Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
A fatal error (<error code>) occurred in an IExchangeEventSink while processing message [Subject = "xxx"].
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
Why are some errors fatal?
- Error code: 0x8000ffff (Error code 0x8000ffff) - See ME918279 for a hotfix applicable to Microsoft Exchange Server 2003, and ME295379 for additional information on this event.
- Error code: 0x80040111 (Error code 0x80040111) - The mailbox, which has been used to edit the Microsoft Exchange Server Scripting and Routing script, is not visible in the Global Address List. Do not hide this mailbox from the Global Address List, otherwise the Microsoft Exchange Server Scripting and Routing script will fail to run. See the link to "The Secrets of Exchange Server Scripting and Routing" for information on solving this problem.
As per Microsoft: "This issue may occur if you join an Exchange 2000 Server-based computer to the site, and then perform either of the following actions:
1. Move the mailbox that created the event scripts that are bound to a folder.
2. Move an existing Exchange Server 5.5 script to an Exchange 2000 Server-based computer". See ME326648 for more details.
This issue may also occur if the Exchange Event Service logs on as the local computer account instead of a service account. See ME288264 to fix this problem.
I had many of these events logged when I was trying to activate an auto reply script. I applied Microsoft patch referred to in ME289606, which fixed the problem.
Alasdair B. McNeill
0x8004011d - As per Microsoft: "Event ID 11 is logged in the application event log soon after you start the Microsoft Exchange Event Service. Event ID 1023 is logged immediately after the Event Service starts. It may take approximately one minute for the Event ID 11 to appear in the application event log. In some cases, the Event 1023 and (or) 11 does not appear at all." See ME259578 for more details.
0x80040111 - As per Microsoft: "Event ID 11 is logged in the application log of the Event Viewer when a client action spawns the activation of a script. Depending on the size of your environment, you may notice that some or all scripts are not running. In a large environment, it may appear that the scripts are running successfully because of the inability to pinpoint the failing script." For more details see ME222066.
For 0x8004011d see also ME281683.
|Private comment: Subscribers only. See example of private comment|
|Links: ME222066, ME259578, ME281683, ME288264, ME289606, ME295379, ME326648, ME918279, Error code 0x80040111, Error code 0x8000ffff, MAPI Errors, The Secrets of Exchange Server Scripting and Routing|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated