Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9405 Source: MSExchangeMTA

An unexpected error has occurred which may cause the MTA to terminate. Error: <description>.
- Error: "Exception e002000b occurred at Address <address>" - See ME924835 for a hotfix applicable to Microsoft Exchange Server 2003.
- Error: "Unable to create file EV0.LOG, return code 110" - See ME162384.
- Error: "Exception c0000005 occurred at Address <address>" - See ME152941 and ME157175.
- Error: "Exception e0050c08 occurred at Address <address>" - See ME157013.
- Error: "Exception e0020002 occurred at Address <address>" - See ME152941 and ME157701.
- Error: "Access violation (0xc0000005) at Address <address> reading from 0x47524154" - See ME257422.
- Error: "Access violation (0xc0000005) at Address <address> reading from 0x0" - See ME282275 for a hotfix applicable to Microsoft Exchange Server 5.5.  
- Error: "Access violation (0xc0000005) at Address <address> reading from 0xc" - See ME153103.
- Error: "Failed to find socket, result=14, count=63" - See ME276222 for a hotfix applicable to Microsoft Exchange Server 5.5.
- Error: "SBPDSCLS:CB TID=1, calling TID=0" - See ME154301 and ME157701.
- Error: "legacy DN is not unique" - See "Captaris Support Answer ID: 185".
- Error: "Init Routing API returned error -2147219168" - See ME298954.

As per Microsoft: "The Microsoft Exchange Server disk may be full or a disk error may have occurred. The message transfer agent (MTA) service will stop if the disk is full". See MSEX2K3DB for additional information about this event.
- Error: 0xc0000005 - See ME140957, ME152876, ME152945, ME157235, ME157708, ME159193, ME159194, ME159195, ME165522, ME177886, ME195731, ME246608, ME555358, and the link to Error code 0xc0000005.
- Error: 0xe0020002 - The MTA terminated due to a resource shortage. See ME155302 and ME182547 to find out how you can avoid this resource shortage.
- Error: 0xe0020004 - See ME159174.
- Error: 0xe005085f - See ME169701.
- Error: 0xe005083e - See ME166402.
- Error: 0xe0050803 - See ME177328.
- Error: 0xc0000094 - See ME177887.
- Error: "Memory corruption at address <adress>" - See ME182547.
- Error: "Error writing AAT" - See ME151395 and ME169701.
- Error: "Double acquire of semaphore 2210" - See ME257995.
- Error: "Double acquire of semaphore 2151" - See ME169690.
- Error: "Double acquire of semaphore 2810" - See ME159174.
- Error: "Out of Semaphores" - See ME254943.
- Error: "Queue-Desc-Object (ID 1) not found" - See ME182085.
- Error: "Base-MS Not initialised-Error=3909" - See ME154337.
- Error: "Init Routing API returned error -1073478776" - See ME840470.
- Error: "Init Routing API returned error -2147219168" - See ME840469.

Also check ME821841 for more details.
The Exchange Server MTA uses the initial checkpoint size to determine how to decode the data it receives from the foreign MTA. If the initial checkpoint is large, and then subsequent checkpoints are considerably smaller, this may prevent the Exchange Server MTA from properly decoding the data it receives. See ME246302.
Error description: "ExchHeapFree failure 87. [BASE DISP:FANOUT 12] (16)". The MTA can encounter problems if it is configured to generate content encoding for a size of 2 KB, which is turned on when the heuristics bit is set. See ME197281.
Error description: "Init Routing API returned error -2147219168. [BASE MAIN BASE 1] (16)". common for Exchange, dedicated smtp or public folder servers configured without a mailbox store. As per Microsoft KB ME259109, "This behavior can be caused when the server does not have a private store (mailbox store). As a result, routing cannot designate a private mail store for the SMTP queue, and returns an error when the MTA tries to initiate routing. This behavior is most likely seen on servers that are dedicated public folder servers. To work around this behavior, disable the Message Transfer Service (MTA) on servers that do not contain a private store, or add a private store.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.