Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8197 Source: SRMSVC

File Server Resource Manager Service error: Unexpected error.

   Running email action.
   Handling a file screen audit event.
   Processing File Server Resource Manager event

   Action type: Email Action
   Action name: Email Action0
   SMTP server: <server>
   Mail-from address: <address>
   Mail-reply-to address: <address>
   Mail-to address: <address>
   Mail-CC address:
   Mail-BCC address:
   Mail subject: <subject>
   Mail message text: The system detected that user failed
   File screen path: <path>

Error-specific details:
   Error: IMessage::Send 0x80040211.
In my case, I received the following description:
    Starting File Server Resource Manager Service.
  Error-specific details:
    Error: IWbemDecoupledRegistrar::Register, 0x80041011

In order to solve this problem I ran the following from a command prompt
  cd /d "%windir%\system32\wbem"
  mofcomp srm.mof
  net stop srmsvc
  net start srmsvc
When you define quotas, File Server Resource Manager (FSRM) stores information about these quotas in the quota.xml,, and databasefilescreen files in the \System Volume Information\SRM folder on the drive that the quotas were imposed initially. During a clean uninstallation of the FSRM, these files are removed. However, if the uninstallation was not completed successfully and you re-installed FSRM on the same computer, these files still remain and are not over-written by a subsequent re-installation of FSRM. See ME555941 for information on how to solve this problem.
This problem may occur if you are using Basic authentication together with NTLM or together with anonymous authentication on the SMTP server. See ME914678 for a hotfix applicable to Microsoft Windows Server 2003.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.