Exchange 2013,2010 – Event logs gathering (Health Check part 2.)

I have mede a script, which connects to all Exchange servers in organization using remote powershell and gathers all event logs for you to central place. Then it analyses event logs based on previous article (https://wordpress.com/post/40179192/2178/) (database of event IDs must be stored as CSV file delimited by semicolon). The result is again XLSX file with two worksheets. One is event ID raw data and second is analyzed event IDs. If there is event ID not present in the database, script marks it with “NEW IN DB, must be found first” in the Action row. If you run the script with empy CSV for database, it will generate XLSX as well, but you have to find solution for every event.

The script utilizes Export-XLSX.ps1. Thanks guys for the great job! https://gallery.technet.microsoft.com/office/Export-XLSX-PowerShell-f2f0c035

Example of script:

# Event logs gathering
Write-Host "Event logs gathering ... " -ForegroundColor White
#Event log variables
$exservers = get-exchangeserver
$evtlogdaysback = 1
$experfwizserver = hostname
$experfwizfilepath = "\\$($experfwizserver)\c$\ExchangeHealthCheck"   #  zmeneno z c:...
$outpath = "\\$($experfwizserver)\c$\ExchangeHealthCheck"
$WellKnownEventLogDB = import-csv .\wellknownevents.csv -Delimiter ";"

############## evt log gathering
$evtlogout = @()
  foreach ($exsvr in $exservers){
                Write-Host "Processing Exchange server $($exsvr.fqdn) ...."
                
                $evtlogout +=Invoke-Command -computername $exsvr.fqdn -ScriptBlock {
                $dat = ((get-date).adddays(-$args[0]))
                Get-eventlog -LogName * | select log | foreach {get-eventlog -LogName $_.log -EntryType Error,warning | where {$_.TimeGenerated -gt $dat} | select eventID,MachineName,Category,CategoryNumber,EntryType,Message,Source,TimeGenerated,PSComputerName}
                } -ArgumentList $evtlogdaysback

       }
       $bck = $evtlogout
$evtlogout = $evtlogout
#EVTlog cleaning
$i = 0
$out = @()
foreach ($line in $evtlogout){
$melio = ""
$line.message = $line.message.replace("`r`n","--")
foreach ($meli in $line.message){$melio = "$($melio) " + $meli}
$line.message = $melio
$out +=$line
}
# Event logs grouping, counting and comparing with WellKnownEventLogs Flat File DB
$res = @()
$WellKnownEventLogDB = import-csv .\wellknownevents.csv -Delimiter ";"
$analysedevents = "" | select count,eventid,entrytype,source,Message,action,affectedservers
$groupedlogs = $out | group eventID,source | sort name
foreach ($evtgroup in $groupedlogs){
        $match = 0
        foreach ($dbline in $WellKnownEventLogDB){

            if($dbline.Eventid -match $evtgroup.name.split(",")[0]){
              if($dbline.Source -match $evtgroup.name.split(",")[1].trim()){
                            $analysedevents = "" | select count,eventid,entrytype,source,Message,action,affectedservers
                            $analysedevents.eventid = $dbline.Eventid                        
                            $analysedevents.entrytype = $dbline.EntryType
                            $analysedevents.source = $dbline.Source
                            $analysedevents.Message  = $dbline.Message
                            $analysedevents.action =  $dbline.action
                            $analysedevents.affectedservers = "$($evtgroup.group | select machinename | group machinename | select name)"
                            $analysedevents.count = $evtgroup.count
                            $res +=$analysedevents
                            $match = 1
                            }
                }
        }
 $match
       if ($match -eq 1){}else{
            $analysedevents = "" | select count,eventid,entrytype,source,message,action,affectedservers
            $analysedevents.eventid = $evtgroup.name.split(",")[0]                        
            $analysedevents.EntryType = $evtgroup.group[0].EntryType
            $analysedevents.source = $evtgroup.name.split(",")[1].trim()
            $analysedevents.message  = $evtgroup.group[0].message
            $analysedevents.action =  "NEW IN DB, must be found first"
            $analysedevents.affectedservers = "$($evtgroup.group | select machinename | group machinename | select name)"
            $analysedevents.count = $evtgroup.count
                $res +=$analysedevents
               }

}
$res | .\Export-xlsx -path "$($xlsout)\EventLogs.xlsx" -WorKsheetname "Analyzed EVENT logs" -Append
$EvtNotExchrelLOGS  = $out
$EvtNotExchrelLOGS | .\Export-xlsx -path "$($xlsout)\EventLogs.xlsx" -WorKsheetname "Event logs raw data" -Append






################################################################################################################################################################################################################################


################################
#   Ends HERE                  #
################################

 Download:

https://onedrive.live.com/redir?resid=3941F86AC9A4F457!9241&authkey=!AG73DJErvetxKsM&ithint=file%2czip

 

Exchange 2013,2010 – Event log analysis (Health Check part 1.)

I have created a database of common event log Errors and Warning generated on Exchange servers. Here is the list of Event IDs, description and its solution:

EventID	EntryType	Source	Message	Action
4	Error	MSExchange Control Panel	Current user: ‘<USER>’–Request for URL ‘<URL> failed with the following error:<ERROR>	No action needed if not frequent.
6	Error	MSExchange CmdletLogs	Cmdlet failed. Cmdlet <CMDlet>, <Parameters>.	No action needed
50	Error	Microsoft-Windows-Time-Service	The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.	Register correct time source and check if it is correctly synchronized
63	Warning	Microsoft-Windows-WMI	A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace <NAMESPACE> to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.	No action needed if not frequent
74	Warning	MSExchange RBAC	(Process w3wp.exe, <PID>) <user ID> in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.	test DataProtection Health Set http://technet.microsoft.com/en-us/library/ms.exch.scom.dataprotection(v=exchg.150).aspx
106	Error	MSExchange Common	Performance counter updating error. Counter name is Time in Resource per second, category name is <Category name>. Optional code: <number>. Exception: The exception thrown is : <Exception text>.	This is common error, which can be handled by re-registering performance counters (use http://support.microsoft.com/kb/2870416)
111	Error	AD FS	The Federation Service encountered an error while processing the WS-Trust request <description>	Chceck Technet articles based on exception (usually wrong username / password or wrong account)
118	Error	ExchangeStoreDB	At <Time> the copy of database ‘<MDB GUID>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted.	check Technet for right solution – https://technet.microsoft.com/en-us/library/hh361352(v=exchg.140).aspx
129	Warning	Microsoft-Windows-Time-Service	NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found.	Check NTP environment health
131	Warning	Microsoft-Windows-Time-Service	NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ‘<DNS name of NTP>’. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known.	Check DNS resolution for NTP client/Server
139	Error	ExchangeStoreDB	At <Time> the copy of database ‘<MDB GUID>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted.	check Technet for solution – https://social.technet.microsoft.com/Forums/en-US/878c4557-81ca-4aab-94f4-9fac30d4bb71/false-database-performance-alerts?forum=exchangesvradminlegacy
139	Error	ExchangeStoreDB	At <time> the copy of database ‘<MDB name>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted	Reset search index catalog for affected MDB (https://social.technet.microsoft.com/Forums/en-US/878c4557-81ca-4aab-94f4-9fac30d4bb71/false-database-performance-alerts?forum=exchangesvradminlegacy)
143	Error	MSExchange OWA	RMS templates for the organization couldn’t be loaded due to Microsoft.Exchange.Security.RightsManagement.RightsManagementException:<exception, URL of RMS>	check connectivity to RMS server from inside and outside of the organization
245	Error	ESE	Information Store – <MDB ID>: The internal database copy (for seeding or analysis purposes) has been stopped because it was halted by the client or because the connection with the client failed.——For more information, click http://www.microsoft.com/contentredirect.asp.	check seeding failures on affected servers and ints connection to backup software
342	Error	AD FS	Token validation failed	no action needed – wrong user credentials
364	Error	AD FS	Encountered error during federation passive request. <Exception>	Check TEchnet articles based on exception (usually wrong username / password)
401	Error	MSExchange Common	The organization certificate named <ThumbPrint> in the Federation Trust object <TRUST OBJECT> cannot be found in the computer’s certificate store. Please review the Federation Trust properties and the certificates present in the certificate store of the server.	Check servers for federation certificate. Import certificate if not present
415	Warning	AD FS	The SSL certificate does not contain all UPN suffix values that exist in the enterprise. Users with UPN suffix values not represented in the certificate will not be able to Workplace-Join their devices. For more information, see http://go.microsoft.com/fwlink/?LinkId=311954.	create ALIASES for your ADFS server farm. – https://technet.microsoft.com/library/dn614658.aspx
489	Error	ESE	msexchangerepl <PID> Log Verifier <LOG BASE NAME>: An attempt to open the file “<LOG FILE>” for read only access failed with system error <ERROR ID>: “The process cannot access the file because it is being used by another process. “.   The open file operation will fail with error <ERROR>	check log file accessibility and file lock and its connection to antivirus and backup software
507	Warning	ESE	Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.	Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
509	Warning	ESE	Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS. In addition, <count> other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted <time delay> seconds ago. This problem is likely due to faulty hardware.	Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
510	Warning	ESE	Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS.	Connected to 507,509. Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
628	Warning	ESE	Information Store – <MDB and PID>: Database ‘<EDB file>’: While attempting to move to the next or–previous node in a B-Tree, the database engine skipped over <Number>–non-visible nodes in <Number> pages. It is likely that these non-visible–nodes are nodes which have been marked for deletion but which are–yet to be purged. The database may benefit from widening the online–maintenance window during off-peak hours in order to purge such nodes–and reclaim their space. If this message persists, offline–defragmentation may be run to remove all nodes which have been marked–for deletion but are yet to be purged from the database.	check performance and space of MDB and log volume, check maintenance window size and icrease if needed
629	Warning	ESE	Information Store – <MDB and PID>: Database ‘<EDB file>’: While attempting to move to the next or–previous node in a B-Tree, the database engine skipped over <Number>–non-visible nodes in <Number> pages. It is likely that these non-visible–nodes are nodes which have been marked for deletion but which are–yet to be purged. The database may benefit from widening the online–maintenance window during off-peak hours in order to purge such nodes–and reclaim their space. If this message persists, offline–defragmentation may be run to remove all nodes which have been marked–for deletion but are yet to be purged from the database.	check performance and space of MDB and log volume, check maintenance window size and icrease if needed
1000	Error	Application Error	Faulting application name<description>	check faulting application and use Technet to find related article
1000	Warning	AD FS	An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request. The data includes an Activity ID that you can cross-reference to error or warning events to help diagnose the problem that caused this error.	check event logs for Correlation Activity ID event logs and check technet for solution
1006	Warning	MSExchangeFastSearch	The FastFeeder component received a connection exception from FAST. Error details: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]:	check FAST search or recreate FAST from scratch https://social.technet.microsoft.com/Forums/office/en-US/9679decc-8707-4ace-80cf-5f57833e59c2/exchange-2013-content-index-status-unknown?forum=exchangesvrdeploy
1007	Error	MSExchangeDiagnostics	Failed to create or start performance logs with error: System.ArgumentException: <Exception>	Check servers if event log is frequent
1008	Warning	MSExchange ActiveSync	An exception occurred and was handled by Exchange ActiveSync. This may have been caused by an outdated or corrupted Exchange ActiveSync device partnership. This can occur if a user tries to modify the same item from multiple computers. If this is the case, Exchange ActiveSync will re-create the partnership with the device.	check CAS server configuration for max request length (http://blogs.technet.com/b/get-exchangehelp/archive/2013/06/10/event-id-1008-quot-maximum-request-length-exceeded-quot.aspx)
1009	Warning	MSExchangeFASTSearch	The indexing of mailbox database <DB GUID> encountered an unexpected exception. Error details: Microsoft.Exchange.Search.Core.Abstraction.OperationFailedException: The component operation has failed.
1009	Error	MSExchangeHM	Microsoft Exchange Health Manager worker process <PID> received restart request and will be stopped. Restart reason: <RASON>	No action if not frequent
1010	Warning	MSExchangeFASTSearch	An operation attempted against a FAST endpoint exprienced an exception. This operation may be retried. Error details: Microsoft.Exchange.Search.Fast.PerformingFastOperationException: An Exception was received during a FAST operation. —> System.ServiceModel.CommunicationException	check FAST service connection to database
1012	Error	MSExchange Store Driver Submission	The store driver failed to submit event <Event> mailbox <mailbox ID><MDB> couldn’t generate an NDR due to exception <Exception>	No action needed. Usually caused by invalid sender
1012	Error	MSExchangeDiagnostics	Data loss occurred in RetentionAgent: RetentionAgent: Data loss occurred. The size of this folder <Diagnostic logging path> has reached the max size allowed -<SIZE>. Some files will be purged.	Connected to warning 1013. Consider increasing logging quota or redrect once it is available. Nowadays no action possible but cleaning logs.
1013	Warning	MSExchangeDiagnostics	Potential data loss warning in RetentionAgent: RetentionAgent: Warning: Potential data loss. The size of this folder <Daily Perf logs path> has reached 95% of max size allowed – <SIZE>. Some data will be purged once it reaches the max limit.	Connected to error 1012. Consider increasing logging quota or redrect once it is available. Nowadays no action possible but cleaning logs.
1014	Warning	Microsoft-Windows-DNS-Client	Name resolution for the name <DNS record>. timed out after none of the configured DNS servers responded.	Check if frequent, might be caused by maintenance
1023	Error	Perflib	The description for Event ID ‘<Event ID number>’ in Source ‘<source>’ cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'<Service>’, ‘<Event>’	check correct registry entries for event log mentioned in the event log message https://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx
1023	Warning	MSExchange ActiveSync	Exchange ActiveSync tried to access a mailbox on Mailbox server “<SERVER>”. It could not access the mailbox because the Mailbox server is offline.	Check if frequent. Might be caused due to server in maintenance
1028	Error	MSExchange Store Driver Delivery	OOF history corruption was detected in mailbox <SMTP>	use New-MailboxRepairRequest for affected mailbox
1029	Error	MSExchange Store Driver Delivery	Unable to open the OOF history folder <SMTP>. OOF history operation skipped.	use New-MailboxRepairRequest for affected mailbox
1032	Warning	MSExchange ActiveSync	The connection to mailbox <IDENTITY> on Mailbox server <SERVER> failed. Examine the event log of Mailbox server <SERVER>	Check server if event is frequent
1035	Warning	MSExchangeFrontEndTransport	Inbound authentication failed with error LogonDenied for Receive connector <Receive Connector Name> The authentication mechanism is <Authentication type>. The source IP address of the client who tried to authenticate to Microsoft Exchange is [<SourceIP>].	Check default authentication types for particular receive connector and change it according the best practice for Exchange server – https://technet.microsoft.com/cs-CZ/library/aa996395(v=exchg.150).aspx
1039	Error	MSExchangeDiagnostics	Failed to detect the bitlocker state for EDS log drive <Drive>	If no Bitlocker enabled, service throuws an event, no action needed
1039	Warning	MSExchangeHMHost	Worker process manager timed out after <Number> seconds while waiting for a retired process handles to close (process id : <PID> ).	No action needed if infrequent
1040	Error	MSExchangeFrontEndTransport	The SMTP availability of the Receive connector Server <Receive connector Name> was low (<number> percent) in the last 15 minutes.	correct solution not available, probably caused by incorrect function of ExchangeHM, check free disk space for transport database and consider moving transport database to dedicated volume
1040	Warning	MSExchange ActiveSync	The average of the most recent heartbeat intervals [<number>] for request [Sync] used by clients is less than or equal to [<number>].–Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.	For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, “Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology” (http://go.microsoft.com/fwlink/?linkid=3052&amp kbid=905013).
1050	Warning	MSExchange Extensibility	The execution time of agent ‘<Transport agent name>’ exceeded <Time span> milliseconds while handling event ‘<Transport Pipeline event>’ for message with InternetMessageId: ‘<Message ID>’. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message.	check transport for messages in queues, restart transport service
1051	Warning	MSExchange Extensibility	Agent ‘<Transport Agent name>’ caused an unhandled exception <Exception>	update exchange for latest version, otherwise no action needed
1057	Error	MSExchange Extensibility	Agent ‘<Transport agent name>’ went async but did not call Resume on the new thread, while handling event ‘<Transport Pipeline Event>’	This should be sent to the vendor of the application server calling async. logging according to: http://blogs.msdn.com/b/dvespa/archive/2013/02/18/exchange-2013-async-agent-resume-1057.aspx
1077	Warning	MSExchangeIS	The mailbox <Identity> on database <MDB GUID> is approaching its storage limit. A notification has been sent to the user. This warning will not be sent again for at least twenty four hours.	No action needed
1079	Warning	MSExchange Unified Messaging	The VoIP platform encountered an exception RequestUri=sip:<sip URI and port>transport=Tls	ID connected to 1136. check UM certificate. It must have SN as same as UM server name https://social.technet.microsoft.com/Forums/lync/en-US/59bdff60-355f-4105-9843-7e3e92a0d020/event-ids-1079-1136-hangups?forum=exchangesvrunifiedmessaginglegacy
1111	Error	UmrdpService	Driver<DRIVER NAME> required for printer <PRINTER> is unknown. Contact the administrator to install the driver before you log in again.	No action needed
1136	Warning	MSExchange Unified Messaging	An error occurred while transferring a call to “<Extension>”. Additional information: The call transfer type is “Blind.”, the transfer target is “phone number”. Call ID: “<Call GUID>”. Referred by: “”.	ID connected to 1079 check UM certificate. It must have SN as same as UM server name https://social.technet.microsoft.com/Forums/lync/en-US/59bdff60-355f-4105-9843-7e3e92a0d020/event-ids-1079-1136-hangups?forum=exchangesvrunifiedmessaginglegacy
1282	Error	Microsoft-Windows-FailoverClustering	Security Handshake between local and remote endpoints ‘<Source endpoint IP>~ -> <remote endpoint IP>’ did not complete in ‘<time>’ seconds, node terminating the connection	check DAG status if occurs frequently
1309	Warning	ASP.NET 4.0.30319.0	Event message: The request has been aborted<description>	check ASP config in IIS and increase ASP request timeout value
1657	Warning	MSExchange Unified Messaging	DTMF map update failed for recipient “<Recipient GUID>”. Tenant: “Enterprise”, Run Id: “<RunID GUID>”, Error: Unable to read recipient.	check if recipient can be read by Exchange server (inheritable properties) and correct DTMF mapping https://technet.microsoft.com/en-us/library/aa996919(v=exchg.150).aspx
1692	Warning	MSExchange Unified Messaging	The Microsoft Exchange Unified Messaging service couldn’t establish a media channel with the current Lync Server Audio/Video Edge resources associated with <LYNC host name and port>. Diagnostic information: No diagnostic information is available.	check connection to EDGE server
2001	Error	MSExchange Certificate Notification	A transient failure has occurred. The problem may resolve itself. <DESCRIPTION>	No action needed if not frequent.
2004	Warning	MSExchange OAuth	Unable to find the certificate with thumbprint <thumbprint> in the current computer or the certificate is missing private key. The certificate is needed to sign the outgoing token.	check mentioned certificate, recreate OAUTH certificate – https://social.technet.microsoft.com/Forums/exchange/en-US/6d67e5ef-555e-41a5-8de9-2a56cf95363a/missing-the-microsoft-exchange-server-auth-certificate?forum=exchangesvradmin
2005	Warning	MSExchange Certificate Deployment	Federation or Auth certificate not found: <THUMBPRINT>. Unable to find the certificate in the local or neighboring sites. Confirm that the certificate is available in your topology and if necessary, reset the certificate on the Federation Trust to a valid certificate using Set-FederationTrust or Set-AuthConfig. The certificate may take time to propagate to the local or neighboring sites.	consider updating Federation trust with new certificate
2005	Warning	MSExchange Mid-Tier Storage	<Process><Exception>	check if frequent, this is common event log with no direct solution
2009	Warning	MSExchange Mid-Tier Storage	[Process:Microsoft.Exchange.RpcClientAccess.Service PID:<PID> Thread:<THREAD>] Error occurred while resolving the Active Directory object for from email address field: ‘<SMTP address>’. Audit log will not be generated for this case. Exception details<DETAILS>	No action needed if not frequent, caused by unknown object being searched in AD
2030	Error	MSExchangeFrontEndTransport	The Ehlo options for the client proxy target <IP> did not match while setting up proxy for user <SMTP address> on inbound session <Session GUID>. The mismatched settings might cause some messages to get rejected. Continue with proxying even though there is a mismatch. The critical non-matching options were maxSize. The non-critical non-matching options were .	Ensure that message size limits are same within all environment, especially FrontEnd and HUB transport messahe limits must correspond to not get messages rejected with NDR – http://technet.microsoft.com/en-us/library/bb124345(v=exchg.150).aspx
2058	Error	MSExchangeRepl	The Microsoft Exchange Replication service was unable to perform an incremental reseed of database copy ‘<MDB copy name>’ due to a network error. The database copy status will be set to Disconnected. Error A timeout occurred while communicating with server <Server>’. Error: “A connection could not be completed within <time span> seconds.”	test replication health against the affected database copy
2091	Warning	MSExchangeRepl	Database: <MDB Copy>–Mailbox Server: <MBX Server>—Database <DB copy> will be mounted with the following loss information:–* The last log generated (known to the server) before the switchover or failover was	check DAG MDB failover and Data loss settings
2107	Warning	MSExchange ADAccess	Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Exchange Active Directory Provider failed to obtain an IP address for DS server <DNS name>, error <ERROR ID>. This host will not–be used as a DS server by Exchange Active Directory Provider.	check DNS regarding to AD
2120	Error	MSExchange ADAccess	Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Error ERROR_TIMEOUT (0x800705B4) occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain <DOMAIN>	check availability of DNS service for AD Topology Service
2123	Warning	MSExchange ADAccess	Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Exchange Active Directory Provider is unable to connect to the Domain Controller <Domain Controller>	check availability of DNS service for AD Topology Service
2137	Warning	MSExchangeRepl	RPC request to the Microsoft Exchange Information Store service for log truncation failed for database <MDB copy name>. Error: Failed to notify source server ‘<source Exchange server name>’ about the local truncation point. Hresult: <result>. Error: Operation has been aborted.	check mailbox database replay and copy queue length as well as truncation log time for lagged copy database
2142	Error	MSExchangeADTopology	Process Microsoft.Exchange.Directory.TopologyService.exe <PID> Forest <FOREST>. Topology discovery failed, error details –TimedOut.	No action needed if not frequent
2153	Error	MSExchangeRepl	The log copier was unable to communicate with server ‘<Mailbox server name>’. The copy of database ‘<MDB copy name>’ is in a disconnected state. The communication error was: An error occurred while communicating with server ‘<Mailbox server name>’. Error: Unable to write data to the transport connection: An established connection was aborted by the software in your host machine. The copier will automatically retry after a short delay.	check mailbox database copy health on mailbox servers experiencing errors
2193	Warning	MSExchange ADAccess	Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Suitability check failed for server <DC> with an exception. <Exception>	Check connection to affected DC. No immediate action needed. DC can be down for maintenance
3008	Warning	MSExchange Front End HTTP Proxy	[Owa] Failed to refresh Mailbox server for database <MDB GUID> in resource forest . Exception:<Exception>	check databases availability
3028	Warning	MSExchangeApplicationLogging	Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file ‘<KillBit XML file path>’ because it is being used by another process.	use handle.exe for killbit.xml file to chek which process is using it, consider antivirus and backup software exclusions for Exchange related files and paths according MS Best Practice
3028	Warning	MSExchangeApplicationLogic	Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file ‘<Killbit file path>’ because it is being used by another process.<Exception>	Check file accessibility. Might be caused by antivirus or backup
4001	Warning	MSExchangeIS	Microsoft Exchange Information Store service has encountered a message (internet message id <ID>) with an invalid submit time (<TIME>). Duplicate copies of this message may be delivered.	No action if not frequent
4002	Error	MSExchange Availability	Process <PID>: ProxyWebRequest CrossSite from <GUID> to https://ex13-cz-02.cz.avg.com:444/ews/Exchange.asmx failed <Description>	check EWS authentication and settings on both endpoints – https://social.technet.microsoft.com/Forums/exchange/en-US/fbaeb391-ab2b-428a-a376-12c3845c67b2/event-id-4002-availability-server
4009	Error	MSExchange Availability	Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: Unable to open connection for mailbox <MAILBOX><EXCEPTION>	No action if not frequent
4026	Error	MSExchangeRepl	[Seed Manager] The seed request for database ‘<DB ID>’ encountered an error during seeding. Error: An Exception was received during a FAST operation.	check index and FAST service state for the database mentioned in error description
4057	Error	MSExchangeRepl	The Microsoft Exchange Replication service encountered an unexpected error in log replay for database <ID>. Error MapiExceptionMdbOffline: LogReplayRequest rpc failed.	check if exists after correction of HC – bring DB online
4065	Error	MSExchangeRepl	The Microsoft Exchange Replication service sent a request to Hub Transport server <Server ID> to resubmit messages for database <DB ID> between time period	check if exists-Test-ReplicationHealth
4082	Error	MSExchangeRepl	The replication network manager encountered an error while monitoring events. Error: Microsoft.Exchange.Cluster.Replay.ClusterNetworkNullSubnetException: Cluster network	check if exists – Test-ReplicationHealth
4110	Error	MSExchangeRepl	The Microsoft Exchange Replication service has suspended log replay on database <DB ID> because the current copy queue length of 16 exceeds the threshold of 12. Replay will automatically be resumed when the queue length falls below 5	check queues and DB replicas
4112	Warning	MSExchange ADAccess	Process <PROCESS><PID>. AD Session operation failed on DC <DC> because this server is not suitable at the moment. DomainController value set on the session instance: <DESCRIPTION>	No action needed if not frequent, might be caused by patching
4401	Error	MSExchangeRepl	Microsoft Exchange Server Locator Service failed to find active server for database ‘<DB GUID> Error: An Active Manager operation failed. Error: Invalid Active Manager configuration.	check DAG status and cluster service
4999	Error	MSExchange Common	Watson report about to be sent for process id: <PID>,<SERVICE>,<INFO>	Check if log is frequent
5004	Warning	MSExchange Mid-Tier Storage	User mailbox <USER> has exceeded the calendar logging quota. Calendar logging has been stopped for the mailbox until more space becomes available.	No action needed or increase log space for mailbox (Set-Mailbox)
6004	Error	MSExchange Common	ADDriverLogs: Failed to write logs because of the error: Access to the path ‘Microsoft.Exchange.Store.Worker.exe__<NO>.LOG’ is denied..	no direct action needes, check log path, disk space and file lock
7024	Error	Service Control Manager	The Cluster Service service terminated with the following service-specific error:	check health of DAG
7024	Error	Service Control Manager	The <SERVICE> service terminated with the following service-specific error: <ERROR>	Check mentioned service and affected servers
7031	Error	Service Control Manager	service named in event ID terminated unexpectedly	check service and repair according Technet articles of particular service
7031	Error	Service Control Manager	The Microsoft Exchange Diagnostics service terminated unexpectedly. It has done this <number> time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.	No action needed if service is running
7032	Error	Service Control Manager	The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the <Service Name> service, but this action failed with the following error:<type>	check service restart according Technet articles
8015	Warning	Microsoft-Windows-DNS-Client	The system failed to register host (A or AAAA) resource records (RRs) for network adapter–with settings:——           Adapter Name : <Description>	Check DNS server connection timeouts, manually register network adapter by using ipconfig /registerDNS
8020	Warning	Microsoft-Windows-DNS-Client	The system failed to register host (A or AAAA) resource records (RRs) for network adapter–with settings:——           Adapter Name : <Description>	Check DNS server connection timeouts, manually register network adapter by using ipconfig /registerDNS
8538	Warning	MSExchangeIS	The archive mailbox <MAILBOX GUID> on database <MDB GUID> has exceeded the maximum archive mailbox size. The user cannot copy or move items into the archive mailbox. All message retention actions that move items to the archive mailbox will fail, and the primary mailbox may contain items with expired retention tags until the archive mailbox is within the maximum size limit. The mailbox owner should be notified about the condition of the archive mailbox.	info only – increase quota
9037	Error	MSExchange Assistants	Service MSExchangeMailboxAssistants. An exception was encountered while processing a RPC. Method: Execute, Exception: <Exceprion>	check mailbox Assistants based on Exception type (usually unknown database which occurs while DB was removed and IS service not restarted yet)
9646	Error	MSExchangeIS	Mapi session <Recipient> with client type <client type> exceeded the maximum of 250 objects of type <Object type e.g. Message>.	check limits for each mailbox servers – must be several times more than users located on mailbox server, check limits for MAPI (messages opened per folder)
10006	Error	MSExchange Mid-Tier Storage	Active Manager Client experienced an AD timeout trying to lookup object <GUID>	check availability of domain controllers (patching ETC)
10015	Warning	MSExchange Mid-Tier Storage	Active Manager Client already doing query for object ‘<Objeckt GUID>’ on another thread, however this thread didn’t complete in 100 msec.	no direct action needed, check DAG status
10022	Warning	MSExchangeMailboxAssistants	The archive mailbox <Description> exceeded the archive warning quota <size>	info only – increase quota, let user delete some content
10025	Warning	MSExchangeMailboxAssistants	Processing of the current batch of items in mailbox <Description> failed. The expiration action is ‘MoveToArchive	Connected to Event ID 10022 – folders cannot be moved to archive while quota exceeded
10027	Error	MSExchangeIS	The archive mailbox <Description> exceeded   the Recoverable Items Warning Quota. Please remove items from Recoverable Items or increase the Recoverable Items Warning Quota and Recoverable Items Quota. If the Recoverable Items Quota is exceeded, the user will be unable to delete items from the mailbox.	info only – increase quota
10028	Error	DCOM	The description for <ID> in Source ‘DCOM’ cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the <description>	check correct registry entries for event log mentioned in the event log message https://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx
14021	Error	MSExchange MailTips	Group metrics generation was interrupted. <Description>	Check group if it has corrupted membership or delegate values, restart OAB generation server (Exchange 2010) or check if generation of group matric in arbitration mailbox is not skipped due to constantly high server workload https://technet.microsoft.com/en-us/library/jj674302(v=exchg.150).aspx
14035	Error	MSExchange MailTips	Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: MailTips query failed for mailbox <MAILBOX><DESCRIPTION>	No action if not frequent
22004	Warning	MSExchangeTransport	The periodic heartbeat to primary server <Transport service FQDN> failed.	check connectivity to servers and shadow redundancy (safety net) functionality
24001	Error	MSExchange CalendarRepairAssistant	Calendar repair assistant related description <SMTP>	check CRA logs for mentioned mailbox
36887	Error	SChannel	A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70.	no action needed http://ficility.net/2013/10/21/exchange-2013-exchange-2010-windows-server-2012-schannel-event-id36888-1203-tlsssl-error-the-root-cause/
36888	Error	SChannel	A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 1203.	no action needed http://ficility.net/2013/10/21/exchange-2013-exchange-2010-windows-server-2012-schannel-event-id36888-1203-tlsssl-error-the-root-cause/