Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Comments for event ID 4002 currently in the processing queue.

Note: We have not reviewed this information yet so it is unfiltered, exactly how it was submitted by our contributors.

Event ID: 4002
Event Source: nc_net
Event Type: Warning
Event Description: NC_Net active check socket failed: An existing connection was forcibly closed by the remote host

Comment:
Event ID: 4002
Event Source: MSExchange System Attendant Mailbox
Event Type: Error
Event Description: Log Name:      Application
Source:        MSExchange System Attendant Mailbox
Date:          01/06/2009 09:48:42
Event ID:      4002
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EXLABSRV144.Dom.EX.Lab
Description:
An unexpected failure has occurred. The problem will require administrator intervention. The service will retry in 56 seconds. Diagnostic information:

Cannot open mailbox /o=ExchMigrationLab/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXLABSRV144/cn=Microsoft System Attendant.
Microsoft.Exchange.Data.Storage.MailboxUnavailableException: Cannot open mailbox /o=ExchMigrationLab/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXLABSRV144/cn=Microsoft System Attendant. ---> Microsoft.Mapi.MapiExceptionUnknownUser: MapiExceptionUnknownUser: Unable to open message store. (hr=0x80004005 ec=1003)
Diagnostic context:
    Lid: 18969   EcDoRpcExt2 called [length=256]
    Lid: 27161   EcDoRpcExt2 returned [ec=0x0][length=116][latency=0]
    Lid: 23226   --- ROP Parse Start ---
    Lid: 27962   ROP: ropLogon [254]
    Lid: 17082   ROP Error: 0x3EB    
    Lid: 26937  
    Lid: 21921   StoreEc: 0x3EB    
    Lid: 27962   ROP: ropExtendedError [250]
    Lid: 1494    ---- Remote Context Beg ----
    Lid: 26426   ROP: ropLogon [254]
    Lid: 27395   Error: 0x0
    Lid: 28230  
    Lid: 16966   StoreEc: 0x8004010F
    Lid: 31433   StoreEc: 0x8004010F
    Lid: 8620    StoreEc: 0x3EB    
    Lid: 1750    ---- Remote Context End ----
    Lid: 26849  
    Lid: 21817   ROP Failure: 0x3EB    
    Lid: 26297  
    Lid: 16585   StoreEc: 0x3EB    
    Lid: 32441  
    Lid: 1706    StoreEc: 0x3EB    
    Lid: 24761  
    Lid: 20665   StoreEc: 0x3EB    
    Lid: 25785  
    Lid: 29881   StoreEc: 0x3EB    
   at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message Int32 hresult Int32 ec DiagnosticContext diagCtx)
   at Microsoft.Mapi.ExRpcConnection.OpenMsgStore(OpenStoreFlag storeFlags String mailboxDn Guid mailboxGuid Guid mdbGuid MapiStore msgStorePrivate String& correctServerDn ClientIdentityInfo clientIdentityAs String userDnAs String applicationId CultureInfo cultureInfo)
   at Microsoft.Mapi.ConnectionCache.OpenMapiStore(String mailboxDn Guid mailboxGuid Guid mdbGuid ClientIdentityInfo clientIdentity String userDnAs OpenStoreFlag openStoreFlags CultureInfo cultureInfo String applicationId)
   at Microsoft.Mapi.ConnectionCache.OpenMailbox(String mailboxDn Guid mailboxGuid Guid mdbGuid WindowsIdentity windowsIdentityAs String userDnAs OpenStoreFlag openStoreFlags CultureInfo cultureInfo String applicationId)
   at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn String userDn String mailboxDn Guid mailboxGuid Guid mdbGuid Object identity ConnectFlag connectFlag OpenStoreFlag openStoreFlag CultureInfo cultureInfo String clientInfoString Boolean secondTry)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn String userDn String mailboxDn Guid mailboxGuid Guid mdbGuid Object identity ConnectFlag connectFlag OpenStoreFlag openStoreFlag CultureInfo cultureInfo String clientInfoString Boolean secondTry)
   at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn String userDn String mailboxDn Guid mailboxGuid Guid mdbGuid Object identity ConnectFlag connectFlag OpenStoreFlag openStoreFlag CultureInfo cultureInfo String clientInfoString Boolean secondTry)
   at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn String userDn String mailboxDn Guid mailboxGuid Guid mdbGuid Object identity ConnectFlag connectFlag OpenStoreFlag openStoreFlag CultureInfo cultureInfo String clientInfoString)
   at Microsoft.Exchange.Data.Storage.MailboxSession.Initialize(LogonType logonType ExchangePrincipal owner DelegateLogonUser delegateUser Object identity OpenMailboxSessionFlags flags)
   at Microsoft.Exchange.Data.Storage.MailboxSession.CreateMailboxSession(LogonType logonType ExchangePrincipal owner DelegateLogonUser delegateUser Object identity OpenMailboxSessionFlags flags CultureInfo cultureInfo String clientInfoString)
   at Microsoft.Exchange.Data.Storage.MailboxSession.OpenAsAdmin(ExchangePrincipal mailboxOwner CultureInfo cultureInfo String clientInfoString Boolean useLocalRpc Boolean ignoreHomeMdb)
   at Microsoft.Exchange.Data.Storage.MailboxSession.OpenAsAdmin(ExchangePrincipal mailboxOwner CultureInfo cultureInfo String clientInfoString)
   at Microsoft.Exchange.Servicelets.SystemAttendantMailbox.Servicelet.Work()
Comment: started occuring when installed windows 2008 sp2 symptom: public folder heirarchy and folder updates would not replicate to server..  uninstalled win2008 sp2.
Event ID: 4002
Event Source: EqualLogic
Event Type: Error
Event Description: The description for Event ID ( 4002 ) in Source ( EqualLogic ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description see Help and Support for details. The following information is part of the event: 0x80070490 \\.\PHYSICALDRIVE5 0-8a0906-35d36c905-b5f0002b4364b7f1.
Comment:
Event ID: 4002
Event Source: network profile
Event Type: Information
Event Description: wait for identification
Comment:

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...