Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: Microsoft ISA report generator|
The action to create the scheduled report, "<report job>", with the specified credentials, failed. The error code in the Data area of the event properties indicates the cause.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
Whare are the credentials?
As per Veritas: "This problem occurs because the message screener is running in the Inetinfo process and is causing a handle leak in the LSAOpenPolicy handle table. The LSAOpenPolicy handle table is hosted by the Lsass.exe process". See the link to "Veritas Support Document ID: 279679" for details on solving this problem.
From Microsoft: "This problem occurs only if ISA Server and the ISA Server SMTP Message Screener (Fltrsnk1.dll) are installed and running on the same computer." For more information see ME816621.
I have had the ISA server running without a problem for several months when suddenly the weekly report started to fail. Daily and Monthly reports are still fine. Only change to system was the installation of GFI Mail Essentials. I removed this and the weekly report is working fine again.
The user id used in the "Credentials" tab of the Report Job Properties must have proper rights.
There have been reports that even when the proper user id and password are used, the reports still fail or the they started to fail after working for a period of time, without changes. From a newsgroup post: "The solution to this is creating the report without entering credentials, just create the report or clean the information about credentials. I do not know why, but it is a solution."
Another post suggested that in some ocasions, the password for the account used in the reporting was changed so the credential information was no longer accurate.
|Private comment: Subscribers only. See example of private comment|
|Links: ME816621, Veritas Support Document ID: 279679|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated