?
Solved

Exchange 2013 CU3 Active Monitoring

Posted on 2014-04-07
4
Medium Priority
?
1,427 Views
Last Modified: 2014-04-28
I have been looking into why disk space on the C:\ drive of a new install of Exchange 2013 CU3 has been disappearing quickly over the past few days and I have tracked it down to the Active Monitoring logs.

After clearing down the logs, over a period of 1hr some 20k of events have been logged in the MonitorResult. 17k in the ResponderResult and 4k in the ProbeResult event logs

MonitorResult 21,824
ResponderResult 17,626
ProbeResult 3,975

I've changed the maximum log size to prevent event logs from filling up the disk.

Should I really be seeing this many logs from Active Monitoring?

This is a single exchange environment with 60 mailboxes, so quite small.

MonitorResult Event Log
Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=Transport.PickupDelete.Monitor/HubTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701864</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13804" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721841</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.PickupDelete.Monitor/HubTransport</ResultName>
      <WorkItemId>175</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>56263003</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:55.7812202Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.560968600Z" />
    <EventRecordID>19701863</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721842</ResultId>
      <ServiceName>MailboxTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MailboxTransportDeliveryServiceStartFailureMonitor/MailboxTransport</ResultName>
      <WorkItemId>250</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15414059</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.5609686Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.5609686Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:44.9314302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/MailboxTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:37
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:37.092962600Z" />
    <EventRecordID>19701862</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="576" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721840</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Kes.Monitor/DAL</ResultName>
      <WorkItemId>368</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>46268889</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:37.0929626Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:37.0929626Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:59.3023477Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/DAL/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701861</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721839</ResultId>
      <ServiceName>OAB</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.msexchangeoabapppool/msexchangeoabapppool</ResultName>
      <WorkItemId>997</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>196528</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:17.4073577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/OAB/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701860</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721838</ResultId>
      <ServiceName>FrontendTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning....angefrontendtransport/msexchangefrontendtransport</ResultName>
      <WorkItemId>863</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>21997134</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:21.4844527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FrontendTransport/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PowerShellHttpGenericErrorAboveThresholdMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701859</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721837</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellHttpGenericErrorAboveThresholdMonitor</ResultName>
      <WorkItemId>716</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>61211537</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.3395302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/EDS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701858</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721836</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWerMgrWarning.M.E.um.callrouter/microsoft.exchange.um.callrouter</ResultName>
      <WorkItemId>849</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>39615878</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:25.3691771Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MicrosoftFailedUpdatesMonitor)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701857</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="6888" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721835</ResultId>
      <ServiceName>FIPS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MicrosoftFailedUpdatesMonitor</ResultName>
      <WorkItemId>1128</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>38528027</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>1</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:26.9814802Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/FIPS/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.edgetransport/edgetransport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701856</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721834</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.edgetransport/edgetransport</ResultName>
      <WorkItemId>665</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57948722</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:56:00.9460402Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/HubTransport/High</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.876147000Z" />
    <EventRecordID>19701855</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721833</ResultId>
      <ServiceName>RWS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError....rtingwebserviceapppool/msexchangereportingwebserviceapppool</ResultName>
      <WorkItemId>1069</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2546121</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.8761470Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.8761470Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:41.5450827Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RWS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:35
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=PrivateWorkingSetError.msftesql/msftesql)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:35.408141000Z" />
    <EventRecordID>19701854</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9820" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721832</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetError.msftesql/msftesql</ResultName>
      <WorkItemId>913</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>43278214</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:35.4081410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:35.4081410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:52.4043577Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning.sftracing/sftracing)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701853</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721831</ResultId>
      <ServiceName>ProcessIsolation</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning.sftracing/sftracing</ResultName>
      <WorkItemId>963</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>27895592</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:51:47.3743177Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/ProcessIsolation/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701852</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721830</ResultId>
      <ServiceName>Search</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ExchangeCrashEventError.M.E.search.service/microsoft.exchange.search.service</ResultName>
      <WorkItemId>814</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19528379</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:53:12.3868027Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/Search/Normal</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.UM.CallRouter)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701851</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="2444" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721829</ResultId>
      <ServiceName>UM.CallRouter</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.UM.CallRouter</ResultName>
      <WorkItemId>516</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57271167</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:33.3835302Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/UM.CallRouter/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701850</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10968" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721828</ResultId>
      <ServiceName>RPS.Proxy</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>ProcessProcessorTimeWarning....eidfrontendapppool/msexchangepowershellliveidfrontendapppool</ResultName>
      <WorkItemId>1039</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50790330</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>100</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>100</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-03-24T15:55:35.5905527Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>ServiceComponents/RPS.Proxy/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/MonitorResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:22:34
Event ID:      3
Task Category: Monitor result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Monitor result (Name=MaintenanceFailureMonitor.Psws)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:22:34.565730200Z" />
    <EventRecordID>19701849</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="1036" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/MonitorResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19721827</ResultId>
      <ServiceName>Psws</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureMonitor.Psws</ResultName>
      <WorkItemId>1134</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>
      </StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>
      </StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>58151490</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:22:34.5657302Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:22:34.5657302Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsAlert>0</IsAlert>
      <TotalValue>0</TotalValue>
      <TotalSampleCount>0</TotalSampleCount>
      <TotalFailedCount>0</TotalFailedCount>
      <NewValue>0</NewValue>
      <NewSampleCount>0</NewSampleCount>
      <NewFailedCount>0</NewFailedCount>
      <LastFailedProbeId>-1</LastFailedProbeId>
      <LastFailedProbeResultId>-1</LastFailedProbeResultId>
      <HealthState>1</HealthState>
      <HealthStateTransitionId>-1</HealthStateTransitionId>
      <HealthStateChangedTime>2014-04-06T17:07:09.9592265Z</HealthStateChangedTime>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <FirstInsufficientSamplesObservedTime>[null]</FirstInsufficientSamplesObservedTime>
      <NewStateAttribute1Value>[null]</NewStateAttribute1Value>
      <NewStateAttribute1Count>0</NewStateAttribute1Count>
      <NewStateAttribute1Percent>0</NewStateAttribute1Percent>
      <TotalStateAttribute1Value>[null]</TotalStateAttribute1Value>
      <TotalStateAttribute1Count>0</TotalStateAttribute1Count>
      <TotalStateAttribute1Percent>0</TotalStateAttribute1Percent>
      <NewFailureCategoryValue>0</NewFailureCategoryValue>
      <NewFailureCategoryCount>0</NewFailureCategoryCount>
      <NewFailureCategoryPercent>0</NewFailureCategoryPercent>
      <TotalFailureCategoryValue>0</TotalFailureCategoryValue>
      <TotalFailureCategoryCount>0</TotalFailureCategoryCount>
      <TotalFailureCategoryPercent>0</TotalFailureCategoryPercent>
      <ComponentName>CustomerTouchPoints/Psws/Low</ComponentName>
      <IsHaImpacting>0</IsHaImpacting>
      <SourceScope>[null]</SourceScope>
      <TargetScopes>[null]</TargetScopes>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window



ResponderResult Event Log

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:53
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=LongRunningWatsonWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:53.295314200Z" />
    <EventRecordID>19958767</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978744</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>LongRunningWatsonWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1620</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>50171293</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:53.2953142Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:53.2953142Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.265694400Z" />
    <EventRecordID>19958766</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="12692" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978743</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.UnhandledException.Directory.Responder/EXCH13</ResultName>
      <WorkItemId>1035</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>57956553</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.2656944Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.2656944Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.SendConnTLS.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958765</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978742</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.SendConnTLS.Responder/EXCH13</ResultName>
      <WorkItemId>953</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>34496034</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958764</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978741</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>XProxyToCommandInvalidEncodedCertificateSubjectEscalateResponder/EXCH13</ResultName>
      <WorkItemId>810</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19416803</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportPickupReadEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958763</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978740</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportPickupReadEscalateResponder/EXCH13</ResultName>
      <WorkItemId>246</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29908235</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:52
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=Transport.TemplateDoesNotExist.EscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:52.000489300Z" />
    <EventRecordID>19958762</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978739</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>Transport.TemplateDoesNotExist.EscalateResponder/EXCH13</ResultName>
      <WorkItemId>227</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>32186398</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:52.0004893Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:52.0004893Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=RegisterDnsHostRecordResponder)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.719683900Z" />
    <EventRecordID>19958761</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="10204" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978738</ResultId>
      <ServiceName>Network</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>RegisterDnsHostRecordResponder</ResultName>
      <WorkItemId>355</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>6848905</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.7196839Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.7196839Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:51
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PrivateWorkingSetWarning.werfaultKillProcess)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:51.438878500Z" />
    <EventRecordID>19958760</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14044" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978737</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PrivateWorkingSetWarning.werfaultKillProcess</ResultName>
      <WorkItemId>1617</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4071895</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:51.4388785Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:51.4388785Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.847647900Z" />
    <EventRecordID>19958759</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="13940" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978736</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.8476479Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.8476479Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.582442800Z" />
    <EventRecordID>19958758</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978735</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.5824428Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.5824428Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.488841000Z" />
    <EventRecordID>19958757</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978734</ResultId>
      <ServiceName>EDS</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>PowerShellLiveIDAuthzErrorAboveThresholdEscalation/EXCH13</ResultName>
      <WorkItemId>1055</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>29899716</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.4888410Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.4888410Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:49
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=QueueExternalRetryEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:49.239236200Z" />
    <EventRecordID>19958756</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="9336" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978733</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>QueueExternalRetryEscalateResponder/Transport</ResultName>
      <WorkItemId>1010</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>15713438</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:49.2392362Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:49.2392362Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportBackpressureCyclingEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.835209200Z" />
    <EventRecordID>19958755</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8324" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978732</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportBackpressureCyclingEscalateResponder/EXCH13</ResultName>
      <WorkItemId>936</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>12341818</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.8352092Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.8352092Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.757207700Z" />
    <EventRecordID>19958754</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="16272" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978731</ResultId>
      <ServiceName>DAL</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>FfoWebServiceDataProvider.MaxRetry.Reporting.Responder/EXCH13</ResultName>
      <WorkItemId>1040</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>7991774</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.7572077Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.7572077Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=MaintenanceFailureEscalate.EWS.Protocol/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958753</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978730</ResultId>
      <ServiceName>EWS.Protocol</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>MaintenanceFailureEscalate.EWS.Protocol/EXCH13</ResultName>
      <WorkItemId>827</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>19620585</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:47
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=SubmissionQueueEscalateResponder/Transport)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:47.289198700Z" />
    <EventRecordID>19958752</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="4536" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978729</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>SubmissionQueueEscalateResponder/Transport</ResultName>
      <WorkItemId>1019</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>55594938</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:47.2891987Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:47.2891987Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TotalMessageCountEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958751</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978728</ResultId>
      <ServiceName>Transport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TotalMessageCountEscalateResponder/EXCH13</ResultName>
      <WorkItemId>1027</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>2356062</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=TransportCategorizerJobAvailabilityEscalateResponder/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958750</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="14588" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978727</ResultId>
      <ServiceName>HubTransport</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>TransportCategorizerJobAvailabilityEscalateResponder/EXCH13</ResultName>
      <WorkItemId>233</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>44918252</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>Defer</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>1</RecoveryResult>
      <IsRecoveryAttempted>1</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Log Name:      Microsoft-Exchange-ActiveMonitoring/ResponderResult
Source:        Microsoft-Exchange-ActiveMonitoring
Date:          07/04/2014 15:26:46
Event ID:      4
Task Category: Responder result
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      EXCH13.doma.domain.com
Description:
Responder result (Name=GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Exchange-ActiveMonitoring" Guid="{ECD64F52-A3BC-47B8-B681-A11B7A1C8770}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x200000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-07T14:26:46.821189700Z" />
    <EventRecordID>19958749</EventRecordID>
    <Correlation />
    <Execution ProcessID="3088" ThreadID="8372" />
    <Channel>Microsoft-Exchange-ActiveMonitoring/ResponderResult</Channel>
    <Computer>EXCH13.doma.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="myNs">
      <ResultId>19978726</ResultId>
      <ServiceName>OWA</ServiceName>
      <IsNotified>0</IsNotified>
      <ResultName>GetExtensibilityContext_ExtLoadApps_ExceptionReachedThresholdEscalate/EXCH13</ResultName>
      <WorkItemId>880</WorkItemId>
      <DeploymentId>0</DeploymentId>
      <MachineName>EXCH13</MachineName>
      <Error>[null]</Error>
      <Exception>[null]</Exception>
      <RetryCount>0</RetryCount>
      <StateAttribute1>[null]</StateAttribute1>
      <StateAttribute2>[null]</StateAttribute2>
      <StateAttribute3>[null]</StateAttribute3>
      <StateAttribute4>[null]</StateAttribute4>
      <StateAttribute5>[null]</StateAttribute5>
      <StateAttribute6>0</StateAttribute6>
      <StateAttribute7>0</StateAttribute7>
      <StateAttribute8>0</StateAttribute8>
      <StateAttribute9>0</StateAttribute9>
      <StateAttribute10>0</StateAttribute10>
      <ResultType>3</ResultType>
      <ExecutionId>4519884</ExecutionId>
      <ExecutionStartTime>2014-04-07T14:26:46.8211897Z</ExecutionStartTime>
      <ExecutionEndTime>2014-04-07T14:26:46.8211897Z</ExecutionEndTime>
      <PoisonedCount>0</PoisonedCount>
      <IsThrottled>0</IsThrottled>
      <ResponseResource>[null]</ResponseResource>
      <ResponseAction>[null]</ResponseAction>
      <TargetHealthState>0</TargetHealthState>
      <TargetHealthStateTransitionId>0</TargetHealthStateTransitionId>
      <FirstAlertObservedTime>[null]</FirstAlertObservedTime>
      <RecoveryResult>4</RecoveryResult>
      <IsRecoveryAttempted>0</IsRecoveryAttempted>
      <CorrelationResultsXml>[null]</CorrelationResultsXml>
      <CorrelationAction>0</CorrelationAction>
      <Version>65536</Version>
    </EventXML>
  </UserData>
</Event>

Open in new window

0
Comment
Question by:Tech Man
  • 2
  • 2
4 Comments
 
LVL 6

Expert Comment

by:Ryan Smith
ID: 39983413
Log files will fill up your drives quick.  60 people checking their emails every 1 minute and then exchange outputting all the checks it's doing.  I've seen directories have 200 gigs in a matter of days.  You have to be selective on what you want to log.
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39983482
How can I turn down the logging on Exchange 2013? It seems a bit excessive at present.
0
 
LVL 6

Accepted Solution

by:
Ryan Smith earned 1500 total points
ID: 39983671
in powershell you can run this command

Set-Eventloglevel -Identity <ECIdParameter> -Level <Lowest | Low | Medium | High | Expert> [-Confirm [<SwitchParameter>]] [-WhatIf [<SwitchParameter>]]
0
 
LVL 1

Author Comment

by:Tech Man
ID: 39992264
Is this applicable to 2013
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Want to know how to use Exchange Server Eseutil command? Go through this article as it gives you the know-how.
With so many activities to perform, Exchange administrators are always busy in organizations. If everything, including Exchange Servers, Outlook clients, and Office 365 accounts work without any issues, they can sit and relax. But unfortunately, it…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question