Solved

Exchange 2013 CU3 Active Monitoring

Posted on 2014-04-07
4
1,307 Views
Last Modified: 2014-04-28
I have been looking into why disk space on the C:\ drive of a new install of Exchange 2013 CU3 has been disappearing quickly over the past few days and I have tracked it down to the Active Monitoring logs.

After clearing down the logs, over a period of 1hr some 20k of events have been logged in the MonitorResult. 17k in the ResponderResult and 4k in the ProbeResult event logs

MonitorResult 21,824
ResponderResult 17,626
ProbeResult 3,975

I've changed the maximum log size to prevent event logs from filling up the disk.

Should I really be seeing this many logs from Active Monitoring?

This is a single exchange environment with 60 mailboxes, so quite small.

MonitorResult Event Log
Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=Transport.PickupDelete.Monitor/HubTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701864</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13804" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721841</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.PickupDelete.Monitor/HubTransport</ResultName>
      <WorkItemId>175</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>56263003</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:55.7812202Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701863</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721842</ResultId>
      <ServiceName>MailboxTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport</ResultName>
      <WorkItemId>250</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15414059</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:44.9314302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/MailboxTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.092962600Z" />
    <EventRecordID>19701862</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="576" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721840</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL</ResultName>
      <WorkItemId>368</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>46268889</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.0929626Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.0929626Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:59.3023477Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/DAL/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701861</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721839</ResultId>
      <ServiceName>OAB</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool</ResultName>
      <WorkItemId>997</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>196528</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:17.4073577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/OAB/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701860</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721838</ResultId>
      <ServiceName>FrontendTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport</ResultName>
      <WorkItemId>863</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>21997134</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:21.4844527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FrontendTransport/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PowerShellHttpGenericErrorAboveThresholdMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701859</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721837</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellHttpGenericErrorAboveThresholdMonitor</ResultName>
      <WorkItemId>716</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>61211537</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.3395302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/EDS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701858</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721836</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter</ResultName>
      <WorkItemId>849</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>39615878</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:25.3691771Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MicrosoftFailedUpdatesMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701857</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="6888" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721835</ResultId>
      <ServiceName>FIPS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MicrosoftFailedUpdatesMonitor</ResultName>
      <WorkItemId>1128</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>38528027</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>1</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:26.9814802Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FIPS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.edgetransport/edgetransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701856</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721834</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.edgetransport/edgetransport</ResultName>
      <WorkItemId>665</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57948722</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.9460402Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701855</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721833</ResultId>
      <ServiceName>RWS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool</ResultName>
      <WorkItemId>1069</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2546121</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:41.5450827Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RWS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PrivateWorkingSetError.msftesql/msftesql)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.408141000Z" />
    <EventRecordID>19701854</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9820" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721832</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetError.msftesql/msftesql</ResultName>
      <WorkItemId>913</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>43278214</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.4081410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.4081410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:52.4043577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.sftracing/sftracing)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701853</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721831</ResultId>
      <ServiceName>ProcessIsolation</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.sftracing/sftracing</ResultName>
      <WorkItemId>963</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>27895592</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:47.3743177Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/ProcessIsolation/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701852</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721830</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service</ResultName>
      <WorkItemId>814</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19528379</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:12.3868027Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.UM.CallRouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701851</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721829</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.UM.CallRouter</ResultName>
      <WorkItemId>516</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57271167</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:33.3835302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701850</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721828</ResultId>
      <ServiceName>RPS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool</ResultName>
      <WorkItemId>1039</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50790330</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:35.5905527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RPS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.Psws)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701849</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721827</ResultId>
      <ServiceName>Psws</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.Psws</ResultName>
      <WorkItemId>1134</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>58151490</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-04-06T17:07:09.9592265Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>CustomerTouchPoints/Psws/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window



ResponderResult Event Log

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:53
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=LongRunningWatsonWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:53.295314200Z" />
    <EventRecordID>19958767</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978744</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWatsonWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1620</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50171293</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:53.2953142Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:53.2953142Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.265694400Z" />
    <EventRecordID>19958766</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978743</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13</ResultName>
      <WorkItemId>1035</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57956553</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.2656944Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.2656944Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.SendConnTLS.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958765</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978742</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.SendConnTLS.Responder/EXCH13</ResultName>
      <WorkItemId>953</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>34496034</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958764</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978741</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13</ResultName>
      <WorkItemId>810</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19416803</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportPickupReadEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958763</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978740</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportPickupReadEscalateResponder/EXCH13</ResultName>
      <WorkItemId>246</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29908235</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.TemplateDoesNotExist.EscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958762</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978739</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.TemplateDoesNotExist.EscalateResponder/EXCH13</ResultName>
      <WorkItemId>227</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>32186398</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=RegisterDnsHostRecordResponder)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.719683900Z" />
    <EventRecordID>19958761</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978738</ResultId>
      <ServiceName>Network</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>RegisterDnsHostRecordResponder</ResultName>
      <WorkItemId>355</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>6848905</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.7196839Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.7196839Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PrivateWorkingSetWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.438878500Z" />
    <EventRecordID>19958760</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978737</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1617</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4071895</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.4388785Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.4388785Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.847647900Z" />
    <EventRecordID>19958759</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978736</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.8476479Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.8476479Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.582442800Z" />
    <EventRecordID>19958758</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978735</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.5824428Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.5824428Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.488841000Z" />
    <EventRecordID>19958757</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978734</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.4888410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.4888410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=QueueExternalRetryEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.239236200Z" />
    <EventRecordID>19958756</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9336" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978733</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>QueueExternalRetryEscalateResponder/Transport</ResultName>
      <WorkItemId>1010</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15713438</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.2392362Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.2392362Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.835209200Z" />
    <EventRecordID>19958755</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8324" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978732</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.8352092Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.8352092Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.757207700Z" />
    <EventRecordID>19958754</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978731</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13</ResultName>
      <WorkItemId>1040</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>7991774</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.7572077Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.7572077Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=MaintenanceFailureEscalate.EWS.Protocol/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958753</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978730</ResultId>
      <ServiceName>EWS.Protocol</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureEscalate.EWS.Protocol/EXCH13</ResultName>
      <WorkItemId>827</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19620585</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=SubmissionQueueEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958752</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978729</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>SubmissionQueueEscalateResponder/Transport</ResultName>
      <WorkItemId>1019</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>55594938</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TotalMessageCountEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958751</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978728</ResultId>
      <ServiceName>Transport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TotalMessageCountEscalateResponder/EXCH13</ResultName>
      <WorkItemId>1027</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2356062</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportCategorizerJobAvailabilityEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958750</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978727</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportCategorizerJobAvailabilityEscalateResponder/EXCH13</ResultName>
      <WorkItemId>233</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>44918252</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958749</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978726</ResultId>
      <ServiceName>OWA</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13</ResultName>
      <WorkItemId>880</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4519884</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window

0
Comment
Question by:Tech Man
  • 2
  • 2
4 Comments
 
LVL 6

Expert Comment

by:Ryan Smith
ID: 39983413
Log files will fill up your drives quick.  60 people checking their emails every 1 minute and then exchange outputting all the checks it's doing.  I've seen directories have 200 gigs in a matter of days.  You have to be selective on what you want to log.
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39983482
How can I turn down the logging on Exchange 2013? It seems a bit excessive at present.
0
 
LVL 6

Accepted Solution

by:
Ryan Smith earned 500 total points
ID: 39983671
in powershell you can run this command

Set-Eventloglevel -Identity <ECIdParameter> -Level <Lowest | Low | Medium | High | Expert> [-Confirm [<SwitchParameter>]] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39992264
Is this applicable to 2013
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data‚Ķ
how to add IIS SMTP to handle application/Scanner relays into office 365.

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question