We are seeing these errors being generated on a number of Exchange 2010 SP3 servers that have recently been deployed.
Configuration Details;
SCOM - 2012 SP1 (no updates installed) - Exchange 2010 and other Management Packs deployed.
Exchange - 2010 SP3 RU10 - Windows 2008 R2 patched up to April 2014 - Running as a virtual on 2012 host
AV - Servers - SC Endpoint Protection - Exchange McAfee
Operations Manager event logs displays a lot of 26017 and 26018 events simultaneously in the event log. For example I can see 67 entries suggesting the Application or System Log is xx minutes behind and also entries (26018) that is has now recovered.
Steps tried so far include
Numerous reboots etc.
Renaming the Health Service State folder
Removing a server from SCOM and adding back in
I have spent quite a bit of time searching various logs and the internet but to no avail. Does anyone have any ideas or pointers on how to resolve this before we start looking into overrides?
The servers, while virtual, are very well spec'd and currently I am not see any potential resource issues.
Thank you.