Event ID 7031 followed by 7032 The Microsoft Exchange Transport service terminated unexpectedly.

Hello
Have a strange problem that reoccurs every day. The following are recorded in the log.
7031
The Microsoft Exchange Transport service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.7032The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Exchange Transport service, but this action failed with the following error:
An instance of the service is already running.Any suggestions are welcome./Deland
/Andreas

Here are the result from the level 5 logging. I Havent disabled the TransportAgent yet.
Log Name:      Application
Source:        MSExchangeTransport
Date:          2013-07-19 10:13:25
Event ID:      12025
Task Category: TransportService
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Transport service is disconnecting performance counters with process lifetime from their old process.
Followed by 32 events of 12028
Log Name:      Application
Source:        MSExchangeTransport
Date:          2013-07-19 10:13:25
Event ID:      12028
Task Category: TransportService
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
The process with process ID 1100 is holding the performance counter configuration cache total requests Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062 from instance transportrules(B1D082BB) RefCount=0 SpinLock=0 Offset=3936
and category MSExchangeTransport Configuration Cache while running processes are: Processes running are:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
And 28 events on 106
Log Name:      Application
Source:        MSExchange Common
Date:          2013-07-19 10:13:29
Event ID:      106
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Performance counter updating error. Counter name is DataRow seeks total, category name is MSExchangeTransport Database. Optional code: 2. Exception: The exception thrown is : System.InvalidOperationException: Instance '_total' already exists with a lifetime
of Process.  It cannot be recreated or reused until it has been removed or until the process using it has exited.
   at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime
lifetime, Boolean& foundFreeInstance)
   at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.get_RawValue()
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.get_RawValue()
Last worker process info : System.ArgumentException: Process with an Id of 14868 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Processes running while Performance counter failed to update:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
10416 EdgeTransport
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
15116 conhost
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=59 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : queue(B351294)
RefCount=0 SpinLock=0 Offset=48552, categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 8(ED0419E7) RefCount=0 SpinLock=0 Offset=44384,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 6(ED0419E9) RefCount=0 SpinLock=0 Offset=40216,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=4 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 3(ED0419EC) RefCount=0 SpinLock=0 Offset=36048,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=3 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 1(ED0419EE) RefCount=0 SpinLock=0 Offset=31880,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=18 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat(B874BB3) RefCount=0 SpinLock=0 Offset=27712,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : inqueue(56145953) RefCount=0 SpinLock=0 Offset=23544,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=17 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : smtpin(81392C98) RefCount=0 SpinLock=0 Offset=19376,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : mail(7C6FB7CC) RefCount=0 SpinLock=0 Offset=15208,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=68 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : other(ADC98A1) RefCount=0 SpinLock=0 Offset=11040,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 4832, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4832 StartupTime: 130183498009738545, currentInstance : _total(CFBEE918) RefCount=1 SpinLock=0 Offset=32,
categoryName: MSExchangeTransport Database
Log Name:      Application
Source:        MSExchange Common
Date:          2013-07-19 10:13:31
Event ID:      106
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Performance counter updating error. Counter name is Transaction Durable Callback Count/sec, category name is MSExchangeTransport Database. Optional code: 1. Exception: The exception thrown is : System.InvalidOperationException: Instance '_total' already exists
with a lifetime of Process.  It cannot be recreated or reused until it has been removed or until the process using it has exited.
   at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime
lifetime, Boolean& foundFreeInstance)
   at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.IncrementBy(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.IncrementBy(Int64 incrementValue)
Last worker process info : System.ArgumentException: Process with an Id of 14868 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Processes running while Performance counter failed to update:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
10416 EdgeTransport
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
15116 conhost
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=59 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : queue(B351294)
RefCount=0 SpinLock=0 Offset=48552, categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 8(ED0419E7) RefCount=0 SpinLock=0 Offset=44384,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 6(ED0419E9) RefCount=0 SpinLock=0 Offset=40216,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=4 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 3(ED0419EC) RefCount=0 SpinLock=0 Offset=36048,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=3 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 1(ED0419EE) RefCount=0 SpinLock=0 Offset=31880,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=18 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat(B874BB3) RefCount=0 SpinLock=0 Offset=27712,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : inqueue(56145953) RefCount=0 SpinLock=0 Offset=23544,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=17 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : smtpin(81392C98) RefCount=0 SpinLock=0 Offset=19376,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 10416, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10416 StartupTime: 130186952059962770, currentInstance : mail(7C6FB7CC) RefCount=1 SpinLock=0 Offset=15208,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 10416, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10416 StartupTime: 130186952059962770, currentInstance : other(ADC98A1) RefCount=1 SpinLock=0 Offset=11040,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 4832, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4832 StartupTime: 130183498009738545, currentInstance : _total(CFBEE918) RefCount=1 SpinLock=0 Offset=32,
categoryName: MSExchangeTransport Database
Then ESE  Recovery starts on the Transport database. 
/Andreas

Similar Messages

  • Microsoft Exchange Transport service terminated unexpectedly

    Hi All,
    We have configured exchange 2013 in windows server 2012. From last two days exchange transport service getting stopped.
    Microsoft Exchange Transport service terminated unexpectedly.
    Log Name:      System
    Source:        Service Control Manager
    Date:          11/13/2014 1:10:28 AM
    Event ID:      7031
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      BMBPRMBX01.BMB.LOCAL
    Description:
    The Microsoft Exchange Transport service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

    Hi,
    This issue may due to some of the corrupt message in the queue. Please try these steps to solve this issue.
    Pause the transport service and let all the messaged go out.
    When queue is empty, stop the transport service and go to the mail.que database in transport-->queue folder. Cut paste all the files from queue folder to some other folder as backup.
    Now start the transport service, it will create a fresh mail.que database and observe if the service us crashing again.
    In addition, please try to disable any AV software, sometimes it will cause Transport service corrupted.
    Best Regards.

  • "The Microsoft Exchange Diagnostics service terminated unexpectedly"

    Hi all, this happens about twice per hour and started some days ago, no reconfigs etc that should make it do that as far as I can find. Have been running CU6 for some months without this happening until recently.
    Also getting AppEventID 1007:
    Failed to create or start performance logs with error: System.ArgumentException: Value does not fall within the expected range.
       at PlaLibrary.DataCollectorSetClass.start(Boolean Synchronous)
       at Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogSet.StartLog(Boolean synchronous)
       at Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogMonitor.CheckPerflogStatus(). Performance log: ExchangeDiagnosticsPerformanceLog.
    Found this article
    http://blogs.technet.com/b/anya/archive/2014/11/25/microsoft-exchange-diagnostics-service-crashing-post-cu6-upgrade.aspx, but I do not actually understand what the "fix" really is here, many steps are made for Diagnostics buth which
    of those are necessary to take? And I'm not so into exporting/importing those XMLs.. I have only one E2013-server also.
    Hope someone can clarify this. I was thinking of installing CU7 if that might fix it, but I'm not sure if I dare in danger of running into trouble with things not working as they should.
    Thanks,
    -Ray.

    Hi,
    Based on the description of that article, the root issue was due to upgrade. While upgrading to Exchange 2013 CU6, the upgrade did some modifications in the registry hives the ExchangeDiagnosticsDailyPerformanceLog got missing from Task Scheduler, performance
    monitor and was also missing from the location C:\Windows\System32\Tasks\Microsoft\Windows\PLA
    Afterwards he did many troubleshooting steps to this issue.
    Actually we don’t need to export/import templates key to XML file. We can just delete both ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog entries from the above registry location and then reboot server. After rebooting server,
    the new default ExchangeDiagnosticsDailyPerformanceLog will be recreated automatically in the task scheduler and performance monitor.
    Here are my suggested steps for ference:
    Ensure that the templates key are present under
    HKLM\Software\Microsoft\PLA\Templates
    Locate to
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\ExchangeDiagnosticsDailyPerformanceLog and delete ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog entries.
    Reboot server and go to registry to check if that two entries have been recreated.
    Check if default ExchangeDiagnosticsDailyPerformanceLog was recreated in task scheduler and performance monitor.
    If this issue persists, please let me know.
    Best Regards.

  • Exchange 2013 - The Microsoft Exchange Transport service is rejecting message submissions because the service continues to consume more memory than the configured threshold

    Noticed at about noon that no emails had been received all day. Began to investigate and found that the MS Exchange Transport service had been set to deny email submission because it was using too much memory on the server (91%). 
    The error message makes me think that we may have been getting used by malware or something similar.“The Microsoft Exchange Transport service is rejecting message submissions because the service continues to consume more memory than the
    configured threshold.” 
    There are also several warning messages that list particular IP addresses and say that a connection from that IP was denied because there were already the maximum number of connections (20). 
    From what I can tell, all of the IP addresses are from Taiwan. 
    The time period for which some emails may be missing is from close of business yesterday ( 4/3/2014) through about 12:45 today (4/4/2014). 
    From the time I spent reading and trying to figure out the error, I think we may need to readjust our throttling policies to prevent this from happening. 
    The exchange server is currently running at 90%+ CPU and 50%+ memory usage the majority of the time, and I’m not sure how to fix it.
    Also, I cannot get into EMS I get a access denied message from the destination computer. (Exchange server) I want to get into there to change the throttling policy back to default, since we disabled it.
    The Error reads:
    The WinRM client cannot process the request. The WinRM client tried to use Kerberos authentication mechanism, but the destination computer <Exchange> returned an 'access denied' error. Change the configuration to allow Kerberos authentication
    mechanism to be used or specify one of the authentication mechanism supported by the server. (How do I do this?) To use Kerberos, specify the local computer name as the remote destination. (I'm trying to use EMS while logged into the local Exchange server)
    Also verify that the client computer and the destination computer are joined to a domain. (Exchange is on our domain, and the computer trying to connect is the same computer) To use basic, specify the local computer name as the remote destination, specify
    Basic authentication and provide user mane and password. Possible authentication mechanisms reported by server.
    At line:1 char:1
    + New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed
    I assumed control of this exchange system already in place and I do not have much experience with exchange 2013 or server 2012. I do know 2008, but that doesn't help very much in this situation.
    Recent changes to the system:
    About three days ago we switch our sessions policy to allow many more connections, and I believe this caused the issue. This is what I changed it to:
    Made the registry DWORD (32-bit) "Maximum Allowed Sessions Per User" and modified the value to 1000. Location of registry change @ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
    I just changed it to 10 from the 1000. I'm hoping this solves this. So far no.
    Also, I am not the best in the shell or command line interfaces. Any help would be wonderful!

    Hi,
    Yes, could be hardware performance issue. Try recycle the Transport process and see if the issue persists.
    Thanks,
    Simon Wu
    TechNet Community Support

  • Microsoft Exchange Transport Service has been stopped.

    I changed out failing drives on a customers SBS 2011 which uses Intel Rapid Storage Technology. I saw that it had an option to email a failing condition to up to three addresses. I configured it but got the Could Not Connect error from the RST software.
    I Googled the condition and determined that I needed to install another Receive Connector on a different port, which is what I tried.
    I opened all of the receive connectors in the MS Exchange Console - Server Configuration - Hub Transport section. As far as I know I did not change anything there, I just looked and cancelled. None of the new receive connectors I configured worked., Everytime
    one configuration made no difference I deleted the connector, re added a connector using different options and tried the RST email test again.
    Getting nowhere, I deleted the last new connector I configured, Closed the Exchange management console figuring I had a job for some time in the future when things were slow.
    This morning I get the call No e-mail, and found the Exchange Transport Service stopped. I restarted it, made sure it was set to automatic, and it ran for about 3 minutes and then stopped. Right now I am keeping my customer working by starting the service
    every 5 to 10 minutes.
    Since I am not going to stay here indefinitely restarting the service, I need help!
    J R Weymouth

    Thanks for the links, I'll check them out. I finally got an error from the logs, in fact there are so many errors in the log I don't even know which one to follow. It gets a cluster of errors every 5 minutes (6 errors one critical) but that is when the transport
    is shut down. I am relaying the first message that comes up after I restart the transport.
    Log Name:      Application
    Source:       
    MSExchangeTransport
    Date:         
    9/16/2014 9:11:48 AM
    Event ID:      17003
    Task Category: Storage
    Level:        
    Error
    Keywords:      Classic
    User:         
    N/A
    Computer:      SBSSRVR2011.MyDomain.local
    Description:
    Sender Reputation Database: An operation has encountered a fatal error. The database may be corrupted. The Microsoft Exchange Transport service is shutting down. Manual database recovery or repair may be required. Exception details: Microsoft.Exchange.Isam.IsamDbTimeCorruptedException:
    Dbtime on current page is greater than global database dbtime (-344)
       at Microsoft.Exchange.Isam.JetInterop.MJetDelete(MJET_TABLEID tableid)
       at Microsoft.Exchange.Isam.Interop.MJetDelete(MJET_TABLEID tableid)
       at Microsoft.Exchange.Transport.Storage.DataTableCursor.DeleteCurrentRow()
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchangeTransport" />
        <EventID Qualifiers="49156">17003</EventID>
        <Level>2</Level>
        <Task>17</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-09-16T16:11:48.000000000Z" />
        <EventRecordID>1141638</EventRecordID>
        <Channel>Application</Channel>
        <Computer>SBSSRVR2011.BainInsuranceAgency.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>Sender Reputation Database</Data>
        <Data>Microsoft.Exchange.Isam.IsamDbTimeCorruptedException: Dbtime on current page is greater than global database dbtime (-344)
       at Microsoft.Exchange.Isam.JetInterop.MJetDelete(MJET_TABLEID tableid)
       at Microsoft.Exchange.Isam.Interop.MJetDelete(MJET_TABLEID tableid)
       at Microsoft.Exchange.Transport.Storage.DataTableCursor.DeleteCurrentRow()</Data>
      </EventData>
    </Event>
    J R Weymouth

  • Microsoft Exchange Transport Service....Starting (Does not reach a running state, stops and tries starting again)

    Hi All,
    After installing the lovely update (https://technet.microsoft.com/library/security/ms14-068) that Microsoft released last week. I restarted my exchange 2013 server and now the Microsoft Exchange Transport Service will not start. It is pretty much constantly
    in a starting state. Tried all the standard stuff, restarting the server etc.
    Running on Server 2012 R2
    Hopefully someone can shed some light.
    Pete

    Hi,
    A few questions here :
    - Have you installed all roles on the same server ? ( MultiRole server )
    - If yes, do use the preconfigured receive connectors from Exchange or did you add custom connectors ?
    - Do you have any anti-spam service installed on the server that could be listening on port 25 ?

  • DAG - Backup failing on 1 DB only with error - The Microsoft Exchange Replication service VSS Writer instance ID failed with error code 80070020 when preparing for a backup of database 'DB012'

    Hi Board,
    i´ve search across the board, technet and symantec sites but did not found a hint about my problem.
    we drive a 2 node DAG (Location1-Ex1-mb1 
    Location2-exc1-mb1), on SP2 RU4 patchlevel with 40 Databases.
    Since some time the backup of one - and only one DB - is failing with these events, logged on the Mailboxserver on which the passive DB is hosted.
    Log Name:      Application
    Source:        MSExchangeRepl
    Date:          28.09.2012 00:37:17
    Event ID:      2112
    Task Category: Exchange VSS Writer
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Location1-Exc1-MB1
    Description: The Microsoft Exchange Replication service VSS Writer instance 1ab7d204-609a-4aea-b0a7-70afb0db38de failed with error code 80070020 when preparing for a backup of database 'DB012'.
    Followed by
    Log Name:      Application
    Source:        MSExchangeRepl
    Date:         
    01.10.2012 03:33:06
    Event ID:      2024
    Task Category: Exchange VSS Writer
    Level:         Error
    Keywords:      Classic
    User:         
    N/A
    Computer:      Location1-Exc1-MB1
    Description:
    The Microsoft Exchange Replication service VSS Writer (Instance 42916d80-36c1-4f73-86d0-596d30226349) failed with error 80070020 when preparing for a backup.
    The backup Application - Symantec Backup Exec 2010 R3 – states, this error
    Snapshot provider error (0xE000FED1): A failure occurred querying the Writer status.
    Check the Windows Event Viewer for details.
    Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: The VSS Writer failed, but the operation can be retried (0x800423f3), State: Stable (1).
    Symatec suggests within http://www.symantec.com/business/support/index?page=content&id=TECH184095
    to restart the MS Exchange Replication Service – BUT the mentioned eventID
    8229 isn´t present on any of the both Mailboxservers.
    The affected Database is active on Location2-Exc1-Mb1 Server and in an overall healthy state. I found during my research, that below Location2-Exc1-Mb1 Server, there are not removed shadow copies present!
    This confuses me, since all Backups are normally taken from the passive copy of a Database.
    So my questions to the board are:
    * Does anyone is facing similar issues?
    * Can someone explain why snapshots are present on the Mailboxserver hosting the Active Database, whilst the errors are logged on the passive one?
    -          * Does someone know the conditions, why shadows copies remain and
    aren´t removed in a proper manner?
    What can cause the circumstance, that only 1 DB is facing such issues?
    Any suggestion is welcome!
    BR
    Markus

    Hi Lenora,
    I´ve encreases VSS / Exchange Backup Log levels to expert, before starting
    those things i´ve all tried now:
    - Backup from passive DB (forced within Symantec Backup Exec)
    - Backup from active DB (forced within Symantec Backup Exec)
    - Backup from passive DB without GRT enabled (forced within Symantec Backup Exec)
    - Backup from active DB without GRT enabled(forced within Symantec Backup Exec)
    All those attempts failed.
    But brought some more details - the backup against the active DB states, that there is still a backup in progress and therefore this backup is cancelled by VSS.
    The Solution was, that i´ve needed to restart the Exchange Replication Service on the Mailbox Server hosting the passive DB.
    Backups are working again on all DBs!
    THX for your replys.
    Best regards
    Markus

  • Exchange Server 2013 SP1 CU5 - The Microsoft Exchange Replication service VSS Writer encountered an exception

    We have 2 server DAG with a witness all servers are Server 2012 R2.  Both members of the DAG are Exchange 2013 SP1 CU5.
    We haven't seen this until recently, but during a VSS enabled storage snapshot the following errors occur.  All of which are related to MSExchangeRepl and the Exchange VSS Writer.
    Event IDs 2140, 2026, 2028, 2030.
    The errors start with the 2140 seen here:
    The Microsoft Exchange Replication service VSS Writer encountered an exception in function Microsoft::Exchange::Cluster::ReplicaVssWriter::CReplicaVssWriterInterop::PrepareSnapshot. HResult -2147467259. Exception Microsoft.Mapi.MapiExceptionDatabaseError: MapiExceptionDatabaseError:
    Unable execute Prepare on snapshot. (hr=0x80004005, ec=1108)
    Diagnostic context:
        Lid: 1494    ---- Remote Context Beg ----
        Lid: 56264   StoreEc: 0x1388    
        Lid: 46280   StoreEc: 0x454     
        Lid: 1750    ---- Remote Context End ----
        Lid: 59216  
        Lid: 34640   StoreEc: 0x454     
        Lid: 52264  
        Lid: 46120   StoreEc: 0x454     
       at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException)
       at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException)
       at Microsoft.Mapi.ExRpcAdmin.ProcessSnapshotOperation(Guid mdbGuid, SnapshotOperationCode operationCode, UInt32 flags)
       at Microsoft.Exchange.Cluster.Replay.StoreRpcController.<>c__DisplayClass1c.<SnapshotPrepare>b__1b()
       at Microsoft.Exchange.Cluster.Replay.SafeRefCountedTimeoutWrapper.<>c__DisplayClass2.<ProtectedCallWithTimeout>b__0()
       at Microsoft.Exchange.Data.HA.InvokeWithTimeout.Invoke(Action invokableAction, Action foregroundAction, TimeSpan invokeTimeout, Boolean sendWatsonReportNoThrow, Object cancelEvent)
       at Microsoft.Exchange.Cluster.Replay.SafeRefCountedTimeoutWrapper.ProtectedCallWithTimeout(String operationName, TimeSpan timeout, Action operation)
       at Microsoft.Exchange.Cluster.ReplicaVssWriter.CReplicaVssWriterInterop.SnapshotPrepare(Guid dbGuid, UInt32 flags)
       at Microsoft.Exchange.Cluster.ReplicaVssWriter.CReplicaVssWriterInterop.PrepareSnapshot().

    Hi Julez K,
    According to your description, you could try upgrading to CU6.
    In addition, you could review the Exchange Application (App) Event log and the Exchange System (Sys) Event log for errors , and some related resolutions for your reference.
    http://www.symantec.com/business/support/index?page=content&id=TECH209938
    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
    or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
    Hope it can be helpful.
    Best regards,
    Eric

  • Get-mailboxdatabasecopystatus -identity DBNAME | fl gives errors "The Microsoft Exchange Replication service encountered an error while attempting to start a replication instance for". DB is mounted and the DB copies are in healthy status.

    We are getting a SCOM alert " Database copy isn''''t keeping up with the changes on the active database copy and has failed."
    When we go to the mailbox server and check we found all the Mailbox DB's are mounted properly and their copies are in healthy state. Further digging to this problem we found that there are no critical events to this DB in the eventviewer.
    When we runt he get-mailboxdatabasecopystatus -identity DBNAME | Fl then in the ErrorMessage section we get error "The Microsoft Exchange Replication service encountered an error while attempting to start a replication instance for . If the copy doesn't
    recover automatically, administrator intervention may be necessary. Error: The directory is not empty."
    ErrorEventID : 4126
    In the event viewer we get a Information event 4114 saying the DB redundancy health check passed and in the details section we get the same error message mentioned above.
    Also we observed that the "MSExchange Replication" counter "Failed" is set to 1 for this perticular DB but is is set to 0 for the other DB's. Tried restarting the MSEXChange replication service but still the "Failed" counter
    is 1 and the SCOM alert is still active.
    The version is Exchange 2010 SP3 UR5
    Any clues???

    Hi,
    From your description, this issue only affect one mailbox datatabase.
    Please use the Update-MailboxDatabaseCopy command to check result.
    If it doesn't work, please dismount your active database copy and check if this is Clean Shutdown, if it's dirty shutdown, please bring to clean shutdown and mount this database copy. Then run the Update-MailboxDatabaseCopy command again to check result.
    Best regards,
    Belinda Ma
    TechNet Community Support

  • SBS2011 - microsoft exchange transport service not installed

    i have been having issues with SMTP and now with some changes advised I have lost the MS exchange Transport service all together - it is not listed under services!
    how to I re-install just the transport service - and more - where did it go???
    KArl

    Hi:
    Can't really tell from here what happened, but please review this article and let us know if it helps:
    http://technet.microsoft.com/en-us/library/gg680345.aspx
    Larry Struckmeyer[MVP] If your question is answered please mark the response as the answer so that others can benefit.

  • Microsoft Exchange Replication Service keep stopping

    Not sure what is going on here. The replication service keep stopping on one of my servers within the DAG. I cant think of anything different about this server compared to others (anything known at least). This server sits at our DR facility and is the host
    of the 3rd copy to a few of our databases, which primary and secondary ones live at our HQ. The application log reports this every 5-10 seconds
    Watson report about to be sent for process id: 31860, with parameters: E12IIS, c-RTL-AMD64, 15.00.0995.029, msexchangerepl, M.Exchange.Common, M.E.C.H.DatabaseFailureItem.Parse, System.ArgumentOutOfRangeException, fe19, 15.00.0995.012.
    ErrorReportingEnabled: False 
    The system log reports this every 5-10 seconds also:
    The Microsoft Exchange Replication service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    I have ran windows update, and it seems that every time I reboot the machine, the shutdown tracker comes up. I think it has something to do with hardware, but no idea where to look next. 

    Hi,
    This issue occurred because Microsoft Exchange Replication Services Was Unable to Write In "Microsoft-Exchange-MailboxDatabaseFailureItems/Operational"
    The fix for the issue will be available in next cumulative update. Meanwhile, please follow the steps below for a workaround to resolve the issue. This workaround is to clear the entries log storing mailbox database failure items.
    On problem server, open command prompt in administrator privileges.
    Run following command to clear the even entries from the log
    Wevtutil.exe cl "Microsoft-Exchange-MailboxDatabaseFailureItems/Operational"
    Best Regards.

  • Information Store service terminated unexpectedly, event id 7031

    We have Exchange 2010 (coexistence with 2003) running SP3 and a DAG with two members. It now happens occasionally that suddenly all mailstores are running on mailbox server. I had them balanced (manually) on one, so I examined the event viewer. There I saw
    The Microsoft Exchange Information Store service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    EVENT ID 7031
    A few seconds later it is started again. But since several mailstores are running on it, it takes some time before all stores are mounted again and so users complain that Outlook disconnects. The time it is down, is too short for the DAG to switch over to
    the replica, so we have a real downtime here.
    Is this a known issue and what can we do for this? I really need to fix this ASAP as you can understand, since we have like 1500 users already now on this environment. I saw this fix:
    http://support.microsoft.com/default.aspx?kbid=2803727
    In there also two issues with information store being stopped are reported here. 
    Thanks for all your help!

    Thanks Gulab,
    No, no major change. We are only moving mailboxes now from the old 2003 to the new 2010 server. I have seen that this happened for a long time already, but probably never during working hours. There is no actual trend. Today it happened once. Yesterday it
    happened like 5 times. other days, just once a day, a few times never.
    We are running TM Scanmail.
    Here the full details
    System
    Provider
    [ Name]
    Service Control Manager
    [ Guid]
    {555908d1-a6d7-4695-8e1e-26931d2012f4}
    [ EventSourceName]
    Service Control Manager
    EventID
    7031
    [ Qualifiers]
    49152
    Version
    0
    Level
    2
    Task
    0
    Opcode
    0
    Keywords
    0x8080000000000000
    TimeCreated
    [ SystemTime]
    2014-01-14T09:16:32.732892000Z
    EventRecordID
    90280
    Correlation
    Execution
    [ ProcessID]
    672
    [ ThreadID]
    6532
    Channel
    System
    Computer
    xxx162.eu.ykgw.net
    Security
    EventData
    param1
    Microsoft Exchange Information Store
    param2
    1
    param3
    5000
    param4
    1
    param5
    Restart the service
    4D005300450078006300680061006E0067006500490053000000

  • Unable to initialize the Microsoft Exchange Information Store service because the clocks on the client and on the server machine are skewed

    Each time I restart this exchange server, the Information Store and System Attendant don't start. If It try to manually start the services, I get the follow errors:
    Event ID 5003:
    Unable to initialize the Microsoft Exchange Information Store service because the clocks on the client and on the server machine are skewed. This may be caused by a time change either in the client or the server machine, and may require a reboot of that machine. Other than that, verify that your domain is properly configured and is currently online.
    Event ID 1005:
    Unexpected error The clocks on the client and server machines are skewed. ID no: 80090324 Microsoft Exchange System Attendant  occurred.
    The clocks on the domain controllers and the exchange server are set to the same time zones. As well, all three clocks are in sync down to the second. Any ideas on what's causing this and how to fix it?

    Run this Command from the Exchange Server
    Net time \\ADServerName /Set
    and confirm the action,
    and then you need to restart the service
    Microsoft Exchange Active Directory Topology Service
    and confirm you are not getting the Error 4001 in the event Viewer.
    Thank you, it resolved my issue after being sweating looking for solution.
    How can I prevent this from happening? I cannot restart services on each server reboot nor lose 5 years of my life!!!
    Sokratis Laskaridis MCP, MCTS, MCITP, Small Business Specialist Netapp ASAP, Symantec STS

  • Microsoft.Exchange.AddressBook.Service.exe 100% CPU Usage

    Hi,
    We have an exchange server 2010 and the Microsoft.Exchange.AddressBook.Service.exe used 100% CPU Usage suddenly. However, after rebooting the server, the CPU Usage of the above .exe is back to normal. Client cannot connect to the exchange server during
    the high CPU Usage of the above .exe.
    Any ideas for the above problems? Thank You.

    Hi
       Microsoft.Exchange.AddressBook.Service.exe is related to OAB function.
       Maybe mobile or client fails to download will cause this problem.
    What was the fix for this?

  • Can't install Microsoft Exchange Web Services Managed API 2.0 - message says it is already installed but it is not.

    I tried to install the Microsoft Exchange Web Services Managed API 2.0 but I got a message saying it was already installed and that I should un-install it.  However it does not appear in the control panel un-install a program list.  I am using
    VS2013 on windows 8.  What can I do to get it to work?
    Mike VE

    Hello,
    Thank you for your sharing.
    If you have any feedback on our support, please click
    here
    Cara Chen
    TechNet Community Support

Maybe you are looking for