Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12800 Source: MSExchangeIS

Source
Level
Description
Message processing failed because there is not enough available memory (8007000E-80000000).
Comments
 
This issue can occur if the attachment in the e-mail message is corrupted. See ME912068 for a hotfix applicable to Microsoft Exchange Server 2003.

This event is logged on public folder servers under a number of heavy stress conditions, including servers that receive NNTP newsfeeds and servers under heavy MAPI client stress. See ME309207 for more information about this event.

On a heavily loaded Exchange 2000 Server computer, the Store.exe process may spin in excess of 350 threads, perhaps as many as 800 to 900, and may use up the available virtual bytes. When this happens, event 12800 can occur. See ME267255 for details on solving this problem.
See ME320652 for a hotfix applicable to Microsoft Exchange 2000.
See ME812071 and ME837216 for two hotfixes applicable to Microsoft Exchange Server 5.5.

See ME325044 for information on hot to troubleshoot virtual memory fragmentation in Exchange 2003 and Exchange 2000.

See ME816753 and MSEX2K3DB for additional information on this event.
As per Microsoft: "This problem may occur because Exchange Server may be in a low-memory condition. This situation may be experienced when almost no virtual address space is available for virtual memory". See ME870935 to resolve this problem.
As per Microsoft: "This problem can occur if the message loops in the information store. Each time that the message loops, it is appended upon itself until the information store runs out of memory". See ME306937 for a hotfix.
This problem may occur if a message contains a large number of font entries. When the user opens this e-mail message in Microsoft Outlook 2000, conversion from Hypertext Markup Language (HTML) to Rich Text Format (RTF) occurs, which reaches the stack limitation of too many font/font entries. Therefore, the event ID 12800 error message is logged in the Application event log. See Microsoft article ME317005.


Exchange 2000: This is caused by a faulty Jet database memory allocation algorithm. See the link to ME302254. As per Microsoft was fixed with Exchange SP1.
Exchange 5.5: As per Microsoft, this error is inadvertently reported. The real cause of the problem is a corrupted address. See ME193782 below. Fixed with SP2.
This refers to Exchange 5.5 and Microsoft says that a patched version of store.exe is available. Please see the KB article 325939.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...