Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1006 Source: MSExchangeMailboxReplication

Level
Description
The Mailbox Replication service was unable to process mailbox move requests in a mailbox database.
Database: [<mailbox database name>]
Error: MapiExceptionUnknownUser: Unable to open message store. (hr=0x80004005 ec=1003)
Diagnostic context:
    Lid: 18969   EcDoRpcExt2 called [length=214]
    Lid: 27161   EcDoRpcExt2 returned [ec=0x0][length=116][latency=15]
    Lid: 23226   --- ROP Parse Start ---
    Lid: 27962   ROP: ropLogon [254]
    Lid: 17082   ROP Error: 0x3EB    
    Lid: 26937  
    Lid: 21921   StoreEc: 0x3EB    
    Lid: 27962   ROP: ropExtendedError [250]
    Lid: 1494    ---- Remote Context Beg ----
    Lid: 26426   ROP: ropLogon [254]
    Lid: 22086  
    Lid: 27206  
    Lid: 17990  
    Lid: 16966   StoreEc: 0x8004010F
    Lid: 31433   StoreEc: 0x8004010F
    Lid: 8620    StoreEc: 0x3EB    
    Lid: 1750    ---- Remote Context End ----
    Lid: 26849  
    Lid: 21817   ROP Failure: 0x3EB    
    Lid: 26297  
    Lid: 16585   StoreEc: 0x3EB    
    Lid: 32441  
    Lid: 1706    StoreEc: 0x3EB    
    Lid: 24761  
    Lid: 20665   StoreEc: 0x3EB    
    Lid: 25785  
    Lid: 29881   StoreEc: 0x3EB
Comments
 
Description: The Microsoft Exchange Mailbox Replication service was unable to process jobs in a mailbox database.
Database: Missing database ()
Error: Database ' doesn't exist.

Resolution:
These errors were occurring every minute after the removal of an Exchange mailbox database. Restarted the Microsoft Exchange Information Store service to stop errors.

However, Event ID 1121 also occurs and this is not resolved by restarting the Information Store service. I rebooted the server to stop these events.
According to ME979848, this problem occurs because the Microsoft Exchange Mailbox Replication service cannot log on to the Exchange Server 2010 system mailbox. This is because the LegacyExchangeDN property of the system mailbox has "/o= as a part of the Hebrew Organization name. The article provides information about an update that fixes this issue.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...