Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4006 Source: MSExchangeTransport

Level
Description
Message delivery to the host "<IP address>" failed while delivering to the remote domain "<domain>" for the following reason: The remote server did not respond to a connection attempt.
Comments
 
This event can also occur if the SMTP service is not started on the front end of a FE/BE configuration as I found out after 10 minutes of trying to figure out what was wrong with my Exchange 2003 server. If you are installing service packs and other Microsoft updates, always double check your services after the install.
This event can have multiple causes, each of them being described in Microsoft article ME919091.

This issue may occur when Sybari Antigen Version 7.5.1138 is running on the Exchange Server 2003 server. See ME922256 for details.
This event can be generated when e-mails are being sent without linefeeds at the end of the message and the message is relayed through SMTP on IIS 6/Exchange 2003. Our internal software was creating messages that did not have <cr/lf> at the end of each message.
With full logging on SMTP, YAHOO was the only site that indicated what the problem was with this entry:
2005-07-21 05:00:05 67.28.113.13 OutboundConnectionResponse SMTPSVC1 SRV-EMAIL1 - 25 - - 451+Timeout+waiting+for+end+of+DATA.+Be+sure+your+client+is+not+sending+bare+linefeeds. 0 0 87 0 120313 SMTP - - - -.
My temporary solution was to create a batch file that appends a <cr/lf> to each message stuck in the queue on the Exchange server. An update to our software will be released shortly that fixes the problem.

See the links to “Bare Linefeeds in SMTP Messages” and “LFs in SMTP” for additional information on this issue.
As per Microsoft: "This Warning event is logged when Exchange cannot deliver a message to a remote host. The event description should specify the reason for the failure". See MSEX2K3DB for information on this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...