Application error log when failsafe message plays

[Leonlei]

Unity 3.1(6) integrated with Call Manager. Recently from time to time, users will get failsafe message when they are trying to access the vm, the problem could be fixed by reboot unity. But after some while, same issue happened again.

Here are the errors in application log

Source:VBRuntime

Event ID:1

Description:The VB Application identified by the event source logged this Application AvSubSetupUtilsENU: Thread ID: 4576 ,Logged: modPhraseUtilGeneral: ErrorGettingProperty: Error getting property: Greeting

Source:VBRuntime

Event ID:1

Description:The VB Application identified by the event source logged this Application AvSubSetupUtilsENU: Thread ID: 4576 ,Logged: PhrasesPHGreetingENU: PersonalGreeting: Error making PersonalGreeting

AvPhraseServer_MC

Event ID:10002

Description: AvPhrase::Make - error returned from Make for PhraseServer [AvPHGreetENU], PhraseID [PersonalGreeting], Message [Invalid procedure call or argument], Return code [800A0005h].

AvConvMsg_MC

Event ID:10002

Description: IAvPhrase::Make(PersonalGreeting) failed for call handler id 7853. returned [0x800a0005] on line 3159 of file e:\views\cs_UE3.1.5.84\un_Conv2\AvConvPhoneHandler\AvConvPHGreetingSvr\AvSPlayGreeting.cpp

Running conversation PHGreeting on Port 1

AvConvMsg_MC

Event ID:10020

Description:[Thread 0x00000F78] [Port 1]: AvSPlayPhrase::SetPhraseParams() returned [80004005]. In file e:\views\cs_UE3.1.5.84\un_Core2\ConversationEng\AvStateSvr\AvSPlayPhrase.cpp on line 125.

Event System

Event ID:4097

The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 42 of .\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

What should I check on Unity from the error messages for troubleshooting? Thanks,

[Hin Lee]

I've seen this issue once before and it may be due to unavailable RPC. Do you see a drwtsn32.log file? It is hidden - if u see it, look for

Application exception occurred:

App: svchost.exe (pid=536)

Exception number: c0000005 (access violation)

FAULT ->e03c3a68

Do you see any exchange error messages (assuming exchang is on-box)?

I would guess that you may need to do a windows update as I think you may have a worm/virus. I don't think SP4 rollup is approved yet so the safe thing to do may be to go to cisco site and download the patches available there first to see if that fixes your issue - Microsoft Updates for Unity

http://www.cisco.com/cgi-bin/tablebuild.pl/unity_msft_updates

[Leonlei]

Thanks for the valuable suggestion. Actually we have three Unity servers in this IPT system.Only two Unity servers are experiencing this issue and the problem ALWAYS happened on two servers on same day, but another Unity never never had.

I checked the drwtsn32.log file on those two servers having issue and found the exactly same type of errors(just different PID) as you saw before on both and the timing also match with Unity failure. There is no such error in the log on another Unity.

I think the problem should be security patches related. Because the one never had problem is running W2K SP3, but the other two are SP4 without patches. I will ask customer to apply the patches.

Thanks again.

[Hin Lee]

Quote from microsoft.public.exchange2000.general forum "W32.Blaster.Worm is currently exploiting RPC vulnerabilities addressed in MS03-026"

http://groups.google.com/group/microsoft.public.exchange2000.general/browse_thread/thread/7fcf6d9c8efb2a1c/dde13057b051c41e?lnk=st&q=e03c3a68+svchost.exe&rnum=1&hl=en#dde13057b051c41e