Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 119 Source: RemovableStorageService

Level
Description
RSM could not Verify the media in drive Drive 5 of library <library name> because the on-media-identifier did not match what was expected.
Comments
 
This problem occurs because Removable Storage is looking for a file that has been removed. When Removable Storage tries to load a media label library file, Removable Storage cannot recognize the on-media identifier (OMID) on the tape device. Removable Storage does not recognize the OMID because the media label library file has been removed from the registry.
When you install ARCserve software, the software installation process registers a media label library file with Removable Storage. A media label library file is a .dll file that uses a specific tape format to identify the data that is written on a tape device. When you use a tape device that is formatted by using ARCserve software, Removable Storage uses the media label library file to recognize the OMID on the tape device. If you try to use the tape device after the ARCserve software has been removed, Removable Storage still refers to the media label library registry entry. Removable Storage still tries to use the .dll file that has been removed to recognize the OMID on the tape device.
To resolve this problem:
1. Click Start, click Run, type regedit in the Open box, and then click OK.  
2. In Registry Editor, locate and click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\NTMS\OMID\Tape\ARC.
3. Right-click ARC, and then click Delete.
4. In the Confirm Key Delete dialog box, click Yes.
5. Quit Registry Editor.
6. Click Start, click Run, type cmd in the Open box, and then click OK.
7. Type the following command at a command prompt, and then press Enter:
net stop “removable storage”.
8. Type the following command at a command prompt, and then press Enter:
net start “removable storage”.
As per Microsoft: "This problem occurs because Removable Storage is looking for a file that has been removed". See ME867702 to fix this problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...