How to determine the user associated with an error reported by Microsoft Exchange Web Services regarding a Symantec Email Submission Client (SESC) Subscription

book

Article ID: 180973

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange Messaging Gateway

Issue/Introduction

 

Resolution

Microsoft Exchange has reported an error regarding an SESC subscription.  This article shows how to map the subscription information to a specific user being monitored.

1. Find the event from MSExchange Web Services in the Windows Application Event log on the CAS server.  The following is an example:

Log Name:      Application
Source:        MSExchange Web Services
Date:          2/16/2012 11:09:28 AM
Event ID:      22
Task Category: Core
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Ex2010DC.2k8domain.test
Description:
An exception occurred while trying to read events for subscription [FwBleDIwMTBkYy4yazhkb21haW4udGVzdBAAAAAJ4VvqbKE1RKXWgVgLInM+te+PUOS6zgg=] against endpoint [http://sesc-3.2k8domain.test:8081/service.asmx]: Microsoft.Exchange.Data.Directory.SystemConfiguration.OverBudgetException: This operation exceeds the throttling budget for policy part 'CAS', budget type: 'EWS'.  Suggested backoff time 19181 ms.
   at Microsoft.Exchange.Data.Directory.Budget.CheckOverBudget(CostType costType)
   at Microsoft.Exchange.Services.Core.PushSubscription.BuildNotification()

 

Save the subscription ID for later.  In the example above the subscription ID is FwBleDIwMTBkYy4yazhkb21haW4udGVzdBAAAAAJ4VvqbKE1RKXWgVgLInM+te+PUOS6zgg=.

2. Write out the list of SESC EWS subscriptions to an XML file. Use the steps in the following article to write the subscriptions to an XML file: How to view Exchange Web Service (EWS) subscriptions created by Symantec Email Submission Client (SESC).

4. Open the XML file in an editor and search for the subscription ID listed in the event.

It looks like this:

<Subscription>
    <SubscriptionID>FwBleDIwMTBkYy4yazhkb21haW4udGVzdBAAAAAJ4VvqbKE1RKXWgVgLInM+te+PUOS6zgg=</SubscriptionID>
    <LastNotificationTime>0001-01-01T00:00:00</LastNotificationTime>
    <Mailbox>
      <SmtpAddress>[email protected]</SmtpAddress>
      <Status>DIRECT_SUBMITTER</Status>
      <SubmissionsFolder>
        <FolderID>AAMkADNlNDRmMWJlLWEzZjEtNGZmMC04MzA3LWM5OTVkOGQxNmM2MQAuAAAAAAD5AM5kjdbdSqpKQJLDKNzaAQBW/KRoZ5mwS5X/zNmbCFlPAAAAdOplAAA=</FolderID>
        <SubscriptionID>FwBleDIwMTBkYy4yazhkb21haW4udGVzdBAAAAAJ4VvqbKE1RKXWgVgLInM+te+PUOS6zgg=</SubscriptionID>
        <Name>Submit Spam to Symantec</Name>
      </SubmissionsFolder>
      <ExchangeServer>
        <Name>EX2010DC</Name>
        <DistinguishedName>CN=EX2010DC,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=2k8domain,DC=test</DistinguishedName>
        <ExchangeRoles>Mailbox ClientAccess HubTransport</ExchangeRoles>
      </ExchangeServer>
    </Mailbox>
  </Subscription>

In this case the subscription is for the user with the SMTP address [email protected].

Use this information to continue troubleshooting Exchange and/or SESC.

Environment

  • SESC 1.X