Alert and Event Collection Rules Disabled by Default
Applies To: Exchange Server, Operations Manager 2007 R2
The following table lists the alert and event collection rules that are disabled by default in this management pack. The rules are disabled by default because they are generally not actionable and, if enabled, may prove noisy in your environment.
Note
In some cases Alert Rules in previous versions of the Exchange 2007 Management Pack are replaced with disabled Event Collection rules
You can enable the rules according to the requirements of your computing environment.
| Rule Name | Target | Type | Event ID |
|---|---|---|---|
Microsoft Exchange Search service has temporarily disabled indexing of the specified mailbox database. Exchange Search will try to index the database when the store is back online or is mounted. |
Exchange 2007 Mailbox Role |
Event Alert |
MSExchange Search Indexer 107 |
A message was rejected by the remote server. This message will be deferred and retried because it was marked for retry if rejected. |
Exchange 2007 Transport Common Role |
Event Collection |
MSExchange Transport 8010 |
A user is consuming their maximum allowed share of server resources. For details check event logs with Event ID 9646. |
Exchange 2007 Mailbox Role |
Event Alert |
MSExchangeIS* 9646 |
Microsoft Exchange Search service has temporarily disabled indexing of the specified mailbox database. Exchange Search will try to index the database when the store is back online or is mounted. |
Exchange 2007 Mailbox Role |
Event Alert |
MSExchange Search Indexer 107 |
A Microsoft Exchange clustered resource failed to come online. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1003|1019|1026 |
Clustered Microsoft Exchange resource failed to go offline. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1004|1020 |
The IsAlive check failed for the clustered Microsoft Exchange resource. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1005 |
The RPC call to the Cluster service to bring the Microsoft Exchange clustered resource online failed. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1011 |
The RPC call to the Cluster service to take the Microsoft Exchange clustered resource offline failed. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1012 |
The Microsoft Exchange clustered resource failed to terminate because of a timeout. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1021 |
The Microsoft Exchange clustered resource failed to stop. |
Exchange 2007 CCR Node Role |
Event Alert |
MSExchange Cluster 1024 |
An exception occurred and was handled by Exchange ActiveSync. |
Exchange 2007 Client Access Role |
Event Alert |
MSExchange ActiveSync 1008 |
An asynchronous LDAP call has failed. In the absence of other events, you can ignore this event. Review the Application log for related events. Check connectivity to domain controllers. |
Exchange 2007 Common Components |
Event Collection |
MSExchange ADAccess 2049 |
A Lightweight Directory Access Protocol (LDAP) search call failed. In the absence of other events, you can ignore this event. Review the Application log for related events. Check network connectivity. |
Exchange 2007 Common Components |
Event Collection |
MSExchange ADAccess 2061 |
A Lightweight Directory Access Protocol (LDAP) notify call failed. In the absence of other events, this event should not impact mail flow. Review the Application log for related events. |
Exchange 2007 Common Components |
Event Collection |
MSExchange ADAccess 2066 |
Collect: Microsoft Exchange initial problem report event. |
Exchange 2007 Common Components |
Event Collection |
MSExchange Common 4999 |
Online information is available for problem detected by Watson. |
Exchange 2007 Common Components |
Event Collection |
MSExchange Monitoring Problem Analysis 1000 |
The database engine started. This event can generally be ignored. If you are experiencing problems keeping your databases mounted, review the event log for ESE 101 events. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 100 |
The database engine started a new instance. Event ID 102 can be safely ignored if it is not logged together with ESE event ID 103 and 104. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 102 |
The database engine stopped an instance. Use the error code listed in the associated event, ESE ID 104, to determine the cause and resolution to this event. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 103 |
The backup procedure was successfully completed. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 202 |
An Exchange store database is starting a full backup. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 210 |
An Exchange store database is starting an incremental backup. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 211 |
An Exchange store database is starting a snapshot backup. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 212 |
An Exchange store database has completed the backup procedure successfully. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 213 |
Beginning the backup of the database. Backup history can be viewed with the All Database Backup events view under Views\Microsoft Exchange Server\Exchange 2007\Common Components\Extensible Storage Engine\Backup. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 220 |
Ending backup of the database. Look for other ESE Application log events to determine backup completion status. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 221 |
The Exchange store database engine successfully completed recovery steps. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 302 |
A torn-write was detected during soft recovery. The log file damage will be repaired and recovery will continue. No user action is required. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 462 |
The shadow header page was damaged and primary header page was used instead. No user action is required. Check Event Viewer for more information. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 472 |
Online defragmentation has completed a full pass on the database. Review the Application log for events 701 and 1221 to make sure that online maintenance finished successfully. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 700 |
Online defragmentation has completed a full pass on the database. Review the Application log for event 1221 to make sure that online maintenance finished successfully. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE 701 |
Restore started. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE BACKUP 901 |
Restore ended successfully. |
Exchange 2007 Extensible Storage Engine |
Event Collection |
ESE BACKUP 902 |
The clustered mailbox server has been stopped. |
Exchange 2007 Log Shipping |
Event Alert |
MSExchangeRepl 105 |
The New-ClusteredMailboxServer operation failed. |
Exchange 2007 Log Shipping |
Event Alert |
MSExchangeRepl 107 |
The Remove-ClusteredMailboxServer operation failed. |
Exchange 2007 Log Shipping |
Event Alert |
MSExchangeRepl 109 |
The clustered mailbox server moved or failed over to the passive node. |
Exchange 2007 Log Shipping |
Event Alert |
MSExchangeRepl 2090 |
The Remove-ClusteredMailboxServer operation succeeded. |
Exchange 2007 Log Shipping |
Event Collection |
MSExchangeRepl 108 |
An error occurred starting Storage Group on Microsoft Exchange Information Store. Check for antivirus software scanning or improperly enabled disk level write caching. |
Exchange 2007 Mailbox Role |
Event Alert |
MSExchangeIS* 9518 |
Collect: The Microsoft Exchange Information Store service started. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1001 |
Collect: Unable to start the Microsoft Exchange Information Store service. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1005 |
Collect: The Microsoft Exchange Information Store service stopped. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1006 |
An error occurred on the database. Review MSExchangeIS event 1025. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1025 |
Collect: Free space available in databases after online defragmentation. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1221 |
Collect: A general error occurred on a database. Review the event description for the function name or description of the problem. No alert was sent. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1233 |
Collect: It took a long time to complete a folder-related action. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 1236|1237|1238|1239 |
Collect: The replication agent started on the public folder store. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 3000 |
Collect: Could not get the properties of a rule. If this failure occurs frequently, run Isinteg as indicated in the event log. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 8534 |
Collect: The Microsoft Exchange database has started. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9523 |
Collect: The Microsoft Exchange database stopped. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9539 |
Collect: The Exchange storage group specified is offline. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9541 |
Virus scanner detected one or more viruses while scanning a message—all viruses have been successfully cleaned. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9572 |
Virus scanner detected one or more viruses while scanning a message. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9573 |
Collect: Virus scanner has been started successfully. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9574 |
Collect: Virus scanner has been stopped. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9575 |
Collect: Virus scanner detected one or more viruses while scanning a message. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9628 |
Collect: Virus scanner message deletion is enabled. Messages can be deleted by request of the virus scanner. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9629 |
Collect: Virus scanner message deletion is disabled. Message deletion requests from a virus scanner will be ignored. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9630 |
Collect: A large percentage of resources of the database engine has been consumed. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeIS* 9786 |
Started to move mailbox. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 1006 |
Mailbox has been moved. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 1007 |
One of the System Attendant's tasks has recovered from a delay. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 1032 |
System Attendant is starting. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 9008 |
System Attendant is stopping. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 9009 |
Name Service Provider Interface (NSPI) Proxy can contact the global catalog, but it does not support the NSPI service. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchangeSA 9176 |
Microsoft Exchange Search service has enabled indexing of the specified mailbox database. No user action is required. |
Exchange 2007 Mailbox Role |
Event Collection |
MSExchange Search Indexer 108 |
Collect: Unified Messaging Worker Process starting and stopping Informational events. |
Exchange 2007 Unified Messaging Role |
Event Collection |
MSExchange Unified Messaging 1000|1002 |