Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 215 Source: ESE

<Process name> (<process id>) The backup has been stopped because it was halted by the client or the connection with the client failed.
This problem can occur because the NTBackup utility refers to the backup information to obtain the file list. You expect the NTBackup utility to refer to the restore information to obtain the file list. See ME927654 for more information on this issue.
This error can also occur if the DHCP Server does not have full permission under %systemroot%\windows\system32\dhcp\backup. Verify if the SYSTEM account has full access to this folder and the subfolders as well.
I had this error and was resolved by re-registering SQLVDI.dll. Take a look at ME830575 for more information. They say the default location is C:\Program Files\Microsoft SQL Server\80\COM. I found mine under C:\Program Files\Microsoft SQL Server\80\Tools\Binn\.
This error occurs during a System State backup on any machine with a Certification Authority installed. If there are no problems reported in the backup log it can be safely ignored. See the link to "Bulletin Board Post" for additional information.
- Process name: certsrv.exe - From a newsgroup post: "Has MSDE or SQL been installed and then uninstalled on this server? If so, you may need to re-register the SQLVDI.dll file. To do so, follow these steps:
1. Stop SQL Server.
2. Click "Start", click "Run", type "Regsvr32 <Path>\SQLVDI.dll" (without the quotation marks) in the "Open" box, and then press ENTER. Note that by default the path to SQLVDI.dll is C:\Program Files\Microsoft SQL Server\80\COM.
3. Re-start SQL Server".
- Process: Information Store - See the links to "Veritas Support Document ID: 246973" and "Veritas Support Document ID: 250370" for information on this issue.

See ME810333, ME828535 and the link to "EventID 215 from source ESE98" for additional information on this event.

In our case, we had this problem when backing up the Information Store with Arcserve Brighstore 9.01. A hard repair of the IS (eseutil /p) followed by a check with isinteg corrected the problem.
See ME830575 for details from Microsoft for this event.
In our case, this error is logged when scheduled Exchange 2000 backup (using Windows 2000 Backup utility) fails.
As per Microsoft: "No user action is required unless you have lost network connectivity or Backup crashed. Then, restart database backup." See the link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.