Software

Ask something
Discussion Locked

Exchange ESE97 logs

0 helpful
3 replies

by m.r.

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I recently noticed that the ESE97 EventLog messages were missing the description info on our Exch5.5 on Win2k system. They did appear origionally and I'm suspecting our AV upgrade. On checking an older server I noticed the reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\ESE97 points to the System32\ESE.dll. On the newer problem system it points to System32\RealEse.dll. This is a different install so it may be a vallid entry but the RealEse.dll file doesn't exist while the ESE.dll does. Anyone ever heard of it?

3 replies

by nettek

This is indeed from your AV. In order to scan attachments from incoming and outgoing mail (i.e., realtime monitors for Exchange), the AV software often copies the ese.dll to its own version (realese.dll for example), or temporarily substitutes the ese.dll with its own. This often occurs at bootup, or when the services start.

Have you tried disabling the AV services, rebooting, and then see if you get the event messages?

This sounds like a bug. I would contact the AV manufacturer before messing with the registry on this one.

by m.r.

It is an AV issue. It's back in there QA group now. They recommended a reinstall - no thanks.

This discussion is closed to new replies.