Solved

Exchange 2013 CU3 Active Monitoring

Posted on 2014-04-07
4
1,294 Views
Last Modified: 2014-04-28
I have been looking into why disk space on the C:\ drive of a new install of Exchange 2013 CU3 has been disappearing quickly over the past few days and I have tracked it down to the Active Monitoring logs.

After clearing down the logs, over a period of 1hr some 20k of events have been logged in the MonitorResult. 17k in the ResponderResult and 4k in the ProbeResult event logs

MonitorResult 21,824
ResponderResult 17,626
ProbeResult 3,975

I've changed the maximum log size to prevent event logs from filling up the disk.

Should I really be seeing this many logs from Active Monitoring?

This is a single exchange environment with 60 mailboxes, so quite small.

MonitorResult Event Log
Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=Transport.PickupDelete.Monitor/HubTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701864</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13804" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721841</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.PickupDelete.Monitor/HubTransport</ResultName>
      <WorkItemId>175</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>56263003</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:55.7812202Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701863</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721842</ResultId>
      <ServiceName>MailboxTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport</ResultName>
      <WorkItemId>250</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15414059</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:44.9314302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/MailboxTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.092962600Z" />
    <EventRecordID>19701862</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="576" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721840</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL</ResultName>
      <WorkItemId>368</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>46268889</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.0929626Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.0929626Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:59.3023477Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/DAL/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701861</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721839</ResultId>
      <ServiceName>OAB</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool</ResultName>
      <WorkItemId>997</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>196528</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:17.4073577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/OAB/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701860</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721838</ResultId>
      <ServiceName>FrontendTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport</ResultName>
      <WorkItemId>863</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>21997134</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:21.4844527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FrontendTransport/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PowerShellHttpGenericErrorAboveThresholdMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701859</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721837</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellHttpGenericErrorAboveThresholdMonitor</ResultName>
      <WorkItemId>716</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>61211537</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.3395302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/EDS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701858</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721836</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter</ResultName>
      <WorkItemId>849</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>39615878</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:25.3691771Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MicrosoftFailedUpdatesMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701857</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="6888" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721835</ResultId>
      <ServiceName>FIPS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MicrosoftFailedUpdatesMonitor</ResultName>
      <WorkItemId>1128</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>38528027</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>1</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:26.9814802Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FIPS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.edgetransport/edgetransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701856</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721834</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.edgetransport/edgetransport</ResultName>
      <WorkItemId>665</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57948722</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.9460402Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701855</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721833</ResultId>
      <ServiceName>RWS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool</ResultName>
      <WorkItemId>1069</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2546121</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:41.5450827Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RWS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PrivateWorkingSetError.msftesql/msftesql)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.408141000Z" />
    <EventRecordID>19701854</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9820" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721832</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetError.msftesql/msftesql</ResultName>
      <WorkItemId>913</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>43278214</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.4081410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.4081410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:52.4043577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.sftracing/sftracing)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701853</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721831</ResultId>
      <ServiceName>ProcessIsolation</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.sftracing/sftracing</ResultName>
      <WorkItemId>963</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>27895592</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:47.3743177Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/ProcessIsolation/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701852</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721830</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service</ResultName>
      <WorkItemId>814</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19528379</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:12.3868027Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.UM.CallRouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701851</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721829</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.UM.CallRouter</ResultName>
      <WorkItemId>516</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57271167</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:33.3835302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701850</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721828</ResultId>
      <ServiceName>RPS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool</ResultName>
      <WorkItemId>1039</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50790330</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:35.5905527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RPS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.Psws)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701849</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721827</ResultId>
      <ServiceName>Psws</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.Psws</ResultName>
      <WorkItemId>1134</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>58151490</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-04-06T17:07:09.9592265Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>CustomerTouchPoints/Psws/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window



ResponderResult Event Log

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:53
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=LongRunningWatsonWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:53.295314200Z" />
    <EventRecordID>19958767</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978744</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWatsonWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1620</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50171293</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:53.2953142Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:53.2953142Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.265694400Z" />
    <EventRecordID>19958766</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978743</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13</ResultName>
      <WorkItemId>1035</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57956553</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.2656944Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.2656944Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.SendConnTLS.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958765</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978742</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.SendConnTLS.Responder/EXCH13</ResultName>
      <WorkItemId>953</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>34496034</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958764</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978741</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13</ResultName>
      <WorkItemId>810</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19416803</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportPickupReadEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958763</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978740</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportPickupReadEscalateResponder/EXCH13</ResultName>
      <WorkItemId>246</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29908235</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.TemplateDoesNotExist.EscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958762</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978739</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.TemplateDoesNotExist.EscalateResponder/EXCH13</ResultName>
      <WorkItemId>227</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>32186398</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=RegisterDnsHostRecordResponder)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.719683900Z" />
    <EventRecordID>19958761</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978738</ResultId>
      <ServiceName>Network</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>RegisterDnsHostRecordResponder</ResultName>
      <WorkItemId>355</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>6848905</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.7196839Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.7196839Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PrivateWorkingSetWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.438878500Z" />
    <EventRecordID>19958760</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978737</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1617</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4071895</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.4388785Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.4388785Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.847647900Z" />
    <EventRecordID>19958759</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978736</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.8476479Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.8476479Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.582442800Z" />
    <EventRecordID>19958758</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978735</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.5824428Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.5824428Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.488841000Z" />
    <EventRecordID>19958757</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978734</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.4888410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.4888410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=QueueExternalRetryEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.239236200Z" />
    <EventRecordID>19958756</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9336" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978733</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>QueueExternalRetryEscalateResponder/Transport</ResultName>
      <WorkItemId>1010</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15713438</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.2392362Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.2392362Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.835209200Z" />
    <EventRecordID>19958755</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8324" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978732</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.8352092Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.8352092Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.757207700Z" />
    <EventRecordID>19958754</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978731</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13</ResultName>
      <WorkItemId>1040</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>7991774</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.7572077Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.7572077Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=MaintenanceFailureEscalate.EWS.Protocol/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958753</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978730</ResultId>
      <ServiceName>EWS.Protocol</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureEscalate.EWS.Protocol/EXCH13</ResultName>
      <WorkItemId>827</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19620585</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=SubmissionQueueEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958752</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978729</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>SubmissionQueueEscalateResponder/Transport</ResultName>
      <WorkItemId>1019</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>55594938</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TotalMessageCountEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958751</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978728</ResultId>
      <ServiceName>Transport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TotalMessageCountEscalateResponder/EXCH13</ResultName>
      <WorkItemId>1027</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2356062</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportCategorizerJobAvailabilityEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958750</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978727</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportCategorizerJobAvailabilityEscalateResponder/EXCH13</ResultName>
      <WorkItemId>233</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>44918252</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958749</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978726</ResultId>
      <ServiceName>OWA</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13</ResultName>
      <WorkItemId>880</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4519884</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window

0
Comment
Question by:Tech Man
  • 2
  • 2
4 Comments
 
LVL 6

Expert Comment

by:Ryan Smith
ID: 39983413
Log files will fill up your drives quick.  60 people checking their emails every 1 minute and then exchange outputting all the checks it's doing.  I've seen directories have 200 gigs in a matter of days.  You have to be selective on what you want to log.
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39983482
How can I turn down the logging on Exchange 2013? It seems a bit excessive at present.
0
 
LVL 6

Accepted Solution

by:
Ryan Smith earned 500 total points
ID: 39983671
in powershell you can run this command

Set-Eventloglevel -Identity <ECIdParameter> -Level <Lowest | Low | Medium | High | Expert> [-Confirm [<SwitchParameter>]] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39992264
Is this applicable to 2013
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
how to add IIS SMTP to handle application/Scanner relays into office 365.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

28 Experts available now in Live!

Get 1:1 Help Now