Troubleshooting the Recipient Update Service (RUS) using Event Logs - Part 3

Good question - I'll be sure to add this info before we make it a KB article.

When you start the System Attendant service, it loads a series of DLLs. One of these DLLs will be ABV_DG.DLL. Look for this series of events:

Event Type: Information
Event Source: MSExchangeSA
Event Category: General
Event ID: 1000
Date: 7/23/2004
Time: 9:44:49 AM
User: N/A
Computer: BILONGEXCH1
Description:
Microsoft Exchange System Attendant is starting. Microsoft Exchange Server System Attendant, service startup complete, version 6.5 (build 7226.0).

... then some other stuff, probably DSACCESS initializing and such... then:

Event Type: Information
Event Source: MSExchangeSA
Event Category: General
Event ID: 9006
Date: 7/23/2004
Time: 9:44:49 AM
User: N/A
Computer: BILONGEXCH1
Description:
Microsoft Exchange System Attendant is loading 'ABV_DG.DLL'.

Event Type: Information
Event Source: MSExchangeSA
Event Category: General
Event ID: 9008
Date: 7/23/2004
Time: 9:44:50 AM
User: N/A
Computer: BILONGEXCH1
Description:
Microsoft Exchange System Attendant is starting 'ABV_DG.DLL'.

Right after the 9008 indicating that ABV_DG.DLL is starting, you should begin seeing 8011 and 8012 events as it searches for the existing RUS's. If you see the 9006 but not the 9008, the RUS server thinks it's a front-end server. ABV_DG.DLL does not start on a front-end server, so you'll never see any 8011 or 8012 events on a front-end. The RUS needs to be pointed to a back-end.

If you see the 9008, you should see some 8011's and 8012's just after it. After a few of these, you should see it actually search for the existing RUS objects:

Event Type: Information
Event Source: MSExchangeAL
Event Category: LDAP Operations
Event ID: 8011
Date: 7/23/2004
Time: 9:44:50 AM
User: N/A
Computer: BILONGEXCH1
Description:
Searching directory bilongexch1.bilong.test at base 'CN=Recipient Update Services,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test' using filter '(&(objectCategory=msExchAddressListService)(!(IsDeleted=TRUE)))' and requesting attributes distinguishedName; objectGUID; LegacyExchangeDN; msExchADCGlobalNames; ObjectSID; ObjectClass; msExchMasterServiceBL; activationSchedule; activationStyle; msExchAddressListServiceLink; msExchDomainLink; msExchServer1AuthenticationCredentials; msExchServer1AuthenticationPassword; msExchEncryptedPassword; msExchServer1NetworkAddress; msExchExportContainers; msExchReplicateNow; msExchDoFullReplication; msExchServer1LastUpdateTime; msExchServer1HighestUSN; msExchServer1PageSize; msExchPollInterval; msExchServer1Flags; VersionNumber; msExchServer1HighestUSNVector; msExchProcessedSids; msExchDomainGlobalGroupSid; msExchDomainLocalGroupSid; msExchDomainGlobalGroupGuid; msExchDomainLocalGroupGuid; gatewayProxy.

Notice the filter in that event. It's looking for any objects of class msExchAddressListService where isDeleted is not TRUE - basically, any RUS objects that aren't tombstoned. This search should return a number of results equal to the number of RUS's you have:

Event Type: Information
Event Source: MSExchangeAL
Event Category: LDAP Operations
Event ID: 8012
Date: 7/23/2004
Time: 9:44:50 AM
User: N/A
Computer: BILONGEXCH1
Description:
Search of directory bilongexch1.bilong.test at base 'CN=Recipient Update Services,CN=Address Lists Container,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bilong,DC=test' returned 2 objects.

In my case I have only my Enterprise RUS and one domain RUS, so the search returns 2 objects as expected. If this search doesn't return any results, your Exchange server doesn't see the RUS objects, probably due to a permissions problem. If it can't see them, it can't see that it's responsible for any of them, so the RUS will never kick off. But even if it doesn't see them you should periodically see 8011's and 8012's as it checks for the existence of any RUS's. If you're not seeing any 8011's and 8012's at all, then ABV_DG.DLL probably was not started because the server is a front-end.

Hope this helps! Now I need to figure out where to add this info in the doc... :-)