Exchange: Event ID 9667

In the recent months, we received multiple reports about MSExchangeIS 9967 event IDs in the Windows Event Log—our clients were wondering if ORF is involved in the issue. Well, it is not, but this Exchange 2007 problem is worth telling a few words about.

If you find warnings with event ID 9666 or errors with ID 9667, you are soon reaching/reached the quota on the number of Named Properties (you did not know you have anything called that, did you? :) The error message is something like this:

Failed to create a new named property for database “First Storage Group\Mailbox Store (server)”, because the number of named properties reached the quote limit (8250). User attempting to create the named property: “username“. Named property GUID: GUID. Named property name/id: “X-whatever“.

The issue is caused by the so-called X-headers. Emails have a well-defined set of standard headers, like From: which stores the sender or Subject: which stores the email subject. When email software wants to add something non-standard to the header, it adds them as X-headers, e.g. X-My-Special-Header: Is-Awesome.

Now, for every new X-header type seen, Exchange 2007 adds a new Named Property to the database, so X-My-Special-Header and X-Your-Special-Header take two entries, but X-My-Special-Header: Is-Cool and X-MySpecial-Header: Is-Awesome take only one, because they are of the same type, X-My-Special-Header.

Ok, but here comes trouble: there are awful lot of different software on the Internet and they simply love adding X-headers. The more the better. Given sufficient time and email traffic, you can actually reach the default quota of 8192 (or 16,384, but the max quota is 32,766). All those X-Spam-Status:, X-SpamInfo:, X-MIBTO:, X-Quarantine-ID:, X-DSPAM-Probability:, X-SEF-Processed:, X-LID:, X-My-Special: headers add up. I am subscribed to a newsletter where emails have a X-SEF-9ED26101-DDA5-4A4D-8030-449F502FF2BC header – even though this header is the same for every mailing, a quick search on the Internet shows that the GUID after X-SEF- varies, probably from installation to installation. Receive 8192 emails from various sites like that and you are out of luck. Sure, adding any X-headers is not wrong per se, it is just your Exchange that has hard time with these emails.

In case the quota is reached, Microsoft has solution on TechNet which basically recommends to set the quota higher and recover the database.

As a preventive measure, you can also remove unwanted X-headers— the HeaderFilterAgent does exactly that (disclaimer: we are not affiliated with the agent author). Before installing the agent, make sure that you have a good whitelist of X-headers you need: as can be seen in the comments, software sometimes relies on X-headers for communication.

5 thoughts on “Exchange: Event ID 9667

  1. Pingback: Vamsoft Insider » UPDATE: Exchange: Event ID 9667

  2. Pingback: Vamsoft Insider » Get-NamedProperty

  3. Brian

    Does anyone know what actually happens when the quota is reached? What happens on the mailstore, or what would the users see or not see if the quota is reached?

Leave a Reply

Your email address will not be published. Required fields are marked *

AlphaOmega Captcha Classica  –  Enter Security Code