Critical event Ids for exchange 2010

I need a list if critical event ids for exchange 2010 which should be monitored regularly. So that a script can be scheduled to report if in case any of these event ids are encountered. I have complied a list below and request you guys to add on this list.
Event ID Message
1004 Unable to start the Microsoft Exchange Information Store. Disk is full.
1022 Database is damaged. This means that online backup cannot complete because the database is damaged.
1034 The disk associated with cluster disk resource driveLetter could not be found. The expected signature of the disk was diskSignature.
5001 Unable to initialize the Microsoft Exchange Information Store service. Disk is full.
9518 Error 0xfffffb40 starting Storage Group /DC=COM/DC=TEST/CN=CONFIGURATION/CN=SERVICES/CN=MICROSOFT EXCHANGE/CN=MICROSOFT/CN=ADMINISTRATIVE GROUPS/CN=AG1/CN=SERVERS/CN=SERVER1/CN=INFORMATIONSTORE/CN= FIRST STORAGE GROUP on the Microsoft Exchange Information
Store.
9555 Corrupt Message detected during MoveMailbox. Fid = folder id; Mid = message id; Some or all properties of this message will not be moved correctly.
9559 The log disk is full for storage group "name". Attempting to unmount all databases in this storage group.

Hi Striker11,
Thank you for your question.
I agree with Martin. We should find a tool to monitor those errors or warning. Because there are many Event IDs in Exchange 2010. If those errors or warnings are both important for Exchange maintenance. If Exchange 2010 update to Exchange 2013, we will still
use tool to monitor it and not modify the script.
We could download SCOM by the following link:
http://www.microsoft.com/en-us/download/details.aspx?id=2268
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Jim Xu
TechNet Community Support

Similar Messages

Mapi Session limit (EVENT ID 9646), Exchange 2010 fix still valid for exchange 2013?

Hi Guy's,
we run Exchange 2013 + Outlook 2010
as i was investigating an Outlook Sync Error, for a secondary mailbox, i figured out that the Mailbox has more than 500 Folders and that i can see the Evnet ID 9646 (Mapi session exceeded the maximum of 500 objects) on the Exchange Server.
Now i found a fix for Exchange 2010 but not for Ex2013, is the old fix for EX2010 still valid?:
Navigate to HKLM > System > CurrentControlSet > Services > MSExchangeIS > ParametersSystem. Create a new key in ParametersSystem named
MaxObjsPerMapiSession. In MaxObjsPerMapiSession, create a DWORD named
objtFolder with a decimal value of 600. Create a second DWORD named
objtFolderView
anyone an idea on this?
regards
Stefan

OK
i seems that fix is still working and you don't even need to reboot.
Also solved the sync Problems of secondary Mailbox.
regards
Stefan

Critical Event ids

Hi
Are there any list of critical event ids which needs to be monitored in Exchange 2013?
We wanted to list all critical event ids and its solution.
pls help
Regards:Mahesh

I wouldn't collect all of those IDs as there could be plenty of them. I would look at the system health and perform certain daily, weekly or monthly checkouts based on the functionality that is enabled in your environment to ensure environment is healthy.
Also suggest you to implement a monitoring product like SCOM with Exchange management pack. That will cover all the critical alerts and alert you with the recommended action whenever any error is logged.
Besides Exchange 2013 has some of the new inbuilt features like Managed Availability that will perform self-healing up to certain level. Check here for more details
Server Health and Performance
Blog:
http://exchangeshare.wordpress.com/

Event ID 9877, Exchange 2010 SP3 RU4

On 2/19 I installed RU4 for Exchange 2010 SP3 on a server at a client's site. This is a single server with all the roles on it, with about 40-45 mailboxes. Ever since then, during the busiest hours of the day (around 7AM to 5:30PM or so), I get the
following event log error on this server:
Log Name:      Application
Source:        MSExchangeIS Mailbox Store
Date:          2/20/2014 6:58:49 AM
Event ID:      9877
Task Category: Content Indexing
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
Content Indexing function 'CISearch::EcGetRowsetAndAccessor' received an unusual and unexpected error code from MSSearch.
Mailbox Database: Mailbox Database 0784353824
Error Code: 0x80043629
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MSExchangeIS Mailbox Store" />
    <EventID Qualifiers="49198">9877</EventID>
    <Level>2</Level>
    <Task>46</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-02-20T11:58:49.000000000Z" />
    <EventRecordID>423922</EventRecordID>
    <Channel>Application</Channel>
    <Computer>server.domain.com</Computer>
    <Security />
</System>
<EventData>
    <Data>CISearch::EcGetRowsetAndAccessor</Data>
    <Data>Mailbox Database 0784353824</Data>
    <Data>0x80043629</Data>
    <Binary>5B444941475F4354585D00000E020000FFC8070000000000000300020000EBF410101B000000F7991010000000008B304010E7FAFFFFEBB410101B0000006DA74010E7FAFFFF6DE74010E7FAFFFF85C710100000008085C710100000008085C7101000000080BDCC101000000C00D4224010E7FAFFFFEBD410101B0000008B3B4010E7FAFFFFEBF410101B000000F7991010000000008B304010E7FAFFFFEBB410101B0000006DA74010E7FAFFFF6DE74010E7FAFFFF85C710100000008085C710100000008085C7101000000080BDCC101000000C00D4224010E7FAFFFFEBD410101B0000008B3B4010E7FAFFFFEBF410101B000000F7991010000000008B304010E7FAFFFFEBB410101B0000006DA74010E7FAFFFF6DE74010E7FAFFFF85C7101000000080D25560200F01048040008F6600000C00D25560200F01048040008F661B000000AD0C4010BFF9FFFFE3D400101B00000029D14010E7FAFFFFADC34010E7FAFFFF53BD00101B000000D25560200F01048040008F66E7FAFFFFD25560200F01048040008F6600000080D25560200F01048040008F6600000C00C5C14010EE030000715D4010EC030000D25560200F0104800B00AA671B000000543760201DFAFFFF0B005C0EE7FAFFFFD42160200F0104800B005C0EE7FAFFFFD25560200F0104800B005C0E00000080D25560200F01048040008F660000008023C3001000000C0023FC4010370A0000D25560200F01048040008F66E7FAFFFF</Binary>
</EventData>
</Event>
The frequency of these errors varies and it definitely seems to be related to the amount of traffic. Over the weekend it only occured about 5-10 times a day. For the past couple of days, it's been pretty constant about every 15 minutes or
so all day.
I've looked this up, but I've only found a few posts mentioning similar errors, all relating to earlier versions of Exchange 2010. Supposedly this problem was fixed in one of the rollups to SP1 or SP2, I think. I never saw these errors, though,
until the SP3 RU4 rollup. I haven't heard any complaints from users, but I'm concerned that this might escalate and start causing noticeable searching issues.
Any ideas would be appreciated.
Deb

Hi Deb,
We're getting the same error as you on Exchange 2010. We have exchange 2010 and exchange 2013 running in a coexisting environment. Since we applied Service Pack 1 for Exchange 2013, we've had nothing but issues!
I've tried the rebuild of the index catalogues by following these instructions:
http://ghousewin.blogspot.in/2012/08/not-able-to-search-in-owa-event-id-9877.html
This failed to resolve the issues too. We've rebooted the server, restarted all the search services and still nothing! We're pulling our hair out here!
The only thing I haven't tried is the prepareAD commands in this post:
http://social.technet.microsoft.com/Forums/exchange/en-US/7a4a7400-a582-4f95-9360-6d84e66e87ad/ex2010-2node-dag-search-in-owa-not-working-caused-by-eventid-9877-content-indexing-function
I'm unable to try this during the day as we have no testing
environment and would hate to mess the production environment up if this went wrong.
If you're able to try this during the day, would you let us know how it goes?
Many thanks,
Stephen

Rollup 8 for Exchange 2010 SP2 causes EWS error with bad parameter for Exchange.MailboxReplicationService.ProxyService

When I installed Rollup 8 for Exchange 2010 SP2 it caused an error in EWS
EWS failed with the error:
exchange web service could not load file or assembly Exchange.MailboxReplicationService.ProxyService bad parameter
When I uninstalled the rollup all worked fine again.
Any ideas, Thanks in advance?

Hi,
To apply this update rollup, you must have Exchange Server 2010 SP2 installed. And remove all interim updates for Exchange Server 2010 SP2 before you apply this update rollup. Please check your installation deployment by the following article:
Install the Latest Update Rollup for Exchange 2010
http://technet.microsoft.com/en-us/library/ff637981.aspx
Description of Update Rollup 8 for Exchange Server 2010 Service Pack 2
http://support.microsoft.com/kb/2903903/en-us
If all requirements and preparations are configured properly, please collect your error logs to check your installation. It would be helpful to post some event logs here for further analysis.
Thanks,
Winnie Liang
TechNet Community Support

How to set default website for exchange 2010

I'm unable to launch the Exchange Management Console, and then I read that it's necessary to set the default web site in a particular way, in order for Exchange 2010 Management Console to work:
http://social.technet.microsoft.com/Forums/en/exchange2010/thread/4d396628-3867-4c95-9541-e0eb021e0135
However, after setting up Sharepoint, I see that it has modified the default website, and I'd like to ask for specific settings on how the default web site bindings should look (for exchange). Could someone please advise what I need to do to correct it?
I'm having trouble interpreting what Mike Crowley recommends in the linked post above, in terms of actual steps to the site binding information (which won't mess up what exists).
Currently it says:
Type           port         ip address        binding information
net.tcp
808:*
net.pipe
net.msmq                                         localhost
msmq.formatname                            localhost
http            80             127.0.0.1
https          443            *
http           80              *
https          443            127.0.0.1
It seems the line for http on port 80 is *, which I guess is equivalent to 'all unassigned'. Is the previous http port 80 binding to 127.0.0.1 causing the problem?
But I'm also supposed to set a Powershell VDir in IIS. Can someone provide steps for that?

Regarding SharePoint on Exchange:
It was not allowed earlier, as documented here:
http://office.microsoft.com/en-us/sharepoint-portal-server-it/coexistence-and-interoperability-guide-for-sharepoint-products-and-technologies-HA001160777.aspx & here:
http://support.microsoft.com/kb/825505 but there doesn't seem to be anything more recent than this. I would work under the assumption it is not supported outside of
SBS 2011 (which I am not very familiar
with).
Mike Crowley
Check out My Blog!

How to do the hard recovery for exchange 2010 (No Restore.env generated)

enrollment:Windows server 2008 R2, exchange 2010.
I want to test the fundamentally of eseutil /cc
so I backup the exchange database by Using the Windows backup, then I restore the database, and no Restore.env be found.But I found I can run the
eseutil /r.
what's happened?
1,why No Restore.env generated for exchange 2010 in Windows server 2008 r2?
2,why I can do the soft recovery after the restoring the database?
3, how to do the hard recovery for this situation(No Restore.env )?
Please click the Mark as Answer button if a post solves your problem!

Hi Eric,
From your description, I would like to clarify the following things:
1. Before performing the restore process, we need to dismount the Exchange databases that we want to restore. If the database is still mounted, the restore process will fail. If the restore process doesn't succeed, Restore.env won't be generated.
2. It is because the log files are healthy, you can run Eseutil/r and perform soft recovery.
3. In your case, you can continue to perform the soft recovery.
For more information about hard recovery and soft recovery, here are some helpful threads for your reference.
Exchange Server Soft and Hard Recovery
http://technet.microsoft.com/en-us/library/aa996168(v=exchg.65).aspx
Exchange Database Recovery – Using eseutil commands (Note: It isn't from Microsoft, please pay attention to refer to it.)
http://msexchangeguru.com/2009/07/12/exchange-database-recovery-using-eseutil-commands/
Hope it helps.
If there any problems, please feel free to let me know.
Best regards,
Amy
Amy Wang
TechNet Community Support
" If the restore process doesn't succeed, Restore.env won't be generated. "
thank you for you reply.The restore process succeed,otherwise I can't do the soft recovery after the restoring the database,but can't see the restore.env
Please click the Mark as Answer button if a post solves your problem!

Outlook 2007 Clients Cannot Access Free/Busy Calendar info. for Exchange 2010 Mailbox

Hi:
I have Outlook 2007 clients that cannot access Free/Busy Calendar info. for Exchange 2010 mailboxes. They receive error like "...you do not have appropriate permissions..."
If those same users logon to a machine running Outlook 2010 then they can view the free/busy info. of the other user's mailbox, so I believe the permissions are set correctly on the mailbox to allow the viewing.
Any insights are greatly appreciated!
Thank you!
Bob Herman IT Tropolis

Hi Herman,
As you said, it seems users have proper permissions on mailbox.
Please make sure users has Reviewer permission on Outlook 2007.
Please try to run Outlook 2007 under safe mode or re-create profile.
Also try to turn Outlook 2007 to Exchange Online mode from Cached mode.
Thanks
Mavis Huang
TechNet Community Support

Configuration for LDAP IP Address and Port for Exchange 2010

Let's say Exchange 2010 is installed on a computer that is joined to a domain. However, I would like to redirect LDAP authentication to another IP address and another port like how sharepoint implement it below
http://sharepoint.stackexchange.com/questions/33540/ldap-authentication-connection-string
Is it possible to do the equivalent for Exchange 2010?
Note: I would like to do this without installing any Edge Transport server or Microsoft Forefront TMG

The question I would need to ask is "Why would you need to do this?" I ask because Exchange requires an Active Directory account for authentication. That account may have permissions from some other directory (as in a linked mailbox),
but the account is used to find it. For SharePoint, you can authenticate to other directories directly.

Mails blocked in queue the moment forefront for exchange 2010 started

Hi,
We have newly installed Forfront protection 2010 for Exchange 2010 installed in our exchange 2010 Edge Server.
Mails got struck in the Queue immediatly after the forefront installations.
Mailflow works properly one we unhook the forefront from Exchange.
need to enable the forefront. Got struck in these. How to proceed up further.
Thanks,
Pradeep

Hi,
Please compare your configuration with the following blog or video. These might help.
http://araihan.wordpress.com/2010/03/15/forefront-protection-2010-how-to-install-and-configure-forefront-protection-2010-for-exchange-server-2010step-by-step/
http://www.youtube.com/watch?v=b2BgTmeXwUs
(Note: Microsoft provides third-party contact information to help you find technical support. This contact
information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.)
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Forefront for exchange 2010 - how long?

Hi there.
Read this article: http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx
I would have additional question.
Our company is MS Gold Partner and we need to renew our yearly license every year around AUGUST.
We are thinking about changing our SPAM filter external gateway with exchange edge, but as we can see from that article, you Will be unable to renew it license after December 2015.
I know that Microsoft offers online Forefront protection but that is not option in our case because of data sensitivity.We need an answer how long we Will be able to get updates regarding forefront for exchange 2010 and be licensed ok?
I guess after 2015 december Forefront Exchange 2010 Will no longer recieve spam updates thru Windows update, right?
And also engines Will not be updated after that date?
Is this the correct view and understanding?
with best regards
bostjanc

Hi Bostjanc,
>>how long we Will be able to get updates regarding forefront for exchange 2010 and be licensed ok?
I think you must have seen the information below in that blog.
For current customers, Microsoft will continue to support the subscription through Dec.31, 2015. If customer subcriptions expire before Dec.31, 2015, and annot be renewed because the product is no longer offered, these products will continue to be supported
through that date in order to provided with customers sufficient time to move to alternative solutions.
You could also check the following blog.
License extension for End-of-Life Antigen/Forefront products
Note: Microsoft provides third-party contact information
to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
If the information above still cannot resolve your questions, please contact Microsoft to get definitive answers.
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Forefront protection for exchange 2010 - updates?

Installed Exchange EDGE server with Forefront Protection for Exchange 2010.
Installed hotfix update rollup 4 for forefront (I think it's the latest because I haven't found any newer).
We have basically left everything on default in forefront, and if we take a look on dashboard in gui we see this error message:
not all the antimalware engines selected in the forefront adminstration console for scanning have been enabled for updates.
where should we take a look whats not being updated. Please a little help.
with best regards,
bostjanc

Hi.
Meanwhile I have also found information that it has been retired
https://social.technet.microsoft.com/Forums/forefront/en-US/400fa485-edc9-499f-8294-c196496437d8/not-all-of-the-antimalware-engines-enabled-for-updates-successfully-updated-at-the-last-attempt?forum=FSENext
bostjanc

Disater Recovery for exchange 2010 plan in Cloud computing

Hi
We are using exchange 2010 for our messaging solutions. Please find below our current setup.
mainsite: MBX Server --- 1no --> Hyper V host
                Hub&Cas ----- 1No --> Hyper V Host
                Edge ---- 1NO --> Physical
DR site : MBX,Hub&CAS -- 1No --> Physical
               Edge   --- 1no --> physical
we enabled the DAG for our Mail box server and its replicating through a point to point link between our main site with DR site.
Now we are interested to enable   our DR (disaster recovery) in MS cloud. Please let me know the process to go further .
how will the DAG or DB replicate to DR Site in cloud?. how its works?
much appreciated if any body have this setup .
Best Regards
Jagadeesan.S
O
Jags

Hello,
Kindly find the 3 types of plan for Exchange 2010 DR site. You can check all 3 plans and select as per your requirement.
1. Rebuild an Entire Database Availability Group plan
http://technet.microsoft.com/en-us/library/gg513521.aspx
2. Site Resiliency in Exchange 2010
http://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/planning-deploying-testing-exchange-2010-site-resilient-solution-sized-medium-organization-part1.html
3. Exchange 2010 Cross Site DAG Disaster Recovery: Data Center/AD Site failure Part 1
http://msexchangeguru.com/2012/10/25/exchange-2010-dag-dr/
Deepak Kotian. MCP, MCTS, MCITP Exchange 2010 Ent. Administrator

Transport Rule MessageSizeOver for exchange 2010

Hi
I have an exchange 2010 SP3 RU 3 environment with edge transport server implemented. I want to Have Transport rules to limit message size going outside/coming inside on edge transport.
I recently found a solution with -messagesizeover switch for new-trasportrule command in exchange 2013. Unfortunately its unavailable in exchange 2010.
I am wondering if there is a workaround or update for exchange 2010 to add this functionality.
Thanks in advance
Farhad

Hi,
On Exchange 2010, there is no MessageSizeOver parameter when you create a transport rule. But you can limit the sending and receiving message size of the whole Exchange organization using the following cmdlet.
Set-TransportConfig -MaxReceiveSize xxx -MaxSendSize xxx
If you want to limit the sending and receiving messages size for a specific mailbox, you can use the cmdlet below.
Set-Mailbox xxx –MaxSendSize xxx –MaxReceiveSize xxx
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

Uninstall Forefront for Exchange 2010

I have acquired another spam filter appliance that will used instead of Forefront for Exchange 2010.
How do I uninstall Forefront for Exchange 2010 without any issues while still using Exchange 2010.
Basically the email will go through the email appliance filter then to Exchange. I want to deactivate or uninstall Forefront for Exchange with impacting my email services. Is it as simple as just uninstalling it?

Hi,
About uninstalling Forefront for Exchange 2010, you could check the following article.
If spam filtering was enabled, the configurations in the corresponding antispam settings in Microsoft Exchange that were leveraged by FPE will be retained by their Exchange antispam counterparts after FPE is uninstalled. These settings include: Connection
Filtering, Sender ID Filtering, Sender Filtering, and Reciepient Filtering. To change these configuration settings you will need to modify them through the Exchange management console.
Uninstalling Forefront Protection 2010 for Exchange Server
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Critical event Ids for exchange 2010

Similar Messages

Maybe you are looking for