: 00 65 38 31 30 35 35 61 .e81055a
00e8: 38 2d 62 64 38 38 2d 34 8-bd88-4
00f0: 33 34 62 2d 39 37 31 37 34b-9717
00f8: 2d 64 34 33 37 61 62 34 -d437ab4
0100: 35 31 35 36 39 00 51569
If the GUIDs of the Outlook offline address book and the Exchange Server computer do not match, you need to delete the existing offline address book files and perform a full offline address book download.
Dave