Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 327 Source: MSExchangeTransport

Level
Description
The following call : EcCopyTo to the store failed. Error code : <error code>. MDB : <GUID>. FID : . MID : . File : <file>.
Comments
 
See ME893615 for a hotfix applicable to Microsoft Exchange Server 2003.

- Error code: -1040 - See ME924206.
- Error code: -2147417836 - See ME914196 and ME914916 for two hotfixes applicable to Microsoft Exchange 2000 and ME909068 for a hotfix applicable to Microsoft Exchange Server 2003.
- Error code: -2147467259 - See ME908062 and ME938650 for two hotfixes applicable to Microsoft Exchange Server 2003.
- Error code: -2147418113 - See ME914196 for a hotfix applicable to Microsoft Exchange 2000.
- Error code: -1601 - See ME909266.
- Error code: -2147221221 - See ME926347.
- Error code: -2147221233 - See ME920845 for a hotfix applicable to Microsoft Exchange Server 2003 and ME280489 for additional information about this event.
- Error code: -2147220731 - See ME317124.
- Error code: -2147024893 - See ME298415.
- Error code: -2147024809 - See ME823494, ME934450 and ME935728 for two hotfixes applicable to Microsoft Exchange Server 2003 and ME823505 for additional information about this event.
- Error code: -1026 - See ME896363 for a hotfix applicable to Microsoft Exchange Server 2003.
- Error code: 1238 - See ME873393 for a hotfix applicable to Microsoft Exchange Server 2003.
- Error code: -1605 - This issue can occur if a server-side rule on the user's Inbox that would apply to the undelivered message fails. Disable the rule(s), and see if the messages are then delivered to the Inbox. If so, the reason for the rule(s) failure needs to be diagnosed and remedied.
I received this event in conjunction with EventID 12002. When I attempted to restart the Information Store the Exchange Events process failed to stop, and I was forced to end the events process. I could then restart the Information Store and this fixed the problem. I suggest you set the ExchangeIS -> Content Engine logging to maximum in order to determine if you also get error 12002 occurring. If restarting the Information Store doesn't work then I suggest reapplying the latest service pack.
As per Microsoft: "This problem may occur if the message header is malformed. If the message header is malformed, the message stays in the Local Delivery queue, and an NDR is not sent". See ME813781, ME823491, ME826134, ME829968, ME328671, and MSEX2K3DB to fix this problem.
This is for E2K, ME319682 says to obtain the latest SP.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...