Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9004 Source: MSExchangeTransport

Categorizer encountered a hard error while processing a message. While processing user '', the function 'CPhatCat::HrSetInboundCharsetHint' called 'HrGetDomainInfo' which returned error code '0x8007054b' (The specified domain either does not exist or could not be contacted.) A DSN has been generated.
This problem occurs when you enable the envelope journaling feature in Microsoft Exchange Server 2003 Service Pack 2 because the envelope journaling feature uses the domain controller instead of the global catalog server to resolve the journaling mailbox GUID to the domain name of the user account. This process occurs when the e-mail message is re-categorized and then is journaled again. See ME925379 for a hotfix applicable to Microsoft Exchange Server 2003.

This issue may occur if one or more of the Exchange 2000 computers does not have sufficient permissions to obtain the attributes of the recipients. See ME814074 to solve this problem.

See ME251746 and ME290204 for additional information about this event.
EventID 9004 in combination with EventID 9000 can occur after an upgrade of Exchange 5.5 to Exchange 2000. Make sure the targetAddress is empty on the AD users. This can happen to all accounts that try to log on to the Exchange server during the upgrade. When retrieving mail they end up in a loop (targetAddress points to itself) resulting in a 5.4.6 NDR.
As per Microsoft: "This problem occurs if the Exchange 2000 Server Message Categorizer component encounters an error when it tries to encapsulate an e-mail message address. A 5.1.0 NDR is generated, even if the error was one that can be retried". See ME816199 and ME884996 for more information on fixing this problem.
This issue can occur if the domain settings for the Internet message formats are incorrect. See ME274320.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.