Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 958 Source: MSExchangeTransport

Level
Description
Following master server DN appears to be pointing to a deleted object. This may prevent Exchange Routing Service from functioning properly. Please check your DS setting. <CN=WEBSERV1,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=HEP,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=hep,DC=no%gt;
Comments
 
As per Microsoft: "This Warning event is logged when Exchange cannot locate the routing group master for a routing group. The routing group master is the server that is responsible for maintaining and communicating information about the routing topology in its routing group. If a routing group has no routing group master, the routing group will not receive link state updates from other routing groups". See MSEX2KDB for additional information about this event.
As per Microsoft: "This issue may occur if you remove the Exchange 2000 Server routing group master and do not designate another Exchange Server computer to be the routing group master". See ME841666 to resolve this problem.

From a newsgroup post: "I got a new box that I wanted to move my exchange 2003 deployment too. I setup the new box, installed exchange on it, moved all the mailboxes, and set all the settings. I disabled the Exchange services on the original box. Things still worked. Like a dummy, I deleted the original server in System Manager. After that, Exchange on the new box failed to start and this event was being logged. A friend of mine, a developer on the Exchange team gave me the following tips that helped me to fix the problem:
1. Go into ESM (Exchange System Manager).
2. Right click on the top-level node (org) and select properties.
3. In the dialog box, check "Display routing groups" and "Display administrative groups" (if they are not already checked).
4. If they were not already checked, you will be prompted that you have to restart ESM for the settings to take affect. Do so.
5. Click on Administrative Groups.
6. Click on First Administrative Group (or whatever you called it).
7. Click on Routing Groups.
8. Click on First Routing Group (or whatever you called it).
9. Click on Members.
10. The new machine will be listed (and the old one will not). Right click on the new machine and set it to be "master".
11. Restart the Exchange services on the new machine".
This error will occur every 2 minutes when you delete the first server in your routing group in Exchange 2000 (2 servers exist and you remove one using ADSI after a migration). In order to eliminate this error you must display routing groups by opening the properties of you "first organization", select "display routing groups" .  Open up the routing group in System manager and select members. Right click on the server that still exists and select "set as master". The event should no longer appear.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...