Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Failed to generate offline Address Book <address book path>, error "<error code>".
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of the Microsoft Exchange System Attendant (MSExchangeSA) service?
Error code 80072030 = LDAP_NO_SUCH_OBJECT or ERROR_DS_NO_SUCH_OBJECT = "Object does not exist." Based on this error code I would verify the existance of the Address Book mentioned in the event description.
This event indicates that the Exchange server failed to generate an Offline Address Book. The error code provides an indication of the underlying cause. See MSEX2K3DB for details about this event.
- Error code: 80072030 - As per Microsoft: "This behavior occurs because the address list must be removed from the OAL before the address list object is deleted. When you delete an address list object, the link to the OAL object in the address list is not removed. The event is logged when you try to access a deleted object on the server. To work around this behavior, after you have deleted the address list object and cannot rebuild the OAL, you must edit the OAL object attribute". To do this, see ME842032.
In our case this event was generated because the Offline Address List (OAL) existed, but the organisation it belonged to had been removed. Removing the OAL solved the problem.
|Private comment: Subscribers only. See example of private comment|
|Links: ME842032, MSEX2K3DB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated