Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3216 Source: REPLICATOR

System error <error code> occurred.
- Error code: 2 - The password for the replication account has changed. See "JSI Tip 5153" to solve this problem.
See ME1599426, ME163814, ME164596, ME168464, ME245084, and the link to "EventID 3216 from source System" for information on this event.
Error code: 5 = "Access is denied." - For Windows NT 4.0 a Microsoft article (ME155237 which is no longer available) describes the cause and the resolution:

This problem can occur when the replication service on the import server has been set to use an account that does not have read permission in the registry of the export server.

Make certain the HKEY_LOCAL_MACHINE key on the export server gives the replication account on the import server at least read permission. By default, everyone has read permission. Alternately, set the replication service to use the system account on all replicating machines.

To verify permissions on the export server, follow these steps:
1. In Registry Editor (REGEDT32.EXE), select HKEY_LOCAL_MACHINE on the export server.
2. On the Security menu, click Permissions.
3. Verify that the user account that starts the Replicator service on the import server has at least read permission for the key.

To check which account is being used to start the replication service on the import server, follow these steps:
1. Log on to the server and open Control Panel.
2. Double-click the Services icon, then click Directory Replicator.
3. Click Startup to view information about which account the service is using when it starts.
Error code: 13 = "The data is invalid." - The replication account and its password have not been set up in the Directory Replicator Service configuration under Control Panel/Services. or The password for the replication account has changed and this has not been reflected in the Directory Replicator Service configuration.
Error code: 32 = "The process cannot access the file because it is being used by another process.". As per Microsoft: "The replicator service requires exclusive use of resources, such as directories and all of their subdirectories being imported or exported, and files on the REPL$ and NETLOGON shares. Any violation of this exclusive use, such as File Manager having one of these directories open, or users connected to the NETLOGON share, causes this problem. See ME132950.
Error code: 59 = "An unexpected network error occurred." - Indicates conenctivity problems.
Error code: 2116 = "You specified an unknown device or directory.". Microsoft's suggestion: "Check the spelling of the device or directory name."
Error code: 2146 = "The specified component could not be found in the configuration information."
Error code: 53 = "The network path was not found. - The WINS database has an incorrect or missing entry for the import or export server. Ensure that WINS and/or LMHOSTS file contains proper entries for both the import and export servers.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.