Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4131 Source: MSExchangeIMC

Source
Level
Description
An unexpected error occurred in the Internet Mail Service. Information about this error is stored in the data portion of this event.
Comments
 
Unknown failure - restart of service did not help. Restart of server cured.
This problem can occur if the message has more than 32, 766 (0x7FFE in hexadecimal numbers) recipients defined. The Internet Mail Service uses Messaging Application Programming Interface (MAPI) to create non-delivery report (NDR) messages, and attempts to add the recipients to an NDR message that MAPI is creating. MAPI uses the Emsmdb32.dll file to communicate with the information store, and the Emsmdb32.dll file has a limit of 32, 766 recipients defined for the number of recipients on a single message. See ME272672.

As per ME245565: "Data is being received in blocks from the remote server and each block is being decrypted as it is received. In rare cases, two blocks may be received by the server and read in a single input/output (I/O) operation. In these cases, the second block is not processed. When the next block arrives, the Windows NT security components recognize an issue (absent data) in the encryption stream and return an error of SEC_E_MESSAGE_ALTERED."

ME231737 specifies: "An application or a user may have deleted the Exchsrvr\Imcdata\In directory. When permissions on the C:\Exchsrvr\Imcdata\In directory are not set to Read Only, the directory may be deleted or renamed by any outside agent during Internet Mail Service operation."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...