Solved

Exchange 2013 CU3 Active Monitoring

Posted on 2014-04-07
4
1,280 Views
Last Modified: 2014-04-28
I have been looking into why disk space on the C:\ drive of a new install of Exchange 2013 CU3 has been disappearing quickly over the past few days and I have tracked it down to the Active Monitoring logs.

After clearing down the logs, over a period of 1hr some 20k of events have been logged in the MonitorResult. 17k in the ResponderResult and 4k in the ProbeResult event logs

MonitorResult 21,824
ResponderResult 17,626
ProbeResult 3,975

I've changed the maximum log size to prevent event logs from filling up the disk.

Should I really be seeing this many logs from Active Monitoring?

This is a single exchange environment with 60 mailboxes, so quite small.

MonitorResult Event Log
Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=Transport.PickupDelete.Monitor/HubTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701864</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13804" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721841</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.PickupDelete.Monitor/HubTransport</ResultName>
      <WorkItemId>175</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>56263003</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:55.7812202Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701863</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721842</ResultId>
      <ServiceName>MailboxTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport</ResultName>
      <WorkItemId>250</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15414059</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:44.9314302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/MailboxTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.092962600Z" />
    <EventRecordID>19701862</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="576" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721840</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL</ResultName>
      <WorkItemId>368</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>46268889</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.0929626Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.0929626Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:59.3023477Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/DAL/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701861</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721839</ResultId>
      <ServiceName>OAB</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool</ResultName>
      <WorkItemId>997</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>196528</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:17.4073577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/OAB/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701860</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721838</ResultId>
      <ServiceName>FrontendTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport</ResultName>
      <WorkItemId>863</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>21997134</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:21.4844527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FrontendTransport/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PowerShellHttpGenericErrorAboveThresholdMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701859</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721837</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellHttpGenericErrorAboveThresholdMonitor</ResultName>
      <WorkItemId>716</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>61211537</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.3395302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/EDS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701858</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721836</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter</ResultName>
      <WorkItemId>849</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>39615878</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:25.3691771Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MicrosoftFailedUpdatesMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701857</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="6888" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721835</ResultId>
      <ServiceName>FIPS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MicrosoftFailedUpdatesMonitor</ResultName>
      <WorkItemId>1128</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>38528027</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>1</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:26.9814802Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FIPS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.edgetransport/edgetransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701856</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721834</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.edgetransport/edgetransport</ResultName>
      <WorkItemId>665</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57948722</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.9460402Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701855</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721833</ResultId>
      <ServiceName>RWS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool</ResultName>
      <WorkItemId>1069</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2546121</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:41.5450827Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RWS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PrivateWorkingSetError.msftesql/msftesql)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.408141000Z" />
    <EventRecordID>19701854</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9820" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721832</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetError.msftesql/msftesql</ResultName>
      <WorkItemId>913</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>43278214</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.4081410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.4081410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:52.4043577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.sftracing/sftracing)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701853</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721831</ResultId>
      <ServiceName>ProcessIsolation</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.sftracing/sftracing</ResultName>
      <WorkItemId>963</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>27895592</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:47.3743177Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/ProcessIsolation/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701852</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721830</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service</ResultName>
      <WorkItemId>814</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19528379</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:12.3868027Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.UM.CallRouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701851</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721829</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.UM.CallRouter</ResultName>
      <WorkItemId>516</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57271167</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:33.3835302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701850</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721828</ResultId>
      <ServiceName>RPS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool</ResultName>
      <WorkItemId>1039</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50790330</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:35.5905527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RPS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.Psws)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701849</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721827</ResultId>
      <ServiceName>Psws</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.Psws</ResultName>
      <WorkItemId>1134</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>58151490</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-04-06T17:07:09.9592265Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>CustomerTouchPoints/Psws/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window



ResponderResult Event Log

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:53
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=LongRunningWatsonWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:53.295314200Z" />
    <EventRecordID>19958767</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978744</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWatsonWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1620</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50171293</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:53.2953142Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:53.2953142Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.265694400Z" />
    <EventRecordID>19958766</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978743</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13</ResultName>
      <WorkItemId>1035</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57956553</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.2656944Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.2656944Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.SendConnTLS.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958765</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978742</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.SendConnTLS.Responder/EXCH13</ResultName>
      <WorkItemId>953</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>34496034</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958764</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978741</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13</ResultName>
      <WorkItemId>810</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19416803</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportPickupReadEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958763</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978740</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportPickupReadEscalateResponder/EXCH13</ResultName>
      <WorkItemId>246</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29908235</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.TemplateDoesNotExist.EscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958762</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978739</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.TemplateDoesNotExist.EscalateResponder/EXCH13</ResultName>
      <WorkItemId>227</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>32186398</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=RegisterDnsHostRecordResponder)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.719683900Z" />
    <EventRecordID>19958761</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978738</ResultId>
      <ServiceName>Network</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>RegisterDnsHostRecordResponder</ResultName>
      <WorkItemId>355</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>6848905</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.7196839Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.7196839Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PrivateWorkingSetWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.438878500Z" />
    <EventRecordID>19958760</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978737</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1617</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4071895</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.4388785Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.4388785Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.847647900Z" />
    <EventRecordID>19958759</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978736</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.8476479Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.8476479Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.582442800Z" />
    <EventRecordID>19958758</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978735</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.5824428Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.5824428Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.488841000Z" />
    <EventRecordID>19958757</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978734</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.4888410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.4888410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=QueueExternalRetryEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.239236200Z" />
    <EventRecordID>19958756</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9336" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978733</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>QueueExternalRetryEscalateResponder/Transport</ResultName>
      <WorkItemId>1010</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15713438</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.2392362Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.2392362Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.835209200Z" />
    <EventRecordID>19958755</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8324" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978732</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.8352092Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.8352092Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.757207700Z" />
    <EventRecordID>19958754</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978731</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13</ResultName>
      <WorkItemId>1040</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>7991774</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.7572077Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.7572077Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=MaintenanceFailureEscalate.EWS.Protocol/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958753</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978730</ResultId>
      <ServiceName>EWS.Protocol</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureEscalate.EWS.Protocol/EXCH13</ResultName>
      <WorkItemId>827</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19620585</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=SubmissionQueueEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958752</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978729</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>SubmissionQueueEscalateResponder/Transport</ResultName>
      <WorkItemId>1019</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>55594938</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TotalMessageCountEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958751</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978728</ResultId>
      <ServiceName>Transport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TotalMessageCountEscalateResponder/EXCH13</ResultName>
      <WorkItemId>1027</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2356062</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportCategorizerJobAvailabilityEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958750</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978727</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportCategorizerJobAvailabilityEscalateResponder/EXCH13</ResultName>
      <WorkItemId>233</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>44918252</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958749</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978726</ResultId>
      <ServiceName>OWA</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13</ResultName>
      <WorkItemId>880</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4519884</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window

0
Comment
Question by:Tech Man
  • 2
  • 2
4 Comments
 
LVL 6

Expert Comment

by:Ryan Smith
ID: 39983413
Log files will fill up your drives quick.  60 people checking their emails every 1 minute and then exchange outputting all the checks it's doing.  I've seen directories have 200 gigs in a matter of days.  You have to be selective on what you want to log.
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39983482
How can I turn down the logging on Exchange 2013? It seems a bit excessive at present.
0
 
LVL 6

Accepted Solution

by:
Ryan Smith earned 500 total points
ID: 39983671
in powershell you can run this command

Set-Eventloglevel -Identity <ECIdParameter> -Level <Lowest | Low | Medium | High | Expert> [-Confirm [<SwitchParameter>]] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39992264
Is this applicable to 2013
0

Featured Post

Are end users causing IT problems again?

You’ve taken the time to design and update all your end user’s email signatures, only to find out they’re messing up the HTML, changing the font and ruining the imagery. What can you do to prevent this? Find out how you can save your signatures from end users today.

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now