Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 201 Source: MSExchangeMTA

Source
Level
Description
A loop has been detected in the message being transferred in. A non-delivery report was generated with reason code unable-to-transfer and diagnostic code loop-detected. [MTA XFER-IN 17 104] (14)
Comments
 
As per Microsoft: "The problem may be the existance of a redundant route located in the Intermediary or Hub Site within the path to the destination site". See MSEX2KDB and ME176127 for additional information about this event.
See ME841834 for information on how to fix this problem.
If it's not a single server environment, try the following suggestions below:
1) Make sure that there are no connectivity issues between the Exchange 5.5 server. Check DNS, HOSTS and LMHOSTS entries on the server and verify that those files (HOSTS and LMHOSTS) has correct entries pointing to the correct servers.
2) Review the GWART0.DAT and GWART1.DAT files from the Exchange Server in the Sending Site. This should indicate the route(s) mail intended for Destination Site should take. Then you can further review the GWART files within the sites the mail passes through en route to the Destination Site.

For example, the following are routing entries from a GWART*.DAT file from a Sending Site. Specifically, the entry below shows the route mail should take to reach the intended Destination Site, where the Destination Site's Directory Name is BELLEVUE. In this example, the Intermediary or Hub Site is named BELLINGHAM:
x=</O=FWWB/OU=BELLEVUE>  
                 X400 TO BELLINGHAM, 0002
                    /O=FWWB/OU=BELLEVUE OFFICE/../CN=X400 TO BELLINGHAM
                    /O=FWWB/OU=BELLINGHAM/../CN=X400 TO BELLEVUE
If the information is wrong, try the following:
Run DS/IS consistency checker
Recalculate routing on the MTA
Recalculate routing on the site addressing
Turn logging on the MTA (Then look at the application log again)
Stop and start the services.
See ME160534 - "Size Limits May Cause Message Looping".
See ME278444 - "Messages may loop in a site when high-priority messages are sent. Message loops result in non-delivery reports (NDRs)."
To resolve this problem, obtain the latest service pack for Exchange Server version 5.5. See ME232586.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...