Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9149 Source: MSExchangeSA

Microsoft Exchange System Attendant failed to start Exchange server '<server name>'. Error code '<error code>'.
- Error code: 0xC0070003 This problem happened when an Exchange cluster disk resource was mounted without a letter drive. Assign the correct letter drive to the disk resource, take offline, and bring back online disk resources. Verify that all drive letters are mounted, and bring online the System Attendant and all other Exchange resources.
- Error code: 0x80072030 (Error code 0x80072030) - See ME273389.
- Error code: 0x5 (Error code 0x5) - See ME271920.
- Error code: 0xC0070005 (Error code 0xC0070005) - See ME842203.

As per Microsoft: "This event indicates that the System Attendant service could not start on this server. A different event may precede or succeed this event and may help explain the cause. Review these additional events to determine the best course of action. See MSEX2K3DB to find out what are the most probable causes for this error.
This Event ID can be accompanied by Event IDs 9022, 1005. Essentially there are corrupted keys within the server's key container. See ME280432.
Also together with 9022 and 1005, as per ME325674, "This issue may occur if the server account does not have the correct permissions on both the Exchange Organization container and the server container in Active Directory".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.