Hi

Suddently yesterday morning a CAS server at a customer began logging Event 5, 6 and 7.

The event:

After 6 unsuccessful attempts to send a notification for subscription [HgAxMDF2czI1MC5rcmltaW5hbGZvcnNvcmdlbi5uZXQQAAAAOx8jA21sSkOxpogIrKGGvl6KyEYdiNII] against endpoint [http://10.168.211.20:6082/PSCEx2k7/488372fd05174693a33154424571eb66], the subscription has been removed. Details: WebException: Request timed out Status: Timeout 

The IP 10.168.211.20 doesn't excist. In fact that net is not in use here.

It gives 6 alarms every 15 minutes.

Any idea where to look? I can't find any useful info anywhere.

BR
Steen

Check the threads

http://forums.msexchange.org/MSExchange_Web_Services,_Unable_to_send_a_notification_for_subscription/m_1800508838/tm.htm

https://social.technet.microsoft.com/Forums/en-US/dabd71eb-858b-477d-b39c-89c3295a38ee/event-id-56and-7-source-msexchange-web-services?forum=exchange2010

• Marked as answer by steenpedersen 22 hours 16 minutes ago

I've already seen those - didn't give me anything.

There must be a way to see what is triggering this. I've been looking in the IIS logs and can't find anything there.

There must also be a way to stop this.

BR
Steen

Hi again

I was lucky, it was also a telephone system here, no one knows about. 

The IP range is not even in use, and there are no way the traffic can be routed to this server.

BR
Steen

• Marked as answer by steenpedersen 22 hours 16 minutes ago

Cheers!