Home
  •  

An error occurred while ASN.1 was decoding an object.

An_error_occurred_while_ASN_1_was_decoding_an_object (Rule)

Knowledge Base article:

Summary

ASN.1 is an ISO/ITU data encoding standard that refers to Specification of Basic Encoding Rules for Abstract Syntax Notation One.

The fully-encoded ASN.1 envelope is in the Microsoft Exchange Server APDU (Application Protocol Data Unit) logs, which are binary representations of communication among message transfer agents (MTAs) in different sites and between MTA and client applications within a site.

APDU logs are enabled when the logging levels of the X.400 Service and APDU categories are both set to Medium or greater after you select MSExchangeMTA on the Diagnostics Logging tab of the Server Properties dialog box. To create Bf*.log files, set the logging level of the APDU and X.400 categories to Maximum.

These text logs are stored in the Mtadata directory. The current log is always named Bf0.log. Prior logs are named Bfx.log, where x increases as the age of the log increases.

Resolutions

View the bad data in the APDU log in Mtadata\Bf0.log. Reload the ASN.1 template files from the Microsoft Exchange Server installation compact disc (CD). For more information, see Microsoft Knowledge Base articles Q168906 and Q163032.

External

For more information about MSExchangeMTA event 200, see:

Element properties:

TargetMicrosoft.Exchange.Routing.MTA
CategoryEventCollection
EnabledTrue
Event_ID200
Event SourceMSExchangeMTA
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
An error occurred while ASN.1 was decoding an object.
{0}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
EventDS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="An_error_occurred_while_ASN_1_was_decoding_an_object" Enabled="onEssentialMonitoring" Target="Exch2003Core!Microsoft.Exchange.Routing.MTA" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>MSExchangeMTA</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>200</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="An_error_occurred_while_ASN_1_was_decoding_an_object.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>