Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7888 Source: OfficeSharePointServer

A runtime exception was detected. Details follow.
Message: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Techinal Details:
System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex)
   at Microsoft.SharePoint.Library.SPRequest.ApplyTheme(String bstrUrl String pVal)
   at Microsoft.SharePoint.SPWeb.ApplyTheme(String strNewTheme)
   at Microsoft.Office.Server.Administration.SharedResourceProvider.ProvisionAdministrationSite()
   at Microsoft.Office.Server.Administration.SharedResourceProvider.Microsoft.Office.Server.Administration.ISharedComponent.Install()
   at Microsoft.Office.Server.Administration.SharedResourceProvider.Provision().
For me this was a problem related with the User profiles. From a MS support engineer: "This error may be caused by insufficient SharePoint permissions for your default content access account. You must give your default content access account and your search service account “Manage User Profiles” rights". I followed his advice and granted the referred permissions.

See also EV100142.
There are different type of errors (the Message part of the event) recorded with this event so the troubleshooting should be approached accordingly:
- "All queries combined using a UNION INTERSECT or EXCEPT operator must have an equal number of expressions in their target lists."
- " Timeout expired.  The timeout period elapsed prior to completion of the operation or the server is not responding."
- "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"
This event is recorded in various conditions so one has to approach each one differently. The “Details” part of the event description contains the error message for the specific instance of this event. One should use this part of the event in order to determine if a particular solution is applicable to that problem. The error message could be generated by almost any component used by Office Sharepoint Server. When searching for solutions, use a search criteria like: sharepoint "specific error message". For instance, if the error message is Thread was being aborted, search on Google for:

sharepoint "Thread was being aborted"

Here are some example of errors:
- Exception of type "System.OutOfMemoryException" was thrown. – The server might be under heavy load. See ME823547
- Thread was being aborted. - See EV100028 for some suggestions.
- Error converting data type ntried to use varchar to float.
- Invalid object name "AR_CacheCounters". Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK TRANSACTION statement is missing. Previous count = 0 current count = 1.
- The request failed with HTTP status 503: Service Unavailable.
From a newsgroup post: "Here are the steps I took to correct these errors:

1. I downloaded a wonderful, free utility called SharePoint Inspector, created by Gat Bouveret (see the link to “SharePoint Inspector” below). I used this tool to identify the web applications and sites referred to by their GUID in the event log errors.
2. I opened a command prompt and typed stsadm- o preparetomove –Site <site> –OldContentDb   <GUID of the contentdb listed in event log error>.
3. After this completed successfully, I ran stsadm –o sync –deleteolddatabases 0 (note: Depending on how long you’ve been seeing these errors, you may be able to use a switch greater than zero. If it’s been 2 days since it synched last, you can use 2. You can tell this by typing stsadm –o sync –listolddatabases <number of days you think> and look for the offending content db GUID.

In my case, there were 4 “my site” sites that were not syncing with the profile database. After performing these steps, I rechecked the event log at the top of the hour and the events had not reoccurred". See the link to "Failure trying to sync" for the original post.
From a newsgroup post: During a database migration to MOSS 2007 using a migration server for the upgrade with SPS 2003 and MOSS 2007 installed, after conducting the upgrade on the migration server you may backup the SQL Databases and restore them to another server farm (ostensibly production).  This problem occurs in the event log of a MOSS farm with 2 or more Web Front Ends (WFE) and a single SQL Server instance.
The reason is that there is a table in the SSP database that contains sync commands. If the GUIDs for the Content databases in that table do not match the GUIDs of the current database, then a conflict develops and the web sites will not be able to be pushed to the other WFE's in the farm. To resolve this, run the following command to delete out the offending rows in the table and force a new population and sync:
stsadm -o sync –DeleteOldDatabases.

See the link to "Office SharePoint Server EventID 7888" for the original post.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.