Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 11 Source: MSExchangeES

Source
Level
Description
A fatal error (<error code>) occurred in an IExchangeEventSink while processing message [Subject = "xxx"].
Comments
 
- Error code: 0x8000ffff (Error code 0x8000ffff) - See ME918279 for a hotfix applicable to Microsoft Exchange Server 2003, and ME295379 for additional information on this event.
- Error code: 0x80040111 (Error code 0x80040111) - The mailbox, which has been used to edit the Microsoft Exchange Server Scripting and Routing script, is not visible in the Global Address List. Do not hide this mailbox from the Global Address List, otherwise the Microsoft Exchange Server Scripting and Routing script will fail to run. See the link to "The Secrets of Exchange Server Scripting and Routing" for information on solving this problem.
As per Microsoft: "This issue may occur if you join an Exchange 2000 Server-based computer to the site, and then perform either of the following actions:
1. Move the mailbox that created the event scripts that are bound to a folder.
2. Move an existing Exchange Server 5.5 script to an Exchange 2000 Server-based computer". See ME326648 for more details.

This issue may also occur if the Exchange Event Service logs on as the local computer account instead of a service account. See ME288264 to fix this problem.
I had many of these events logged when I was trying to activate an auto reply script. I applied Microsoft patch referred to in ME289606, which fixed the problem.
0x80040111 - As per Microsoft: "Event ID 11 is logged in the application log of the Event Viewer when a client action spawns the activation of a script. Depending on the size of your environment, you may notice that some or all scripts are not running. In a large environment, it may appear that the scripts are running successfully because of the inability to pinpoint the failing script." For more details see ME222066.
0x8004011d - As per Microsoft: "Event ID 11 is logged in the application event log soon after you start the Microsoft Exchange Event Service. Event ID 1023 is logged immediately after the Event Service starts. It may take approximately one minute for the Event ID 11 to appear in the application event log. In some cases, the Event 1023 and (or) 11 does not appear at all." See ME259578 for more details.


For 0x8004011d see also ME281683.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...