Solved

Exchange 2013 CU3 Active Monitoring

Posted on 2014-04-07
4
1,355 Views
Last Modified: 2014-04-28
I have been looking into why disk space on the C:\ drive of a new install of Exchange 2013 CU3 has been disappearing quickly over the past few days and I have tracked it down to the Active Monitoring logs.

After clearing down the logs, over a period of 1hr some 20k of events have been logged in the MonitorResult. 17k in the ResponderResult and 4k in the ProbeResult event logs

MonitorResult 21,824
ResponderResult 17,626
ProbeResult 3,975

I've changed the maximum log size to prevent event logs from filling up the disk.

Should I really be seeing this many logs from Active Monitoring?

This is a single exchange environment with 60 mailboxes, so quite small.

MonitorResult Event Log
Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=Transport.PickupDelete.Monitor/HubTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701864</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13804" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721841</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.PickupDelete.Monitor/HubTransport</ResultName>
      <WorkItemId>175</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>56263003</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:55.7812202Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701863</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721842</ResultId>
      <ServiceName>MailboxTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport</ResultName>
      <WorkItemId>250</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15414059</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:44.9314302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/MailboxTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.092962600Z" />
    <EventRecordID>19701862</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="576" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721840</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL</ResultName>
      <WorkItemId>368</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>46268889</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.0929626Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.0929626Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:59.3023477Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/DAL/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701861</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721839</ResultId>
      <ServiceName>OAB</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool</ResultName>
      <WorkItemId>997</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>196528</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:17.4073577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/OAB/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701860</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721838</ResultId>
      <ServiceName>FrontendTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport</ResultName>
      <WorkItemId>863</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>21997134</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:21.4844527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FrontendTransport/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PowerShellHttpGenericErrorAboveThresholdMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701859</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721837</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellHttpGenericErrorAboveThresholdMonitor</ResultName>
      <WorkItemId>716</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>61211537</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.3395302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/EDS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701858</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721836</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter</ResultName>
      <WorkItemId>849</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>39615878</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:25.3691771Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MicrosoftFailedUpdatesMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701857</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="6888" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721835</ResultId>
      <ServiceName>FIPS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MicrosoftFailedUpdatesMonitor</ResultName>
      <WorkItemId>1128</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>38528027</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>1</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:26.9814802Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FIPS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.edgetransport/edgetransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701856</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721834</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.edgetransport/edgetransport</ResultName>
      <WorkItemId>665</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57948722</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.9460402Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701855</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721833</ResultId>
      <ServiceName>RWS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool</ResultName>
      <WorkItemId>1069</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2546121</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:41.5450827Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RWS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PrivateWorkingSetError.msftesql/msftesql)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.408141000Z" />
    <EventRecordID>19701854</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9820" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721832</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetError.msftesql/msftesql</ResultName>
      <WorkItemId>913</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>43278214</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.4081410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.4081410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:52.4043577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.sftracing/sftracing)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701853</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721831</ResultId>
      <ServiceName>ProcessIsolation</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.sftracing/sftracing</ResultName>
      <WorkItemId>963</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>27895592</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:47.3743177Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/ProcessIsolation/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701852</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721830</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service</ResultName>
      <WorkItemId>814</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19528379</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:12.3868027Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.UM.CallRouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701851</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721829</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.UM.CallRouter</ResultName>
      <WorkItemId>516</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57271167</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:33.3835302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701850</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721828</ResultId>
      <ServiceName>RPS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool</ResultName>
      <WorkItemId>1039</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50790330</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:35.5905527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RPS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.Psws)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701849</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721827</ResultId>
      <ServiceName>Psws</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.Psws</ResultName>
      <WorkItemId>1134</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>58151490</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-04-06T17:07:09.9592265Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>CustomerTouchPoints/Psws/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window



ResponderResult Event Log

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:53
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=LongRunningWatsonWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:53.295314200Z" />
    <EventRecordID>19958767</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978744</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWatsonWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1620</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50171293</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:53.2953142Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:53.2953142Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.265694400Z" />
    <EventRecordID>19958766</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978743</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13</ResultName>
      <WorkItemId>1035</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57956553</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.2656944Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.2656944Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.SendConnTLS.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958765</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978742</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.SendConnTLS.Responder/EXCH13</ResultName>
      <WorkItemId>953</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>34496034</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958764</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978741</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13</ResultName>
      <WorkItemId>810</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19416803</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportPickupReadEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958763</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978740</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportPickupReadEscalateResponder/EXCH13</ResultName>
      <WorkItemId>246</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29908235</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.TemplateDoesNotExist.EscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958762</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978739</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.TemplateDoesNotExist.EscalateResponder/EXCH13</ResultName>
      <WorkItemId>227</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>32186398</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=RegisterDnsHostRecordResponder)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.719683900Z" />
    <EventRecordID>19958761</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978738</ResultId>
      <ServiceName>Network</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>RegisterDnsHostRecordResponder</ResultName>
      <WorkItemId>355</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>6848905</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.7196839Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.7196839Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PrivateWorkingSetWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.438878500Z" />
    <EventRecordID>19958760</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978737</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1617</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4071895</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.4388785Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.4388785Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.847647900Z" />
    <EventRecordID>19958759</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978736</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.8476479Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.8476479Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.582442800Z" />
    <EventRecordID>19958758</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978735</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.5824428Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.5824428Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.488841000Z" />
    <EventRecordID>19958757</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978734</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.4888410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.4888410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=QueueExternalRetryEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.239236200Z" />
    <EventRecordID>19958756</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9336" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978733</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>QueueExternalRetryEscalateResponder/Transport</ResultName>
      <WorkItemId>1010</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15713438</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.2392362Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.2392362Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.835209200Z" />
    <EventRecordID>19958755</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8324" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978732</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.8352092Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.8352092Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.757207700Z" />
    <EventRecordID>19958754</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978731</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13</ResultName>
      <WorkItemId>1040</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>7991774</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.7572077Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.7572077Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=MaintenanceFailureEscalate.EWS.Protocol/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958753</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978730</ResultId>
      <ServiceName>EWS.Protocol</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureEscalate.EWS.Protocol/EXCH13</ResultName>
      <WorkItemId>827</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19620585</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=SubmissionQueueEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958752</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978729</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>SubmissionQueueEscalateResponder/Transport</ResultName>
      <WorkItemId>1019</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>55594938</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TotalMessageCountEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958751</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978728</ResultId>
      <ServiceName>Transport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TotalMessageCountEscalateResponder/EXCH13</ResultName>
      <WorkItemId>1027</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2356062</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportCategorizerJobAvailabilityEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958750</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978727</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportCategorizerJobAvailabilityEscalateResponder/EXCH13</ResultName>
      <WorkItemId>233</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>44918252</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958749</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978726</ResultId>
      <ServiceName>OWA</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13</ResultName>
      <WorkItemId>880</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4519884</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window

0
Comment
Question by:Tech Man
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 6

Expert Comment

by:Ryan Smith
ID: 39983413
Log files will fill up your drives quick.  60 people checking their emails every 1 minute and then exchange outputting all the checks it's doing.  I've seen directories have 200 gigs in a matter of days.  You have to be selective on what you want to log.
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39983482
How can I turn down the logging on Exchange 2013? It seems a bit excessive at present.
0
 
LVL 6

Accepted Solution

by:
Ryan Smith earned 500 total points
ID: 39983671
in powershell you can run this command

Set-Eventloglevel -Identity <ECIdParameter> -Level <Lowest | Low | Medium | High | Expert> [-Confirm [<SwitchParameter>]] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39992264
Is this applicable to 2013
0

Featured Post

[Webinar] How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read this checklist to learn more about the 15 things you should never include in an email signature.
If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question