Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1014 Source: NTDSKCC

Source
Level
Description
The replication topology update task terminated abnormally with code <error code>.
Comments
 
See the link to "EventID 1014 from source Active Directory" for information about this event.
If these errors occur during a domain controller demotion, you can ignore them. Just like promoting a server to DC gives some errors, demoting one gives errors too.
Happened when I was demoting one of two DC. Event 1568 also shown in directory service log. Follow ME250874 and ME269417 to manually create a site connection between the two DC and add the Administrator group to the local security policy (Enable computer and users accounts to be trusted for delegation). Retry dcpromo - worked for me this time.
Look at time on you Domain Controllers. They must be with the same hour and minute.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...