Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9318 Source: MSExchangeMTA

An RPC communications error occurred. <error descriptiion>. The locality table (LTAB) index is 76. Windows NT error code: <error code>. [BASE IL MAIN BASE 1 500] (12)
This error indicates that the server that the messages are destined for is either down or cannot be reached on the network.

For generic information about the errors that are reported in this event see the links to the various error codes.
A system call from the message transfer agent to the operating system failed. See MSEX2K3DB for more details on this event.
In the Application event log on the Exchange 2000 Server computer, you may see some event ID message 9318ís from the message transfer agent (MTA) and event ID messages 1025ís from the MSExchangeIS private information store after you apply the changes described in ME316886. These event ID messages are warnings that may be due to Name Resolution failure using cached DNS naming information in Active Directory. These event ID messages are typically removed in three to six days. Some customers have reported that they removed these warnings more quickly by rebooting their Global Catalog Servers.
A system call from the message transfer agent to the operating system failed. Verify that the remote procedure call (RPC) service is running. Check network connectivity. If the error persists, stop and restart the message transfer agent service. If necessary, use Network Monitor to capture network traces, then view these traces from Network Monitor for any network issue.

The most common error codes are listed with possible resolutions:

Error code 5 - "Access denied" - A failure with the credentials provided at the time the MTA attempts to bind: check the permissions and account being used by the service. This issue can occur if there is a problem with the Exchange Server 5.5 service account or password that was specified when the Exchange 2000 server was installed in the Exchange Server 5.5 site and signifies that there is a security problem between the two servers. See ME217142, ME253307, ME257679, ME274770, ME279030, ME307459, ME323733 and ME327004.

Error code 14: This issue can occur if your computer does not have enough available Random Access Memory (RAM). See ME275468.

Error code 1722 - Similar to Event ID 9318 Source MSExchangeMTA Type Warning. Occurs when Exchange server is unable to locate another Exchange server on the network. I have received both 9318 and 9322 when one of the servers is offline or when using dual-homed Exchange servers and Netbios over TCP/IP. Problem on dual-homed exchange servers resolved by adding specific interfaces to be used by each server to each Exchange server's HOST and LMHOST file. See ME266312, ME303156, ME191594 and ME279537.

Error 1726: The remote procedure call failed.††RPC_S_CALL_FAILED

Error code 1753 - This problem is also usually DNS, but on the bind back. Verify that the host reporting this problem is able to resolve the remote host by FQDN. See ME307459.

This event also may occur if you upgrade from Exchange Server 5.5 Service Pack 3 (SP3) to Exchange Server SP4 and may be associated with event ID 9322 message with Error code 1722. To work around this issue, turn off the NAT service. For Exchange Server computer or clusters that are connected with site connectors, create an X400 connector, and then configure the address.

Error 1783: "Bad Stub Data" - This Problem occurs when the number of messages in the outbound DRAS connector's Queue exceeds the DRAS connector's configured threshold. By default, the Threshold value is set to 50. When the queue exceeds this threshold, an Additional association is generated. However, the sending MTA passes an Invalid context handle to the receiving MTA, which terminates the Connection because the handle is invalid.

Error 1818 = The remote procedure call was cancelled.††Symbolic name: PC_S_CALL_CANCELLED.

Error 9260: "This may be because the Exchange Server computer's connection to the network infrastructure has changed". See ME225206.

Some Q articles that may prove useful are:††ME248488, ME288195, ME289609, ME323733, ME325564 and ME327004.

See also the "MTA Troubleshooting Guide" link.
Error code 1330, it indicates a logon failure (the specified account password has expired.) See ME225196 link below for solution.

Error code 1753, it indicates: "There Are No More Endpoints Available from the Endpoint Mapper" ME245273 can help.

Related to Microsoft Exchange Server, version 5.5 SP4. As per ME280449, "This problem can occur if the network binding that the MTA needs to use is not the first binding available". Microsoft released a fix, see the link.
How about DNS? See ME261251, ref Exchange Server, versions 4.0, 5.0, 5.5

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.