Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9322 Source: MSExchangeMTA

Source
Level
Description
An interface error has occurred. An MtaBindBack over RPC has failed. Locality Table (LTAB) index: <number>, Windows 2000/MTA error code: <error code>. Comms error <error code>, Bind error <error code>, Remote Server Name <server name>, Protocol String <value> [<value> <value> <value> <value>] (14).
Comments
 
Error code 5: "This issue can occur if there is a problem with the Exchange Server 5.5 service account or password that was specified when the Exchange 2000 server was installed in the Exchange Server 5.5 site." See ME257679, ME279030, ME274770.
Error code 14: "This issue can occur if your computer does not have enough available Random Access Memory (RAM)." See ME275468
Error code 1722: "Similar to Event ID 9318 Source MSExchangeMTA Type Warning. Occurs when Exchange server is unable to locate another Exchange server on the network. I have received both 9318 and 9322 when one of the servers is offline or when using dual-homed Exchange servers and NetBIOS over TCP/IP. Problem on dual-homed exchange servers resolved by adding specific interfaces to be used by each server to each Exchange server's HOST and LMHOST file." See ME266312, ME303156, ME191594, ME279537.
Error 9260: "This may be because the Exchange Server computer's connection to the network infrastructure has changed". See ME225206.

For general description and suggestions about the network error codes reported for this event see the links to various error codes.
- Error code 1722 - See ME247782, ME824054 and the link to "Symantec Knowledge Base Document ID: 2001020513515454".
- Error code 5 - See ME247782 and ME322051.

This issue may occur when your Exchange 2003 computer cannot contact other Exchange Server computers that are in the domain. This event may indicate that there is a problem with name resolution of the computer that is listed in the description. See ME821889 to solve this problem.

As per Microsoft: "This event occurs when a remote procedure call (RPC) connection cannot be established between two message transfer agent (MTA) servers. The remote server has initiated an RPC bind (connection) to the local server; however, the local server failed to establish an RPC bind back to the remote server. As a result, two-way communication via RPC could not be established". See MSEX2K3DB for more details.
This event occurs when a remote procedure call (RPC) connection cannot be established between two message transfer agent (MTA) servers. The remote server has initiated an RPC bind (connection) to the local server; however, the local server failed to establish an RPC bind back to the remote server. As a result, two-way communication via RPC could not be established.

User Action:
At the Windows 2000 command prompt, use the Net Helpmsg command for an explanation of the Windows 2000 error. For example, if you want to get an explanation of Windows 2000 Error code 3817, type "Net Helpmsg 3817" at the command prompt, and then press Enter.
Verify that the remote procedure call (RPC) service is running.
Check network connectivity. If the error persists, stop and restart the message transfer agent service. If the error still persists, restart Microsoft Exchange Server.

The most common error codes are listed with possible resolutions:

Error code 5 = "Access denied" - A failure with the credentials provided at the time the MTA attempts to bind: check the permissions and account being used by the service.  This issue can occur if there is a problem with the Exchange Server 5.5 service account or password that was specified when the Exchange 2000 server was installed in the Exchange Server 5.5 site  and signifies that there is a security problem between the two servers. See ME217142, ME253307, ME257679, ME274770, ME279030,   ME307459, ME323733 and ME327004.

Error code 14: "This issue can occur if your computer does not have enough available Random Access Memory (RAM)." See ME275468.

Error code 1722: Similar to Event ID 9318 Source MSExchangeMTA Type Warning. Occurs when Exchange server is unable to locate another Exchange server on the network. I have received both 9318 and 9322 when one of the servers is offline or when using dual-homed Exchange servers and Netbios over TCP/IP. Problem on dual-homed exchange servers resolved by adding specific interfaces to be used by each server to each Exchange server's HOST and LMHOST file. See ME266312, ME303156, ME191594, ME279537. See ME266330, ME325564 and ME326990.

Error 1726: The remote procedure call failed.  RPC_S_CALL_FAILED

Error code 1753 - this problem is also usually DNS, but on the bind back. Verify that the host reporting this problem is able to resolve the remote host by FQDN. See ME307459

Error code 1783: "Bad Stub Data." This Problem occurs when the number of messages in the outbound DRAS connector's Queue exceeds the DRAS connector's configured threshold. By default, the Threshold value is set to 50. When the queue exceeds this threshold, an Additional association is generated. However, the sending MTA passes an Invalid context handle to the receiving MTA, which terminates the Connection because the handle is invalid.

Error 1818 = The remote procedure call was cancelled (PC_S_CALL_CANCELLED)

Error 9260: "This may be because the Exchange Server computer's connection to the network infrastructure has changed". See ME225206.

For general information see the "MTA Troubleshooting Guide" link.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...