Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Unknown Ext's in event log

Unanswered Question
Jun 26th, 2006
User Badges:

The following unknown ext's are logged in event log, These ext's are not defined any where.

5615 - This ext is logged when mailbox is full for any user

4765 - This Ext is logged when the user (any user) enter's a invalid password

4753 - This Ext is logged when the account of any user is locked out

OS-Windows 2000 sp4

Unity 4.0(5)

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
lindborg Tue, 06/27/2006 - 08:18
User Badges:
  • Cisco Employee,

Can you post the full text of one of the event log messages you're talking about?

Also, you can search in the vw_DTMFAccessId table using CUDLE (you'll find it in the Tools Depot on your desktop) - there may be extensions defined somewhere that you're not seeing. If you look in this table it should find them regardless of what type of object they're associated with and you can run them down from there.

ciscounity Tue, 06/27/2006 - 17:48
User Badges:

Please check the attached screenshots, also i cannot find the ext's in the DTMFAccessId table (eg 5615,4765)



lindborg Wed, 06/28/2006 - 06:45
User Badges:
  • Cisco Employee,

Well, the problem is those error messages are not indicating there is extension 5615 or 4765 - those are message IDs.

The first message indicatess the mailbox attached to the user with extension 4003 is full. That's it. The 5615 is a message ID, not an extension. All this error is indicating is that user sent a message and since his mailbox is full, Exchange will not allow us to send it on their behalf so we have to send it as an unknown caller to get around it. This is a warning to let you know that you need to get that guy's quota up or have them clean up their inbox. We cannot get around the Exchange inbox limit enforcement rules.

On the 2nd error, the only extension noted in there is [1194] - the 4765 is just a message Id number - it's not an extesnsion. As the error message states, the user called from 1194 and entered an invalid PW when attempting to get into that mailbox (this is for tracking crackers who may be hitting your system).

ciscounity Wed, 06/28/2006 - 16:59
User Badges:

Thanks, I know what those events mean,

1)ok than where are these message id's defined,

2)Is this the default behaviour, ie:- these message

id's would always appear when we get the above





This Discussion