none
Explination of Exchange Email Logs - Source: AGENT, Event-ID: FAILED RRS feed

  • Question

  • Hi:

    We had to restore some Exchange mail logs from a few months back and have used third party software to format the logs for view in Access. We are trying to locate a NDR email that we know is not there and have run into some other interesting information that I am unable to find an answer to by searching the net.

    Basically, this is what the logs say:

     

    Can someone tell me what the AGENT FAIL in yellow represents? Why would I be getting that event thrown?

    Thanks - Chris

    Friday, October 28, 2011 10:13 PM

Answers

  • Hi Chris,

    Per your description, the issue seems related with some agent involved  in to the message delivery.
    And through the log, it seems that there are something wrong when the message apply the agent.
    I would suggest that you use Pipeline tracing to check the agent.
    How to enable the pipeline tracing log:
    http://technet.microsoft.com/en-us/library/bb125018.aspx
    And then we could confirm more things about the log.

    Regards!
    Gavin

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contacttngfb@microsoft.com
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Marked as answer by Gavin-Zhang Tuesday, November 8, 2011 8:24 AM
    Tuesday, November 1, 2011 7:22 AM
  • Wanted to thank everyone for their time on this. It was decided that the overhead that this would cause wasn't worth investigating so we don't need an answer at this time. Thanks again Chris
    • Marked as answer by Gavin-Zhang Tuesday, November 8, 2011 8:24 AM
    Thursday, November 3, 2011 4:38 PM

All replies

  • On Fri, 28 Oct 2011 22:13:57 +0000, Steinomite wrote:
     
    >
    >
    >Hi:
    >
    >We had to restore some Exchange mail logs from a few months back and have used third party software to format the logs for view in Access. We are trying to locate a NDR email that we know is not there and have run into some other interesting information that I am unable to find an answer to by searching the net.
    >
    >Basically, this is what the logs say:
    >
    >
    >
    >
    >
    >Can someone tell me what the AGENT FAIL in yellow represents? Why would I be getting that event thrown?
     
    You should be able to find that information in the agent logs (if you
    still have them).
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Saturday, October 29, 2011 3:31 AM
  • Got any 3rd part agents installed or something like ForeFront

    http://technet.microsoft.com/en-us/library/bb123536(EXCHG.80).aspx


    Sukh
    Sunday, October 30, 2011 7:31 PM
  • Hi Chris,

    Any update for your issue?
    Above gave some good suggestion.

    Regards!
    Gavin

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Monday, October 31, 2011 8:01 AM
  • Sorry all for the late reply.

    We do have a few 3rd party applications installed on this server:

    1. CodeTwo Exchange Rule (for disclaimer)
    2. Microsoft Synchronization Tool (for syncing user accounts with ForeFront)

    Get-TransportAgent gave me this output:

    Identity                                           Enabled         Priority      
    --------                                                -------           --------      
    PmE12Transport                                 True               1             
    Transport Rule Agent                          True               2             
    Journaling Agent                                 True               3             
    AD RMS Prelicensing Agent                  False             4             
    PmE12Protocol                                    True               5             
    CodeTwoExchangeRules                     True               6  

    As far as agent logs, I can browse to this location: C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\, but there is not a folder named "AgentLog". Are these logs stored in some other place? I checked all three Exchange servers (store, client access, transport) and it is at neither.

    Thanks

    Chris

    Monday, October 31, 2011 10:34 PM
  • Hi Chris,

    Per your description, the issue seems related with some agent involved  in to the message delivery.
    And through the log, it seems that there are something wrong when the message apply the agent.
    I would suggest that you use Pipeline tracing to check the agent.
    How to enable the pipeline tracing log:
    http://technet.microsoft.com/en-us/library/bb125018.aspx
    And then we could confirm more things about the log.

    Regards!
    Gavin

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contacttngfb@microsoft.com
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Marked as answer by Gavin-Zhang Tuesday, November 8, 2011 8:24 AM
    Tuesday, November 1, 2011 7:22 AM
  • Wanted to thank everyone for their time on this. It was decided that the overhead that this would cause wasn't worth investigating so we don't need an answer at this time. Thanks again Chris
    • Marked as answer by Gavin-Zhang Tuesday, November 8, 2011 8:24 AM
    Thursday, November 3, 2011 4:38 PM
  • Hi Chris,

    So, can I close the case for you.
    If you want to continue the discussion, you could be free to open a new one. :)

    Regards!
    Gavin

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Monday, November 7, 2011 8:09 AM
  • Yes, you can close it. Thanks
    Monday, November 7, 2011 6:29 PM