Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4999 Source: MSExchange Common

Watson report about to be sent to dw20.exe for process id: <pid>, with parameters: <parameteres>.
EV100634 (Exchange Diagnostics service crashing with the event 4999, 1007 and 7031 post CU6) provides information on how to troubleshoot this event when recorded along with events 1007 from MSExchangeDiagnostics and 7031 from Service Control Manager (making sure that that the templates key are present under PLA registry key).
If you just installed Exchange 2010 SP3 Update Rollup 1, see the 'Known Issue' on ME2803727. Basically it tells you to disable any transport rule that adds a disclaimer to outgoing emails, then you can resume emails that are in the Poison Message queues on your CAS servers. That's the workaround as MS doesn't have a solution yet.
I've had this exact issue. Possible fixes are discussed in EV100237 (Exchange 2010 SP1 BUG - Import IsArchive) for those that may be doing PST imports directly to Exchange 2010.
As per Microsoft, if System.ObjectDisposedException is in the parameters specified in the event description then this is caused by a bug in the software. See ME970118 for information about the update required to fix this.

Another instance of this event can be recorded if the user used the Transporter Suite to migrate their folders and items from an external IMAP server to A Microsoft Exchange Server 2007 server. See ME971431 for details.

For the following message details: "parameters: E12, <build type>, <application version>, edgetransport, unknown, M.E.D.S.RetryBagFactory.ctor, System.NullReferenceException", there is an update rollup available. See ME2188615.
As per ME962220, you may get this error when you try to mount a Storage Group database on a server that is running the cluster continuous replication (CCR) feature in Microsoft Exchange Server 2007. This problem occurs if the private properties for the nonworking Storage Group are blank.  See the article for the resolution.

ME968111 indicates a situation when this event might be recorded if an administrator deletes a store that was being replicated but does not remove the storage group that hosted the store. This is fixed by installing the Update Rollup 9 for Exchange 2007 Service Pack 1.

ME947551 indicates that this error may occur on a Microsoft Exchange Server 2007 Service Pack 1 (SP1) Edge server, when you use a Send connector that uses the BasicAuthRequireTLS value. To resolve this problem, install Update Rollup 2 for Exchange Server 2007 Service Pack 1.
See ME944752, ME945938, ME947360, ME948666, ME949463, and ME956532 for information about this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.