Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1349 Source: MSExchangeDS

Source
Level
Description
The GUID on server <Server Name> has changed from <GUID> <Server Name> to <GUID> <Server Name>. This causes all replicas to be resynced from scratch.
Comments
 
Servers may incorrectly log this event in the event log. According to Microsoft "when there are a lot of changes to be replicated, it may take multiple calls to transfer the data between the servers. If during the multiple calls there is a remote procedure call (RPC) error, the global universal identification (GUID) on the REPS-FROM for the calling server is reset to the invocation ID of the local server. The next replication cycle detects the GUID change and logs the 1349 error. This logic error causes unnecessary naming context resynchronizations". This is a bug fixed in the latest service pack for Exchange Server 5.5. See ME246214 link below.

"When you have two multi-server sites with the same organization and site name and same service account, and you remove a server from one site and install it in the other site without deleting the server from the original site, the two sites will join together". In this case see ME243398 for more information.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...