Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8012 Source: NTBackup

The '<service>' returned '<error>' from a call to 'HrESEBackupSetup()' additional data '-'
- Service: Active Directory, error: "DS Contents in the backup copy are out of date. Try restoring with a more recent copy" - Restore from a more recent backup if possible. Consider changing the Active Directory tombstone lifetime before taking more backups with NTBACKUP. See ME216993 for more details on this issue.
- Service: Active Directory, error: "The disk is full" - Make more disk space available on the disk specified in the other Event IDs. Restart the computer in Directory Services Restore mode to do this if necessary.
- Service: Active Directory, error: "The handle is not valid" - Look for similar related Event IDs.
- Service: Active Directory, error: "The remote system refused the network connection" - Do not restrict the communication between NTBACKUP and the domain controller with firewall software products such as ZoneAlarm.
- Service: Active Directory, error: "There is no backup in progress" - Look for similar related Event IDs.
- Service: Active Directory, error: "A device attached to the system is not functioning" - See ME328691.
- Service: Microsoft Information Store, error: "Database is in use" - See the link to "Veritas Support Document ID: 236424".
In my case, this event appeared when I was attempting a scheduled NTBackup of an Exchange 2003 database on a member server. The problem turned out to be caused by the fact that the backup job was running under a domain account, which was not a member of the local administrators group (or backup operators group).
I received this event combined with EventID 614 from source ESE. I resolved the problem by defragging the Exchange DBs using “eseutil /p” and running “chkdsk /f” on the Exchange data and system drives.
As per Microsoft: "The backup type is set to Incremental or Differential, and the database has never had a full backup". See ME255530 for more details.

- Service: Microsoft Information Store, error: "An incremental backup cannot be performed when circular logging is enabled" - See ME294741.
- Service: Microsoft Information Store, error: "Database is in use" - See ME253299 and ME291996.
- Service: Microsoft Information Store, error: "The restore environment information isn't found" - See ME258529.
- Service: Microsoft Information Store, error: "Database not found" - See ME296841.
- Service: Microsoft Information Store, error: "error from ESE function call (d).from a call to '<function>' " - See ME318429, ME814891, and ME840013.

- Service: Microsoft Site Replication, error: "Backup is already active" - As per ME811934 this can be caused by the fact that a previous instance of Windows 2000 Backup (Ntbackup.exe) is still running in the background. Just use the Task Manager to stop the other instance. See ME811934 for more details.
As per ME306342, this behavior can occur if either of the following conditions is true:
- Exchange System Manager is installed on a computer on which Exchange 2000 Server is not installed.
- The Exchange information store service is not running.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.