cancel
Showing results for 
Search instead for 
Did you mean: 

Wish List - Monitoring Criteria

Aaron_Mears
Level 4
Employee Accredited Certified
In an effort to be more proactive administratively it would be nice to compile a list of useful events from the App Logs (and EV App Logs) with some priority associated to them, and also other things worth getting alerted on, like failed to store items in Journal Mailboxes. This would tie into monitoring software so maybe you get an e-mail when an Index rolls over, but you get a page when the storage service fails. I have some lists of EventID's, but the intent is to set some priority. Anything that you can share would be great.

Thanks,

Aaron

Event NoSubjectComment

2178Startup success: Archiving TaskThis message is logged when an Archiving Service successfully starts. The number at the end of the message identifies the build of the Enterprise Vault software.
2179Startup success: Retrieval ServiceLogged when an Enterprise Vault Retrieval Service has started. The number in brackets indicates the version of the Enterprise Vault software. In the above example this means Version 5.0 Build 5562.
2180Startup success: Journaling TaskLogged when an Enterprise Vault Journal Service has started. The number in brackets indicates the version of the Enterprise Vault software.
2181Startup success: Archiving TaskThis message is logged when an Archiving Service stops.
2182Shutdown success: Retrieval ServiceThis message is logged when a Retrieval Service stops.
2183Journaling Task stoppedThis message is logged when a Journal Service stops.
2184Archiving Task failureTry to restart the Archiving Task. Check application and system event logs for other messages that may have been logged at the same time because these may show the root cause of the problem.
2185Retrieval Service failureAttempt to restart the service. Check application and system event logs for other messages that may have been logged at the same time because these may be the root cause of the failure.
2209Startup failure: MAPIIn Internet Explorer on the Enterprise Vault server. Go to Internet Options on the Tools menu. Click the Programs tab. Next to E-mail, make sure that that Microsoft Outlook is selected.
2210Startup failure: COMAttempt to restart the service. Check application and system event logs for other messages that may have been logged at the same time because these may show the root cause of the problem.
2214Startup failure: Archiving, Journaling, or Public Folder taskCheck other events, which will have been logged in the Application event log at the same time, to find the root cause of the problem.
2246Journal mailbox access problemWhen a Journaling Service starts it attempts to connect to the mailbox with which it is associated. This message is logged if the login fails for some reason. The most likely causes are incorrect configuration or a permission problem.
2247Journal mailbox access problemA mailbox can have any of the following states: New, Enabled, Disabled, or Suspended. This message is logged by a Journal Service if the mailbox with which it is associated is disabled or suspended. Also, in certain circumstances, Enterprise Vault will disable a mailbox if there is a configuration problem.
2256Startup failure: Archiving TaskWhen the Archiving Service starts it makes various checks and also starts another process called AgentClientBroker. This message is logged if the tests fail or the AgentClientBroker process cannot be started. Check the event log for other messages that should show the root cause of the problem, which could, for example, be a failure to retrieve information from the Enterprise Vault Directory Service.
2257Startup failure: Retrieval ServiceTry to restart the service. Check the application and system event logs for other messages that may have been logged at the same time because these may indicate the root cause of the problem.
2258Startup failure: Journaling TaskCheck the application and system event logs for other messages that may have been logged at the same time because these may indicate the root cause of the problem.
2276Fatal errorIf a fatal error occurs in an agent service then this message may be logged. For example, the message could be logged if there is a configuration issue, or a lack of resources, or a failure to launch the AgentClientBroker process. Examine the Application Event log for other errors to determine the root cause of the problem.
2304Failure: directory database lookupThis may occur if archiving requests have been sent to an Archiving Service that has subsequently been deleted from the Enterprise Vault directory database.

Use MSMQ to purge all Archive queues related to the corresponding Exchange Server.
2737Startup failure: Archiving TaskAgentClientbroker is a process used by both the Archiving and Retrieval services for client-to-server communication. This message may be logged if either of these services fails to start. Try restarting the services again if this error is logged. If this fails, use the Enterprise Vault Administration Console to re-enter the Vault Service account. If the problem continues contact your Enterprise Vault support office.
2748Incorrect Vault Service account detailsIn Enterprise Vault administration console re-enter Vault Service account details.
2749Incorrect Vault Service account detailsIn the Enterprise Vault Administration Console re-enter the Vault Service Account details.
2750Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2751Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2752Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2753Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2754Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2755Directory database integrity problemThis may be due to some kind of directory database integrity issue. Contact your local Enterprise Vault support office for further assistance.
2756Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2757Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2758Directory database integrity problemThere is a data integrity issue related to the Enterprise Vault directory database. If the problem remains, contact your local Enterprise Vault support provider.
2763Directory database integrity problemThis may be due to some kind of directory database integrity issue. Contact your local Enterprise Vault support office for further assistance.
2823Journal mailbox has reached quota limitIncrease or remove storage quotas for the journal mailbox.
2851Insufficient disk spaceCheck disk space on all disks on the server for disk space issues.
2852Insufficient memory or MAPI resourcesThis message may be logged by any of the agents. This message usually indicates that there is a MAPI resource issue rather than a lack of physical memory. Stop and then restart all Enterprise Vault services on the server. If this does not resolve the issue, restart the server. MAPI resource leaks were found in the Enterprise Vault and fixed in V4.0 CP5 and later releases. Also ensure that as part of Enterprise Vault backup procedures all Archiving/Retrieval services etc. are stopped at the same time to ensure all resources are freed up. See the Enterprise Vault operations guide for further advice on backing up Enterprise Vault.
2853Insufficient MAPI resourcesThis is logged when one of the Agents in Enterprise Vault requests resources from MAPI and receives a status that indicates insufficient resources. This was sometimes caused by memory leaks in Enterprise Vault. MAPI resource leaks were found and fixed in V4.0 CP5 and later releases.
2854Disk access or space problemEnsure that all disks on the Enterprise Vault server are accessible and have sufficient disk space.
2947Startup success: Public Folder TaskThe Public Folder Task for the root path logged in the message has started.
2948Startup success: Public Folder TaskThe Public Folder Task responsible for processing the Root path logged in the message has stopped.
3027Cannot read from Active DirectoryCheck Enterprise Vault has been configured correctly and there there are no network or connectivity issues.
3038Startup failure: Archiving, Journaling, or Public Folder taskOn startup each Archiving, Journaling, and Public Folder task tries to communicate with Exchange Server to see if the Exchange Directory Service exists. If it does exist then the task assumes it is communicating with Exchange 5.5, otherwise it assumes Exchange 2000. This article may be relevant http://support.microsoft.com/default.aspx?scid=kb;en-us;q323790
3039Exchange Server connectivity issueThis message may be logged by Archiving, Journaling, or Public Folder tasks. The problem is usually caused by either an Exchange Server connectivity issue or a lack of MAPI resources. Ensure that proper backup procedures are followed. Specifically, make sure that all Archiving, Journal, and Public Folder tasks are shut down nightly as part of backup procedures.
3040Failed to connect to MAPI session. Shutting down.Attempt to restart the task. Check the Application and System event logs for other errors that may help you to determine the root cause of the problem.
3041Failed to connect to MAPI session. Shutting down.Attempt to restart the task. Check the Application and System event logs for other errors that may help you to determine the root cause of the problem.
3077Startup failure: Archiving, Journaling, or Public Folder taskOn startup each Archiving, Journaling, and Public Folder task tries to communicate with the Exchange Server to see if the Exchange Directory Service exists. If it does then the task assumes it is communicating with Exchange Server 5.5, otherwise it assumes Exchange Server 2000. This article may be relevant http://support.microsoft.com/default.aspx?scid=kb;en-us;q323790
3078Startup failure: Archiving, Journaling, or Public Folder taskOn startup each Archiving, Journaling, and Public Folder task tries to communicate with the Exchange Server to see if the Exchange Directory Service exists. If it does then the task assumes it is communicating with Exchange Server 5.5, otherwise it assumes Exchange Server 2000. This article may be relevant http://support.microsoft.com/default.aspx?scid=kb;en-us;q323790
3079Startup failure: cannot determine Exchange Server versionCheck that Microsoft Exchange is still installed on the Exchange Server specified in the error message.
3080Startup failure: Exchange Server version incorrect or unobtainableThis message may be logged if the Exchange Server version cannot be identified. It may be that Exchange Server is no longer installed on that computer.
3087Startup failure: Archiving, Journaling, or Public Folder taskCheck other events, which will have been logged in the Application event log at the same time, to find the root cause of the problem.
3116Startup failure: Archiving, Journaling, or Public Folder taskWhen each Archiving, Journaling, or Public Folder task starts it contacts the Windows Services control database for information. This message may be logged if this information could not be retrieved. Try restarting the task.
3144Startup failure: filterThis may be due to the filter settings being incorrect or a problem with the filter itself.
3150Too many filter errors: shutting downContact provider of the external filter for assistance with troubleshooting this issue.
3235Active Directory error or Directory database errorThere may be a data integrity issue with the Enterpise Vault directory database. Contact your local Enterprise Vault support provider for further assistance.
4110Startup success: Admin ServiceWhen the Enterprise Vault Admin Service starts up it carries out a list of checks. This message is logged when the Admin Service's checks are complete.
4111Shutdown success: Admin ServiceThis message is logged when the Enterprise Vault Admin Service stops. This is a critical service, so when the Admin Service is stopped all other Enterprise Vault services on the system should already be stopped. If the Admin Service has stopped unexpectedly, look for other events logged by the Admin Service that should explain the reason for the controlled shut down.
4140Insufficient virtual memory: shutting downThe Enterprise Vault Admin Service continuously monitors free virtual memory. If more than 95% of virtual memory is used up, the Admin Service logs this message and shuts down all Enterprise Vault services to maintain system integrity. This message is common on new systems where virtual memory has not been tuned accordingly.
4141Insufficient disk space: shutting downEnterprise Vault monitors all local disks on the system for free disk space, regardless of whether they are currently used by Enterprise Vault. If any disk has more than 99% of its space consumed then Enterprise Vault Admin Service shuts down all Enterprise Vault services to protect the overall system integrity. See the Administration Console Help topic Modifying the Admin Service, which describes how to configure Enterprise Vault to monitor only specific disks.
4142Insufficient disk space: shutting downEnterprise Vault monitors all local disks on the system for free disk space, regardless of whether they are currently used by Enterprise Vault. If any disk has more than 99% of its space consumed then Enterprise Vault Admin Service shuts down all Enterprise Vault services to protect the overall system integrity. See the Administration Console Help topic Modifying the Admin Service, which describe how to configure Enterprise Vault to monitor only specific disks.
4143Insufficient disk space: shutting downEnterprise Vault monitors all local disks on the system for free disk space, regardless of whether they are currently used by Enterprise Vault. If any disk has more than 99% of its space consumed then Enterprise Vault Admin Service shuts down all Enterprise Vault services to protect the overall system integrity. See the Enterprise Vault Knowledge Base, or the Administration Console Help topic Modifying the Admin Service, which describe how to configure Enterprise Vault to monitor only specific disks.
4144Low virtual memory The Enterprise Vault Admin Service continually checks there is sufficient virtual memory on the Enterprise Vault server. This message is logged when the amount of free virtual memory is getting low. If free virtual memory continues to be reduced the Enterprise Vault Admin Service will stop all Enterprise Vault services to protect system integrity. Examine the virtual memory size on the server and increase it if necessary.
4145Low disk spaceSee Enterprise Vault Knowledge Base to learn how to control which disks should be monitored by the Enterprise Vault Admin Service.
4146Low disk spaceThe Enterprise Vault Admin Service continually monitors all disks on the Enterprise Vault server for free disk space.

Examine disks to determine how to make more disk space available. If necessary, see Administrator help topic Modifying the Admin Service to learn how to control which disks are monitored by the Admin Service.
4147Low disk spaceThe Enterprise Vault Admin Service continually monitors all disks on the Enterprise Vault server for free disk space.

Examine disks to determine how to make more disk space available. If necessary, see Administrator help topic Modifying the Admin Service to learn how to control which disks are monitored by the Admin Service.
4183Error rate is too high: shutting downEnterprise Vault monitors errors that have been logged. If too many Enterprise Vault errors have been logged in a given period of time then Enterprise Vault shuts down to protect the integrity of the system and so that the cause of the errors can be investigated.
5186Startup success: Shopping ServiceLogged when the Enterprise Vault Shopping Service starts up. The number at the end of the message identifies the version and build number of the Enterprise Vault server software on the system.
5187Shutdown success: Shopping ServiceLogged when the Enterprise Vault Shopping Service stops.
6221Startup success: Storage ServiceThis message is logged when the Enterprise Vault Storage service is started. The number at the end of the message identifies the version and build number of the Enterprise Vault server software on the system.
6222Shutdown success: Storage ServiceThis is logged when the Enterprise Vault Storage Service stops.
6517Storage Service error: shutting downThe Enterprise Vault Storage Service is implemented as a number of separate processes. These are all managed by the Storage Management process. When any process in the Storage Service fails it automatically restarts. If subsequent restarts of the Storage Management process fail then this message may be logged and, since this is a critical process, the Storage Service shuts down. Check other errors that may be logged at the same time for information on how to troubleshoot this issue further or contact your local Enterprise Vault support office.
6655Storage Service failed: no automatic restartThe Enterprise Vault Storage Service is comprised of a number of separate processes. If one of these processes terminates unexpectedly then the Storage Management process within the Storage Service restarts it. The process will be restarted a maximum of 10 times. If the process terminates again the Storage Management process assumes that there is a serious problem and it does not restart the process but instead logs this message. The problem can then be investigated and resolved. Other errors will be logged during this period and those should be investigated to find the root cause of the problem.
6681Storage Service failed: no automatic restartCheck the Application and System event logs on the server for other messages that may provide information about the root cause.
7168Startup success: Indexing ServiceThis is logged when an Enterprise Vault Indexing Service has started. The Enterprise Vault Indexing Service is responsible for dealing with search requests as well as adding and removing items from the Alta Vista indexes. The number at the end of the message identifies the version and build number of the Enterprise Vault server software on the system.
7169Shutdown success: Indexing ServiceThis message is logged when an Enterprise Vault Indexing Service stops. This service deals with searches and index maintenance, so when it is stopped Enterprise Vault searches fail and items cannot be added to or removed from the indexes.
7184Startup failure: Index Server processAn Index Server is a process created to deal with requests to an index. This message is logged if the Index Server process could not be started. If this failure happens repeatedly contact your local Enterprise Vault Support office.
7206Indexing Service requires manual restartThis may occur if there is an internal error in the Enterprise Vault Indexing Service. Stopping and restarting the service may resolve the issue. Contact your local Enterprise Vault support office for further assistance.
7207Indexing failureThis error may occur if there is an internal issue with the Enterprise Vault Indexing Service. Stopping and restarting the Enterprise Vault Indexing Service may resolve the issue. Contact your local Enterprise Vault support office for further assistance.
7243Cannot commit index data to diskThe index data could not be committed to disk. Possible causes are:

Disk space or quota has been exhausted on the index device
Permissions do not allow the service access to the index
The index device is not available
7252Vault index is fullThere are certain limitations on how large an index can get. Normally when an index reaches towards its limit, Enterprise Vault will start a new index. This message may be logged if the roll-over to this new index has not occurred. Contact your local Enterprise Vault Support office for futher assistance.
8192Startup success: Directory ServiceThis message is logged when the Enterprise Vault Directory Service starts. The Directory Service deals with many data requests between the Enterprise Vault components and the Directory Database. This is therefore a critical service and must be running in order for Enterprise Vault to function. The number at the end of the message is the version and build of the Enterprise Vault system.
8193Shutdown success: Directory ServiceThis message is logged when the Enterprise Vault Directory Service is stopped. The Directory Service deals with many data requests between the Enterprise Vault components and the Directory database. It should be stopped only when the other services have been stopped.
16385Startup success: SPS ServiceThis message is logged when the SharePoint Archive Service starts.
16386Shutdown success: SPS ServiceThis message is logged when the SharePoint Archive Service stops.
16397Unrecoverable error: shutting down SPS ServiceThis may be logged by the Enterprise Vault SharePoint Service when a serious error occurs. Try restarting the SharePoint Service. If problems continue, contact your local Enterprise Vault support provider.
16426Startup success: SPS Pruning ServiceThe SPS Pruning Service has started
16427Shutdown success: SPS Pruning ServiceThe SPS Pruning Service has stopped
20481Startup success: File Placeholder ServiceThe Enterprise Vault File Placeholder Service has started
20482Shutdown success: File Placeholder ServiceThe Enterprise Vault File Placeholder Service has stopped
20484Startup failure: File Placeholder ServiceContact your local Enterprise Vault support provider if this problem occurs.
2 REPLIES 2

Daniel_R_
Level 5
Partner Accredited
this is a great list, thank you very much

Lone-Wolf
Level 3
is this not what the MOM MP does?