I have an Exchange 2007 server that is almost 2 yrs old that just started getting event ID's 5, 6 and 7 (see sample below). Can someone tell me how to trace this out to find the source? We do use Windows Mobile devices via ActiveSync. Our SSL certificate is also due to be renewed in March but I would not think that this would cause the problem?Event Type: ErrorEvent Source: MSExchange Web ServicesEvent Category: Core Event ID: 7Date: 2/11/2010Time: 4:29:44 PMUser: N/AComputer: MS2Description:After 8 unsuccessful attempts to send a notification for subscription DgBtczIuY3Bocy5sb2NhbBAAAABSkWacjrixQJ6bAKL3draV, subscription has been removed. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

See the thread below. Here just a quote: "The event 5, 6, and 7 are basically event that telling us that a device/client is subscribing a server event, but when the server when to notify the client/device, the client is not there to respond to it, so the server threw and error and close the subscription." MSExchange Web Services event warnings and errorshttp://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/4d341abb-8e2f-4cab-a6ae-6735d4c1561eMCTS: Messaging | MCSE: S+M | Small Business Specialist

Jon- Thanks for the reply but I want to track down which device/client is subscribing the server event so that I can stop it. Does anyone know how to do that? Thanks!

HiAre any WM users intermittently not able to synchronize with the Exchange server over activesync? Maybe they receive an error: 0x80072efd in their device.Or some other devices, like telephone system sending SOAP request to your server?Frank Wang

Frank- Thanks for your reply. We have many Windows Mobile devices and getting users to tell me if they are having a problem is hard. Is there any way to track a subscription via the unique ID that it uses? The problem went away over the weekend and started again this morning. That makes me think that it is a PC since we have users shutdown when they go home. Any help from anyone would be appreciated about how I can track this down.

I had Microsoft help me analyze the IIS logs on our Exchange server. It looks like someone is trying to attach a rogue mobile device to our Exchange server using Jakarta protocol. We were able to pinpoint the credentials being used and the IP address of the mobile service provider. It appears to be coming from something affiliated with www.seven.com. Hope this helps someone else in the future.