0

For the last few days, the system log on our Exchange server has been filled with "errors" like the following:

Error   1/14/2022 2:15:10 PM    MSExchangeFrontEndTransport 12017   TransportService
An internal transport certificate will expire soon. Thumbprint: 1E7CC2E1C3F0737651FEB99B0BEF5546154B404A, expires: 4/4/2022 1:28:15 PM

These errors fire once every fifteen minutes. Since the certificate does not expire for several months, I do not want to deal with them right now. Unfortunately, our monitoring system is not very granular and alerts us about any number of errors over some low threshold. In other words, having an error added every 15 minutes is causing a lot of false alerts.

Is there any way to turn these alerts off at the source? I poked around a little bit on various Microsoft forums and found a command which ostensibly disables this particular monitor until a later date, but the errors keep coming:

Add-GlobalMonitoringOverride -Identity "HubTransport\Transport.ServerCertExpireSoon.Monitor" -PropertyName Enabled -PropertyValue 0 -Duration 72.00:00:00 -ItemType Monitor

Any tips on where I should look next? I would rather suppress these at the source than filter them from the monitoring system, as I'd still like to know that my certs are expiring. I just don't need to know three months in advance.

mcwayliffe
  • 101
  • 1

1 Answers1

1

You can't stop logging for a specific event ID, but you can lower the event log level.

Set-EventLogLevel -Identity "HubTransport\Transport.ServerCertExpireSoon.Monitor" -Level Low

For more details: Manage Diagnostic Logging Levels

In addition, here's a similar thread for your reference: Can I disable Windows Event Logging for a certain service?

Joy Zhang
  • 1,002
  • 1
  • 4
  • 5
  • Unfortunately, the logging level for that event is already at the lowest. Here's the output of `Get-EventLogLevel`: `SERVER\MSExchangeFrontEndTransport\TransportService Lowest` – mcwayliffe Jan 17 '22 at 14:47
  • As I have replied above, you can't seem to stop logging for a specific event ID. – Joy Zhang Jan 19 '22 at 07:24