Explination of Exchange Email Logs - Source: AGENT, Event-ID: FAILED
Hi:
We had to restore some Exchange mail logs from a few months back and have used third party software to format the logs for view in Access. We are trying to locate a NDR email that we know is not there and have run into some other interesting information
that I am unable to find an answer to by searching the net.
Basically, this is what the logs say:
Can someone tell me what the AGENT FAIL in yellow represents? Why would I be getting that event thrown?
Thanks - Chris
October 28th, 2011 6:23pm
On Fri, 28 Oct 2011 22:13:57 +0000, Steinomite wrote:
>
>
>Hi:
>
>We had to restore some Exchange mail logs from a few months back and have used third party software to format the logs for view in Access. We are trying to locate a NDR email that we know is not there and have run into some other interesting information
that I am unable to find an answer to by searching the net.
>
>Basically, this is what the logs say:
>
>
>
>
>
>Can someone tell me what the AGENT FAIL in yellow represents? Why would I be getting that event thrown?
You should be able to find that information in the agent logs (if you
still have them).
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
October 28th, 2011 11:41pm
Got any 3rd part agents installed or something like ForeFront
http://technet.microsoft.com/en-us/library/bb123536(EXCHG.80).aspxSukh
October 30th, 2011 3:40pm
Hi Chris,
Any update for your issue?
Above gave some good suggestion.
Regards!
Gavin
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
tngfb@microsoft.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if
a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
October 31st, 2011 4:11am
Sorry all for the late reply.
We do have a few 3rd party applications installed on this server:
CodeTwo Exchange Rule (for disclaimer) Microsoft Synchronization Tool (for syncing user accounts with ForeFront)
Get-TransportAgent gave me this output:
Identity
Enabled Priority
--------
------- --------
PmE12Transport True
1
Transport Rule Agent True 2
Journaling Agent True
3
AD RMS Prelicensing Agent False 4
PmE12Protocol True
5
CodeTwoExchangeRules True 6
As far as agent logs, I can browse to this location: C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\, but there is not a folder named "AgentLog". Are these logs stored in some other place? I checked all three Exchange servers (store,
client access, transport) and it is at neither.
Thanks
Chris
October 31st, 2011 6:42pm
Hi Chris,
Per your description, the issue seems related with some agent involved in to the message delivery.
And through the log, it seems that there are something wrong when the message apply the agent.
I would suggest that you use Pipeline tracing to check the agent.
How to enable the pipeline tracing log:
http://technet.microsoft.com/en-us/library/bb125018.aspx
And then we could confirm more things about the log.
Regards!
Gavin
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contacttngfb@microsoft.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your
question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
November 1st, 2011 3:31am
Hi Chris,
Per your description, the issue seems related with some agent involved in to the message delivery.
And through the log, it seems that there are something wrong when the message apply the agent.
I would suggest that you use Pipeline tracing to check the agent.
How to enable the pipeline tracing log:
http://technet.microsoft.com/en-us/library/bb125018.aspx
And then we could confirm more things about the log.
Regards!
Gavin
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contacttngfb@microsoft.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your
question. This can be beneficial to other community members reading the thread.
November 1st, 2011 10:22am
Wanted to thank everyone for their time on this. It was decided that the overhead that this would cause wasn't worth investigating so we don't need an answer at this time. Thanks again Chris
Free Windows Admin Tool Kit Click here and download it now
November 3rd, 2011 12:47pm
Wanted to thank everyone for their time on this. It was decided that the overhead that this would cause wasn't worth investigating so we don't need an answer at this time. Thanks again Chris
November 3rd, 2011 7:38pm
Hi Chris,
So, can I close the case for you.
If you want to continue the discussion, you could be free to open a new one. :)
Regards!
Gavin
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
tngfb@microsoft.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if
a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
November 7th, 2011 3:19am
Yes, you can close it. Thanks
November 7th, 2011 1:40pm