Exchange 2010/2013 – MSExchange Management Application Error 5000 Events

Error 5000 in application log indicates error saving the Admin audit log. There is many variations depending on the reason for the error. It looks like this :


Failed to save admin audit log for this cmdlet invocation.
Organization: First Organization
Log content:
Cmdlet Name: Set-Mailbox
Object Modified:
Parameter: SingleItemRecoveryEnabled = True
Parameter: Identity =domains/xxxxx/Users/xxxxxxxx/xxxxx
Caller: NT AUTHORITY\SYSTEM (powershell)
ExternalAccess: True
Succeeded: True
Run Date: 2016-07-19T10:23:50
OriginatingServer: RZ1GRP01 (15.00.1178.000)

Microsoft.Exchange.Data.ApplicationLogic.AuditLogServiceException: The Exchange Web Service returned an error while trying to access the audit log. Reason: ‘Error’,’ErrorQuotaExceeded’,’Mailbox has exceeded maximum mailbox size.’.
at Microsoft.Exchange.Data.ApplicationLogic.EwsAuditClient.CallEwsWithRetries(LID lid, Func`1 delegateEwsCall, Func`3 responseMessageProcessor, Func`3 responseErrorProcessor)
at Microsoft.Exchange.Data.ApplicationLogic.EwsAuditLog.WriteAuditRecord(IAuditLogRecord auditRecord)
at Microsoft.Exchange.ProvisioningAgent.EwsAuditLogger.WriteAuditRecord(IAuditLogRecord auditRecord)
at Microsoft.Exchange.ProvisioningAgent.AdminLogProvisioningHandler.WriteAuditRecord(Stopwatch stopwatch)

The Error part in red can be different. Important is to know that for Admin audit logging is used one system mailbox – SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} 

If the Database were this mailbox is located is dismounted, we get error “MapiExeptionMailboxOffline” if hte mailbox is too big you get “‘Error’,’ErrorQuotaExceeded’,’Mailbox has exceeded maximum mailbox size.'” and you have to increase this quotas for this mailbox.

get-mailbox -arbitration -identity “SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}” | get-mailboxstatistics | fl *size*

checked the quota limits on this mailbox:
get-mailbox -arbitration -identity “SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}” | fl *quota*
ProhibitSendQuota : Unlimited
ProhibitSendReceiveQuota : Unlimited
RecoverableItemsQuota : 30 GB (32,212,254,720 bytes)
RecoverableItemsWarningQuota : 20 GB (21,474,836,480 bytes)
CalendarLoggingQuota : 6 GB (6,442,450,944 bytes)
UseDatabaseQuotaDefaults : False
IssueWarningQuota : Unlimited
RulesQuota : 64 KB (65,536 bytes)
ArchiveQuota : 100 GB (107,374,182,400 bytes)
ArchiveWarningQuota : 90 GB (96,636,764,160 bytes)

Use set-mailbox -arbitration -identity “SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}” -RecoverableItemsQuota unlimited -RecoverableItemsWarningQuota unlimited  -CalendarLoggingQuota unlimited  to set the quotas to unlimied.