285 real failures, buried in 1,345 heartbeats

Every alert in IW_Alerts, sorted and explained

7 July to 4 September 2026. All 1,630 messages classified into 33 error types, each with a description, an immediate fix, a permanent correction and an automation path.

What is actually in the folder

All 1,630 messages, drawn to scale.

Four in five messages carry no error. Routing restart notices and daily log reports to a separate mailbox would leave 285 messages here — a folder someone can actually read every morning.

Severity

Where the weight sits

Assigned by error signature. Critical means a retry cannot succeed without a code or credential change — the record keeps failing until someone changes something.

Error types

Thirty-three signatures, fully documented

Search by name, code, symptom or flow. Open any row for the full entry.

Where failures land

Platform problem or customer conversation

A type spanning many customers points at the platform. A type sitting with a single customer is usually one conversation with one accountant or administrator.

Customers by error count

Dominant error type shown beside each.

Errors per week

The most recent week is the worst in the window.

The final bar covers a partial week.

Integration flows

Invoice paths into QuickBooks dominate

Failures by flow across the window.

Credential exposure

Found while parsing, and more urgent than the errors

This surfaced during extraction of the daily log attachments. It is not an integration failure, but it should be handled before anything else on this page.

Salesforce passwords and session IDs are logged in plain text and emailed externally

The integration engine logs full HTTP request bodies. The first call every flow makes is the Salesforce SOAP login() operation, which carries the username and password as XML elements — so each daily .erl log captures them verbatim, along with every session ID returned afterwards.

These attachments were emailed to 29 external recipient addresses across customer domains. The credentials have passed through third-party mail servers and cannot be recalled.

  1. Verify blast radius. Confirm whether any customer received another customer's credentials. Cross-tenant leakage is a materially different incident.
  2. Rotate and revoke. Change the 23 exposed Salesforce integration passwords and revoke active sessions for those users.
  3. Redact at the log writer. Mask password, sessionId and authorization headers before anything reaches disk.
  4. Stop attaching raw logs to outbound mail. Send a summary if customers need visibility.
  5. Reconsider full request-body logging as a standing default on every flow for every tenant.

The PST file itself carries the same exposure. Wherever copies exist, handle them accordingly.

Method

What is measured and what is judged

Read this before treating anything on this page as procedure.

Where did the data come from?

IW_Alerts.pst, folder IW_Alerts — 1,630 messages spanning 7 July to 4 September 2026. Extracted with readpst, RTF bodies parsed, then flow name, customer account and QODBC error code read from the embedded log line in each message.

Which parts are facts from the logs?

Error codes, error messages, counts, timestamps, affected customers and integration flows. All of it is read directly from the source and recomputed rather than transcribed.

Which parts are inference?

Severity, descriptions, resolution steps, permanent corrections, automation paths and customer impact. These are reasoning from what the QuickBooks and QODBC codes mean, not statements from your emails. Have someone who knows the platform review them before they become procedure.

How complete is the classification?

281 of 285 errors matched a known signature. Four are marked ERR-UNCL-99 and need manual triage — two of those have empty bodies.

Is anything missing?

Yes. The folder holds 1,630 messages, not the roughly 10,000 expected. Older mail is likely archived or was excluded from the export, so the weekly trend reflects a 60-day sample only. A fuller export would run through the same pipeline unchanged.