Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9320 Source: MSExchangeSA

Source
Level
Description
OALGen could not generate full details for some entries in the OAL "\Global Address List". To see which entries are affected, event logging for the OAL Generator must be set to at least medium.
Comments
 
Apparently, this can be ignored. See EV100164 (Events 9320 and 9359 on new installation of Exchange 2010) for information about this event.
This event indicates that information has been limited in the offline address book. See ME908496 for additional information on this event.

As per Microsoft: "This Warning event is logged when there are problems generating details for one or more entries in an offline address list. The most common cause for this event is when the details information of a user object is larger than the 64-kilobyte (KB) limit". See MSEX2K3DB for additional information about this event.
This event may indicate invalid User Certificates within the Active Directory. To identify the invalid certificates perform the following steps.

Turn OAL Generator Diagnostics Logging to at least "Medium". Within Exchange System Manager navigate to the property page for the Exchange Server which is triggering the event. Select the "Diagnostics Logging" tab, select "MSExchangeSA" and set the logging for the OAL Generator to at least “Medium”.

Rebuild the Offline Address List. Within Exchange System Manager navigate to the "Offline Address Lists" container under "Recipients". In the right pane right-click the OAL which is generating the warning and select "Rebuild". This should create an event 9323 for each User with an invalid or expired certificate. See “EventID 9323 from source MSExchangeSA” for information on how to remove the invalid certificates.
To see which entries are affected open up Exchange System Manager, expand the "Server" folder, right click on the server that is generating the warning, and go to "Properties". Then click on the "Diagnostics Logging" tab, and click on "MSExchangeSA" in the left "Services" window. Then select "OAL Generator” in the left window, and select the "medium" radio button at the bottom.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...