Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9301 Source: MSExchangeSA

Failed to generate offline Address Book <address book path>, error "<error code>".
Error code 80072030 = LDAP_NO_SUCH_OBJECT or ERROR_DS_NO_SUCH_OBJECT = "Object does not exist." Based on this error code I would verify the existance of the Address Book mentioned in the event description.
This event indicates that the Exchange server failed to generate an Offline Address Book. The error code provides an indication of the underlying cause. See MSEX2K3DB for details about this event.
- Error code: 80072030 - As per Microsoft: "This behavior occurs because the address list must be removed from the OAL before the address list object is deleted. When you delete an address list object, the link to the OAL object in the address list is not removed. The event is logged when you try to access a deleted object on the server. To work around this behavior, after you have deleted the address list object and cannot rebuild the OAL, you must edit the OAL object attribute". To do this, see ME842032.
In our case this event was generated because the Offline Address List (OAL) existed, but the organisation it belonged to had been removed. Removing the OAL solved the problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.