Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1009 Source: MSExchangeFastSearch

Level
Description
The indexing of mailbox database DB6 encountered an unexpected exception. Error details: Microsoft.Exchange.Search.Core.Abstraction.OperationFailedException: The component operation has failed. ---> Microsoft.Exchange.Search.Fast.FastConnectionException: Connection to the Content Submission Service has failed. ---> Microsoft.Ceres.External.ContentApi.ConnectionException: Given CSS specification failed:
Could not connect to CSS node at net.tcp://localhost:17028/ContentSubmissionServices/content with flow: Microsoft.Exchange.Search.Writer.12.14. Error: Object reference not set to an instance of an object. Inner exception:---
at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder.SetCssNodes(IEnumerable`1 newCssNodes)
at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder..ctor(DocumentFeederOptions options)
at Microsoft.Exchange.Search.Fast.FastFeeder.Initialize()
--- End of inner exception stack trace ---
at Microsoft.Exchange.Search.Fast.FastFeeder.Initialize()
at Microsoft.Exchange.Search.Fast.Factory.InternalCreateFastFeeder(ISearchServiceConfig config, String indexSystemFlow, String indexSystemName, String instanceName, Int32 numberOfSessions)
at Microsoft.Exchange.Search.Engine.SearchFeedingController.InternalExecutionStart()
at Microsoft.Exchange.Search.Core.Common.Executable.InternalExecutionStart(Object state)
--- End of inner exception stack trace ---
at Microsoft.Exchange.Search.Core.Common.Executable.EndExecute(IAsyncResult asyncResult)
at Microsoft.Exchange.Search.Engine.SearchRootController.ExecuteComplete(IAsyncResult asyncResult)
Comments
 
According to ME2807668, this issue may occur if the search platform tries to check its membership in a security group that is named "ContentSubmitters." This group is not created by the search platform or by Exchange Server 2013 and is therefore not usually present. The article provides details on how to create this group.
EV100572 (How to Fix a Failed Database Content Index for Exchange Server 2013) suggests that this event may be caused by a failed content index and provides information on how to rebuild it.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...