Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1031 Source: MSExchangeSA

One of the System Attendant's task is blocked.
Function: CMonitoringTask::Work
Function: CPollDomainExchangeServersGroup::Work - I have faced the issue in E2K7 for one of our customers. Whenever this problem occured the Exchange server went into hanged state and the mail flow would stop. To fix the problem we had to move all the resources manually to another server (cluster environment).
Function: COffLineABScanTask::Work - See EV100360 (he Exchange system attendant logs 1031 and 1032 after generating an Offline Address Book).
Microsoft Exchange Troubleshooting Assistant and Microsoft Exchange Best Practices Analyzer are useful in troubleshooting Exchange related problems. See the links in the Links section.
The Microsoft Exchange System Attendant service has many tasks to perform. If any of these tasks encounter a problem it may fail and the MSExchangeSA service is recording this event along with the name of the programming function that failed.

See the link to "Microsoft Certified Professional Magazine Online" for an article describing several problems in Exchange.

Function: SctartVM Required: ME928436
Function: COffLineABScanTask::Work: ME931904
Function: OfflineABScanTack Work: ME940725

Also, see MSEX2K3DB for additional information about this event.
The Microsoft Exchange System Attendant service may not come online on a server that is running Microsoft Exchange Server 2003 in a Microsoft Windows 2000 active/passive cluster. This problem occurs if the RootVer registry value is invalid. See ME906154 to correct this problem.

When you run Microsoft Exchange Server 2003 on a server that is running Windows 2000, Windows Management Instrumentation (WMI) may stop responding while the Microsoft Exchange System Attendant service (Mad.exe) is tracking messages. When this problem occurs, Exchange System Attendant queues up the message-tracking entries and may eventually stop delivering e-mail. See ME818204 for a hotfix applicable to Microsoft Windows 2000.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.