Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 10036 Source: MSExchangeISMailboxStore

Level
Description
Continuous replication block mode is unable to keep up with the data generation rate. Block mode has been suspended, and file mode has been resumed.
Database: 0ed75776-2b32-4f18-942c-85af47ef3e9a
IoDepth: 3145032
IoLatencyInMsec: 36
Comments
 
From a support forum: This may indicate that the Exchange server disabled block mode (a new feature in Exchange 2010 SP1) because it can't keep up for whatever reason. Exchange 2010 SP1 will attempt to use the block mode feature but it will revert back to file mode if the log generation is too fast. See TF625233 for details about this new feature. You should look for other error or warnings that may provide clues as to what is causing this.
From a support forum: "In my case, I got this error while the Exchange server was up at 100% CPU due to MSFTESQL.exe sitting at 53% or more usage. All my online Outlook clients were hanging since there was a massive CPU backlog. I stopped MS Exchange Indexing and MS Search services and restarted and has the CPU use turned to normal levels. After deleting and recreating the indexes, the problem was gone.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...