Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 10003 Source: MSExchangeTransport

Level
Description
The transport process failed during message processing with the following call stack: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
at
Microsoft.Exchange.Security.Cryptography.CapiNativeMethods.CertGetCertificateChain(S afeChainEngineHandle engine, IntPtr pCertContext, IntPtr time, SafeCertStoreHandle hAdditionalStore, CertChainParameter& parameters, ChainBuildOptions flags, IntPtr reserved, SafeChainContextHandle& chainContext)
at
Microsoft.Exchange.Security.Cryptography.X509Certificates.ChainEngine.BuildAsAnonymo us(X509Certificate2 certificate, ChainBuildOptions options, ChainBuildParameter parameter)
at
Microsoft.Exchange.Protocols.Smtp.CertificateValidator.ChainValidateInternal(String domain, X509Certificate2 cert, Boolean validateAsAnonymous)
at
Microsoft.Exchange.Protocols.Smtp.CertificateValidator.ChainValidateAsAnonymous(X509 Certificate2 cert)
at
Microsoft.Exchange.Protocols.Smtp.SmtpOutSession.TlsNegotiationComplete()
at
Microsoft.Exchange.Protocols.Smtp.SmtpOutSession.TlsNegotiationComplete(IAsyncResult asyncResult)
at
Microsoft.Exchange.Net.LazyAsyncResult.Complete(IntPtr userToken)
at
Microsoft.Exchange.Net.NetworkConnection.InvokeSendCallback(LazyAsyncResultWithTimeo ut asyncResult, Object result)
at
Microsoft.Exchange.Net.NetworkConnection.SendTlsNegotiationCompleted(IAsyncResult asyncResult)
at System.Net.LazyAsyncResult.Complete(IntPtr userToken)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Net.ContextAwareResult.Complete(IntPtr userToken)
at System.Net.LazyAsyncResult.ProtectedInvokeCallback(Object result, IntPtr userToken)
at System.Net.Sockets.BaseOverlappedAsyncResult.CompletionPortCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)
at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)
Comments
 
If you just installed Exchange 2010 SP3 Update Rollup 1 see the 'Known Issue' on ME2803727. Basically it tells you to disable any transport rule that adds a disclaimer to outgoing emails then you can resume emails that are in the Poison Message queues on your CAS servers. That's the workaround as MS doesn't have a solution yet.
Applies to Exchange 2008 - This error event indicates that the transport process failed during a message processing operation. To resolve this problem install Update Rollup 2 for Exchange Server 2007 Service Pack 1. See ME947551.
ME957002 indicates that this error may occur on a Microsoft Exchange Server 2007 Service Pack 1 (SP1) Edge server, when you use a Send connector that uses the BasicAuthRequireTLS value. To resolve this problem, install Update Rollup 2 for Exchange Server 2007 Service Pack 1.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...