Change Auditor for Exchange 7.3 - Event Reference Guide


	NOTE: These events are generated by a Microsoft PowerShell command; therefore, a generic PowerShell cmdlet event (Event ID 2304) is logged to the event log. See PowerShell cmdlet event.

Table 13. InTrust for Exchange event log: Store Mount events
Event ID	Description
505	Public or Mailbox store mounted
506	Public or Mailbox store dismounted

Table 14. InTrust for Exchange event log: System events
Event ID	Description
1	Change Auditor for Exchange Service started
2	Change Auditor for Exchange Service stopped
3	Change Auditor for Exchange Service error occurred
4	Change Auditor for Exchange Service information
5	Change Auditor for Exchange Service is going to be automatically restarted
6	Change Auditor for Exchange Service can not be restarted
9	Memory usage limit was exceeded
10	Used disk space usage limit was exceeded
11	Disk space is more than limit
12	Disk space usage limit was exceeded
12	Disk space usage is now below limit
13	Storage integrity fatal error occurred
14	Storage integrity error occurred
15	Storage was recovered after error
19	Cannot initiate service stop
28	Skip events for user(s)
29	Skip events for mailbox(es)
30	Failed to initialize WMI sink component
39	ID list of disabled events
40	Changes to a list of disabled events
41	Filtering configuration load failure
42	Filtering configuration successfully loaded


Event ID	Description
2304	PowerShell cmdlet <cmdlet name> was executed with following parameters: <parameters>

Table 16. InTrust for Exchange event log: ActiveSync events
Event ID	Description
2817	ActiveSync Autodiscover was executed
2818	ActiveSync Folder Create was executed
2819	ActiveSync Folder Delete was executed
2820	ActiveSync Folder Sync was executed
2821	ActiveSync Update (rename or move) was executed
2822	ActiveSync Get Attachment was executed
2823	ActiveSync Get Item Estimate was executed
2824	ActiveSync Item Operation was executed
2825	ActiveSync Meeting Response was executed
2826	ActiveSync Move Item was executed
2827	ActiveSync Ping was executed
2828	ActiveSync Provision was executed
2829	ActiveSync Resolve Recipients was executed
2830	ActiveSync Resolve Recipients was executed
2831	ActiveSync Search was executed
2832	ActiveSync Settings was executed
2833	ActiveSync Smart Forward was executed
2834	ActiveSync Smart Reply was executed
2835	ActiveSync Snyc was executed
2836	ActiveSync Initial Sync was executed
2837	ActiveSync Initial Folder Sync was executed
2838	ActiveSync Validate Certificates was executed
2839	ActiveSync request failed
2840	ActiveSync remote wipe of this device requested from server
2841	ActiveSync remote wipe operation succeeded
2842	ActiveSync remote wipe operation failed
2843	ActiveSync GetHierarchy (deprecated) command executed
2844	ActiveSync CreateCollection (deprecated) command executed
2845	ActiveSync MoveCollection (deprecated) command executed
2846	ActiveSync DeleteCollection (deprecated) command executed