Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 904 Source: ESEBackup

Information Store (3024) Callback function call <callback function name> ended with error <error code> <error message>.
Callback function: eInstanceForBackup, error 0x0000050D  - In my case, logged in conjunction with event id 9840 from MSExchangeIS. The Error code 0x50D is identical to Error code 1293. It means that the IS does not know that the previous backup for the storage was completed then block any new backup tentative. Fixed by a restart of the exchange server or MSexchangeIS recycle or a dismount-mount of Storage(s).

See also ME930800.
- Callback function: "ErrESECBRestoreGetDestination", Error code 0xC7FE1F42 - See ME841143.
- Callback function: "ErrESECBPrepareInstanceForBackup", Error code 0xC7FE1F45 - See ME924204.
As per Microsoft: "This Error event indicates that an Extensible Storage Engine (ESE) callback function returned an error. This can potentially signify a serious situation in which a backup or restore process has failed. The error message that is included in the message text of Event ID 904 will vary, depending on the problem encountered". See MSEX2K3DB for more details.

As per Microsoft: "This issue may occur if the Exchange information store service (Store.exe) is not running when you restore a full online backup of an Exchange Server 2003 computer. The restore process tries to replay the transaction log files, but because the Exchange information store service is not running, this prevents the information store databases from mounting". See ME823016 for information on how to fix this problem.

- Callback function: "ErrEseCBRestoreOpen", Error code 0xc7fe1f45 - See ME280056.
- Callback function: "ErrESECBRestoreGetDestination", Error code 0xC7FE1F42 - See ME824126 and the link to Error code 0xC7FE1F42.
- Callback function: "ErrESECBRestoreComplete", Error code 0xFFFFFB40 - See ME843092 and the link to "Error code 0xFFFFFB40".
- Callback function: "ErrESECBRestoreGetDestination", Error code 0xC7FE1F41 - See the link to "Veritas Support Document ID: 236424".
- Callback function: ErrESECBPrepareInstanceForBackup - Restart "Microsoft Exchange MTA stacks" and "Microsoft Exchange Information Store". Than attempt the backup again.
Callback function: ErrESECBPrepareInstanceForBackup - no info

Callback function: "ErrESECBRestorecomplete", Error code 0xC8000262. See ME316794.
Callback function: "ErrESECBRestoreComplete", Error code 0xC8000263. See ME328639.
Callback function: "ErrESECBRestoreGetDestination", Error code 0xC7FE1F41, error message: "Database is in use". See ME291996.

Callback function: "ErrESECBRestoreGetDestination" , Error code 0xC7FE1F42, error message: "Database not found". See ME296841.

Callback function: "ErrESECBRestorecomplete", Error code 0xC8000262. See ME299000.
Callback function: "ErrESECBGetDatabasesInfo", error: 0x8004010F. Error event appears after apparently successful backup with Veritas Backup Exec (environment: Exchange 2000 on W2KAS cluster).

The solution proposed by Veritas is to ignore the message as it is "non data threatening". See Veritas TechNote 245287.
Callback function: "ErrESECBRestoreOpen", Error code 0x8004010F. See ME266689.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.