"The Microsoft Exchange Diagnostics service terminated unexpectedly"

Hi all, this happens about twice per hour and started some days ago, no reconfigs etc that should make it do that as far as I can find. Have been running CU6 for some months without this happening until recently.
Also getting AppEventID 1007:
Failed to create or start performance logs with error: System.ArgumentException: Value does not fall within the expected range.
   at PlaLibrary.DataCollectorSetClass.start(Boolean Synchronous)
   at Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogSet.StartLog(Boolean synchronous)
   at Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogMonitor.CheckPerflogStatus(). Performance log: ExchangeDiagnosticsPerformanceLog.
Found this article
http://blogs.technet.com/b/anya/archive/2014/11/25/microsoft-exchange-diagnostics-service-crashing-post-cu6-upgrade.aspx, but I do not actually understand what the "fix" really is here, many steps are made for Diagnostics buth which
of those are necessary to take? And I'm not so into exporting/importing those XMLs.. I have only one E2013-server also.
Hope someone can clarify this. I was thinking of installing CU7 if that might fix it, but I'm not sure if I dare in danger of running into trouble with things not working as they should.
Thanks,
-Ray.

Hi,
Based on the description of that article, the root issue was due to upgrade. While upgrading to Exchange 2013 CU6, the upgrade did some modifications in the registry hives the ExchangeDiagnosticsDailyPerformanceLog got missing from Task Scheduler, performance
monitor and was also missing from the location C:\Windows\System32\Tasks\Microsoft\Windows\PLA
Afterwards he did many troubleshooting steps to this issue.
Actually we don’t need to export/import templates key to XML file. We can just delete both ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog entries from the above registry location and then reboot server. After rebooting server,
the new default ExchangeDiagnosticsDailyPerformanceLog will be recreated automatically in the task scheduler and performance monitor.
Here are my suggested steps for ference:
Ensure that the templates key are present under
HKLM\Software\Microsoft\PLA\Templates
Locate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\ExchangeDiagnosticsDailyPerformanceLog and delete ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog entries.
Reboot server and go to registry to check if that two entries have been recreated.
Check if default ExchangeDiagnosticsDailyPerformanceLog was recreated in task scheduler and performance monitor.
If this issue persists, please let me know.
Best Regards.

Similar Messages

Event ID 7031 followed by 7032 The Microsoft Exchange Transport service terminated unexpectedly.

Hello
Have a strange problem that reoccurs every day. The following are recorded in the log.
7031
The Microsoft Exchange Transport service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.7032The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Exchange Transport service, but this action failed with the following error:
An instance of the service is already running.Any suggestions are welcome./Deland
/Andreas

Here are the result from the level 5 logging. I Havent disabled the TransportAgent yet.
Log Name:      Application
Source:        MSExchangeTransport
Date:          2013-07-19 10:13:25
Event ID:      12025
Task Category: TransportService
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Transport service is disconnecting performance counters with process lifetime from their old process.
Followed by 32 events of 12028
Log Name:      Application
Source:        MSExchangeTransport
Date:          2013-07-19 10:13:25
Event ID:      12028
Task Category: TransportService
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
The process with process ID 1100 is holding the performance counter configuration cache total requests Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062 from instance transportrules(B1D082BB) RefCount=0 SpinLock=0 Offset=3936
and category MSExchangeTransport Configuration Cache while running processes are: Processes running are:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
And 28 events on 106
Log Name:      Application
Source:        MSExchange Common
Date:          2013-07-19 10:13:29
Event ID:      106
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Performance counter updating error. Counter name is DataRow seeks total, category name is MSExchangeTransport Database. Optional code: 2. Exception: The exception thrown is : System.InvalidOperationException: Instance '_total' already exists with a lifetime
of Process. It cannot be recreated or reused until it has been removed or until the process using it has exited.
   at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime
lifetime, Boolean& foundFreeInstance)
   at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.get_RawValue()
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.get_RawValue()
Last worker process info : System.ArgumentException: Process with an Id of 14868 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Processes running while Performance counter failed to update:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
10416 EdgeTransport
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
15116 conhost
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=59 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : queue(B351294)
RefCount=0 SpinLock=0 Offset=48552, categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 8(ED0419E7) RefCount=0 SpinLock=0 Offset=44384,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 6(ED0419E9) RefCount=0 SpinLock=0 Offset=40216,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=4 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 3(ED0419EC) RefCount=0 SpinLock=0 Offset=36048,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=3 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 1(ED0419EE) RefCount=0 SpinLock=0 Offset=31880,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=18 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat(B874BB3) RefCount=0 SpinLock=0 Offset=27712,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : inqueue(56145953) RefCount=0 SpinLock=0 Offset=23544,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=17 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : smtpin(81392C98) RefCount=0 SpinLock=0 Offset=19376,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : mail(7C6FB7CC) RefCount=0 SpinLock=0 Offset=15208,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=68 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : other(ADC98A1) RefCount=0 SpinLock=0 Offset=11040,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 4832, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4832 StartupTime: 130183498009738545, currentInstance : _total(CFBEE918) RefCount=1 SpinLock=0 Offset=32,
categoryName: MSExchangeTransport Database
Log Name:      Application
Source:        MSExchange Common
Date:          2013-07-19 10:13:31
Event ID:      106
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      XXXX
Description:
Performance counter updating error. Counter name is Transaction Durable Callback Count/sec, category name is MSExchangeTransport Database. Optional code: 1. Exception: The exception thrown is : System.InvalidOperationException: Instance '_total' already exists
with a lifetime of Process. It cannot be recreated or reused until it has been removed or until the process using it has exited.
   at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime
lifetime, Boolean& foundFreeInstance)
   at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.IncrementBy(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.IncrementBy(Int64 incrementValue)
Last worker process info : System.ArgumentException: Process with an Id of 14868 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Processes running while Performance counter failed to update:
6300 UMWorkerProcess
5312 Microsoft.Exchange.ServiceHost
1568 Microsoft.Exchange.Diagnostics.Service
2212 WMSvc
776 svchost
1760 MSExchangeHMHost
9808 MSExchangeDelivery
376 explorer
2252 Microsoft.Exchange.Directory.TopologyService
9436 rundll32
1752 nscp
2932 noderunner
10416 EdgeTransport
6076 MSExchangeSubmission
7056 scanningprocess
1736 PccNtMon
1340 fms
4688 MSExchangeTransport
1732 Ntrtscan
2716 MSExchangeMailboxAssistants
548 winlogon
9016 TmProxy
348 svchost
2904 SMSvcHost
1524 inetinfo
15116 conhost
8376 TMBMSRV
5264 MSExchangeThrottling
12552 powershell
4080 w3wp
1124 svchost
7688 svchost
12744 w3wp
332 smss
1316 svchost
13188 mmc
5772 ForefrontActiveDirectoryConnector
3080 HostedAgent
11364 conhost
3268 w3wp
1060 svchost
2924 noderunner
904 dwm
3856 w3wp
504 wininit
7200 Microsoft.Exchange.Store.Worker
1668 SMSvcHost
4832 MSExchangeFrontendTransport
2072 sftracing
4932 MSExchangeMailboxReplication
7192 Microsoft.Exchange.Store.Worker
6992 Microsoft.Exchange.UM.CallRouter
9640 w3wp
9204 svchost
3244 svcGenericHost
1200 Microsoft.Exchange.Store.Service
876 svchost
10724 rundll32
3040 conhost
2480 w3wp
5992 MSExchangeTransportLogSearch
596 services
12508 w3wp
2636 MSExchangeHMWorker
11892 taskhostex
4796 Microsoft.Exchange.Search.Service
3568 WmiPrvSE
12532 ServerManager
9564 msdtc
4352 Microsoft.Exchange.EdgeSyncSvc
2032 mqsvc
6560 scanningprocess
3404 TmListen
4384 updateservice
3004 scanningprocess
6744 umservice
1424 hostcontrollerservice
828 svchost
432 csrss
696 svchost
1284 spoolsv
8152 w3wp
3576 w3wp
1264 svchost
496 csrss
5928 Microsoft.Exchange.RpcClientAccess.Service
2972 noderunner
2380 conhost
604 lsass
6884 Microsoft.Exchange.Store.Worker
10056 WmiPrvSE
992 svchost
2764 noderunner
5324 msexchangerepl
4 System
3548 Microsoft.Exchange.AntispamUpdateSvc
2168 svchost
0 Idle
Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=59 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : queue(B351294)
RefCount=0 SpinLock=0 Offset=48552, categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 8(ED0419E7) RefCount=0 SpinLock=0 Offset=44384,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 6(ED0419E9) RefCount=0 SpinLock=0 Offset=40216,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=4 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 3(ED0419EC) RefCount=0 SpinLock=0 Offset=36048,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=3 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat event 1(ED0419EE) RefCount=0 SpinLock=0 Offset=31880,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=18 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : cat(B874BB3) RefCount=0 SpinLock=0 Offset=27712,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : inqueue(56145953) RefCount=0 SpinLock=0 Offset=23544,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 1100, counter : datarow seeks total Value=17 SpinLock=0 Lifetime=Type: 1 ProcessId: 1100 StartupTime: 130186827159405062, currentInstance : smtpin(81392C98) RefCount=0 SpinLock=0 Offset=19376,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 10416, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10416 StartupTime: 130186952059962770, currentInstance : mail(7C6FB7CC) RefCount=1 SpinLock=0 Offset=15208,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 10416, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10416 StartupTime: 130186952059962770, currentInstance : other(ADC98A1) RefCount=1 SpinLock=0 Offset=11040,
categoryName: MSExchangeTransport Database
A process is holding onto a transport performance counter. processId : 4832, counter : datarow seeks total Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4832 StartupTime: 130183498009738545, currentInstance : _total(CFBEE918) RefCount=1 SpinLock=0 Offset=32,
categoryName: MSExchangeTransport Database
Then ESE Recovery starts on the Transport database.
/Andreas

Microsoft Exchange Transport service terminated unexpectedly

Hi All,
We have configured exchange 2013 in windows server 2012. From last two days exchange transport service getting stopped.
Microsoft Exchange Transport service terminated unexpectedly.
Log Name:      System
Source:        Service Control Manager
Date:          11/13/2014 1:10:28 AM
Event ID:      7031
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      BMBPRMBX01.BMB.LOCAL
Description:
The Microsoft Exchange Transport service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Hi,
This issue may due to some of the corrupt message in the queue. Please try these steps to solve this issue.
Pause the transport service and let all the messaged go out.
When queue is empty, stop the transport service and go to the mail.que database in transport-->queue folder. Cut paste all the files from queue folder to some other folder as backup.
Now start the transport service, it will create a fresh mail.que database and observe if the service us crashing again.
In addition, please try to disable any AV software, sometimes it will cause Transport service corrupted.
Best Regards.

DAG - Backup failing on 1 DB only with error - The Microsoft Exchange Replication service VSS Writer instance ID failed with error code 80070020 when preparing for a backup of database 'DB012'

Hi Board,
i´ve search across the board, technet and symantec sites but did not found a hint about my problem.
we drive a 2 node DAG (Location1-Ex1-mb1
Location2-exc1-mb1), on SP2 RU4 patchlevel with 40 Databases.
Since some time the backup of one - and only one DB - is failing with these events, logged on the Mailboxserver on which the passive DB is hosted.
Log Name:      Application
Source:        MSExchangeRepl
Date:          28.09.2012 00:37:17
Event ID:      2112
Task Category: Exchange VSS Writer
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Location1-Exc1-MB1
Description: The Microsoft Exchange Replication service VSS Writer instance 1ab7d204-609a-4aea-b0a7-70afb0db38de failed with error code 80070020 when preparing for a backup of database 'DB012'.
Followed by
Log Name:      Application
Source:        MSExchangeRepl
Date:
01.10.2012 03:33:06
Event ID:      2024
Task Category: Exchange VSS Writer
Level:         Error
Keywords:      Classic
User:
N/A
Computer:      Location1-Exc1-MB1
Description:
The Microsoft Exchange Replication service VSS Writer (Instance 42916d80-36c1-4f73-86d0-596d30226349) failed with error 80070020 when preparing for a backup.
The backup Application - Symantec Backup Exec 2010 R3 – states, this error
Snapshot provider error (0xE000FED1): A failure occurred querying the Writer status.
Check the Windows Event Viewer for details.
Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: The VSS Writer failed, but the operation can be retried (0x800423f3), State: Stable (1).
Symatec suggests within http://www.symantec.com/business/support/index?page=content&id=TECH184095
to restart the MS Exchange Replication Service – BUT the mentioned eventID
8229 isn´t present on any of the both Mailboxservers.
The affected Database is active on Location2-Exc1-Mb1 Server and in an overall healthy state. I found during my research, that below Location2-Exc1-Mb1 Server, there are not removed shadow copies present!
This confuses me, since all Backups are normally taken from the passive copy of a Database.
So my questions to the board are:
* Does anyone is facing similar issues?
* Can someone explain why snapshots are present on the Mailboxserver hosting the Active Database, whilst the errors are logged on the passive one?
-          * Does someone know the conditions, why shadows copies remain and
aren´t removed in a proper manner?
What can cause the circumstance, that only 1 DB is facing such issues?
Any suggestion is welcome!
BR
Markus

Hi Lenora,
I´ve encreases VSS / Exchange Backup Log levels to expert, before starting
those things i´ve all tried now:
- Backup from passive DB (forced within Symantec Backup Exec)
- Backup from active DB (forced within Symantec Backup Exec)
- Backup from passive DB without GRT enabled (forced within Symantec Backup Exec)
- Backup from active DB without GRT enabled(forced within Symantec Backup Exec)
All those attempts failed.
But brought some more details - the backup against the active DB states, that there is still a backup in progress and therefore this backup is cancelled by VSS.
The Solution was, that i´ve needed to restart the Exchange Replication Service on the Mailbox Server hosting the passive DB.
Backups are working again on all DBs!
THX for your replys.
Best regards
Markus

Exchange 2013 - The Microsoft Exchange Transport service is rejecting message submissions because the service continues to consume more memory than the configured threshold

Noticed at about noon that no emails had been received all day. Began to investigate and found that the MS Exchange Transport service had been set to deny email submission because it was using too much memory on the server (91%).
The error message makes me think that we may have been getting used by malware or something similar.“The Microsoft Exchange Transport service is rejecting message submissions because the service continues to consume more memory than the
configured threshold.”
There are also several warning messages that list particular IP addresses and say that a connection from that IP was denied because there were already the maximum number of connections (20).
From what I can tell, all of the IP addresses are from Taiwan.
The time period for which some emails may be missing is from close of business yesterday ( 4/3/2014) through about 12:45 today (4/4/2014).
From the time I spent reading and trying to figure out the error, I think we may need to readjust our throttling policies to prevent this from happening.
The exchange server is currently running at 90%+ CPU and 50%+ memory usage the majority of the time, and I’m not sure how to fix it.
Also, I cannot get into EMS I get a access denied message from the destination computer. (Exchange server) I want to get into there to change the throttling policy back to default, since we disabled it.
The Error reads:
The WinRM client cannot process the request. The WinRM client tried to use Kerberos authentication mechanism, but the destination computer <Exchange> returned an 'access denied' error. Change the configuration to allow Kerberos authentication
mechanism to be used or specify one of the authentication mechanism supported by the server. (How do I do this?) To use Kerberos, specify the local computer name as the remote destination. (I'm trying to use EMS while logged into the local Exchange server)
Also verify that the client computer and the destination computer are joined to a domain. (Exchange is on our domain, and the computer trying to connect is the same computer) To use basic, specify the local computer name as the remote destination, specify
Basic authentication and provide user mane and password. Possible authentication mechanisms reported by server.
At line:1 char:1
+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed
I assumed control of this exchange system already in place and I do not have much experience with exchange 2013 or server 2012. I do know 2008, but that doesn't help very much in this situation.
Recent changes to the system:
About three days ago we switch our sessions policy to allow many more connections, and I believe this caused the issue. This is what I changed it to:
Made the registry DWORD (32-bit) "Maximum Allowed Sessions Per User" and modified the value to 1000. Location of registry change @ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
I just changed it to 10 from the 1000. I'm hoping this solves this. So far no.
Also, I am not the best in the shell or command line interfaces. Any help would be wonderful!

Hi,
Yes, could be hardware performance issue. Try recycle the Transport process and see if the issue persists.
Thanks,
Simon Wu
TechNet Community Support

Get-mailboxdatabasecopystatus -identity DBNAME | fl gives errors "The Microsoft Exchange Replication service encountered an error while attempting to start a replication instance for". DB is mounted and the DB copies are in healthy status.

We are getting a SCOM alert " Database copy isn''''t keeping up with the changes on the active database copy and has failed."
When we go to the mailbox server and check we found all the Mailbox DB's are mounted properly and their copies are in healthy state. Further digging to this problem we found that there are no critical events to this DB in the eventviewer.
When we runt he get-mailboxdatabasecopystatus -identity DBNAME | Fl then in the ErrorMessage section we get error "The Microsoft Exchange Replication service encountered an error while attempting to start a replication instance for . If the copy doesn't
recover automatically, administrator intervention may be necessary. Error: The directory is not empty."
ErrorEventID : 4126
In the event viewer we get a Information event 4114 saying the DB redundancy health check passed and in the details section we get the same error message mentioned above.
Also we observed that the "MSExchange Replication" counter "Failed" is set to 1 for this perticular DB but is is set to 0 for the other DB's. Tried restarting the MSEXChange replication service but still the "Failed" counter
is 1 and the SCOM alert is still active.
The version is Exchange 2010 SP3 UR5
Any clues???

Hi,
From your description, this issue only affect one mailbox datatabase.
Please use the Update-MailboxDatabaseCopy command to check result.
If it doesn't work, please dismount your active database copy and check if this is Clean Shutdown, if it's dirty shutdown, please bring to clean shutdown and mount this database copy. Then run the Update-MailboxDatabaseCopy command again to check result.
Best regards,
Belinda Ma
TechNet Community Support

Exchange Server 2013 SP1 CU5 - The Microsoft Exchange Replication service VSS Writer encountered an exception

We have 2 server DAG with a witness all servers are Server 2012 R2. Both members of the DAG are Exchange 2013 SP1 CU5.
We haven't seen this until recently, but during a VSS enabled storage snapshot the following errors occur. All of which are related to MSExchangeRepl and the Exchange VSS Writer.
Event IDs 2140, 2026, 2028, 2030.
The errors start with the 2140 seen here:
The Microsoft Exchange Replication service VSS Writer encountered an exception in function Microsoft::Exchange::Cluster::ReplicaVssWriter::CReplicaVssWriterInterop::PrepareSnapshot. HResult -2147467259. Exception Microsoft.Mapi.MapiExceptionDatabaseError: MapiExceptionDatabaseError:
Unable execute Prepare on snapshot. (hr=0x80004005, ec=1108)
Diagnostic context:
Lid: 1494 ---- Remote Context Beg ----
Lid: 56264 StoreEc: 0x1388
Lid: 46280 StoreEc: 0x454
Lid: 1750 ---- Remote Context End ----
Lid: 59216
Lid: 34640 StoreEc: 0x454
Lid: 52264
Lid: 46120 StoreEc: 0x454
at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException)
at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException)
at Microsoft.Mapi.ExRpcAdmin.ProcessSnapshotOperation(Guid mdbGuid, SnapshotOperationCode operationCode, UInt32 flags)
at Microsoft.Exchange.Cluster.Replay.StoreRpcController.<>c__DisplayClass1c.<SnapshotPrepare>b__1b()
at Microsoft.Exchange.Cluster.Replay.SafeRefCountedTimeoutWrapper.<>c__DisplayClass2.<ProtectedCallWithTimeout>b__0()
at Microsoft.Exchange.Data.HA.InvokeWithTimeout.Invoke(Action invokableAction, Action foregroundAction, TimeSpan invokeTimeout, Boolean sendWatsonReportNoThrow, Object cancelEvent)
at Microsoft.Exchange.Cluster.Replay.SafeRefCountedTimeoutWrapper.ProtectedCallWithTimeout(String operationName, TimeSpan timeout, Action operation)
at Microsoft.Exchange.Cluster.ReplicaVssWriter.CReplicaVssWriterInterop.SnapshotPrepare(Guid dbGuid, UInt32 flags)
at Microsoft.Exchange.Cluster.ReplicaVssWriter.CReplicaVssWriterInterop.PrepareSnapshot().

Hi Julez K,
According to your description, you could try upgrading to CU6.
In addition, you could review the Exchange Application (App) Event log and the Exchange System (Sys) Event log for errors , and some related resolutions for your reference.
http://www.symantec.com/business/support/index?page=content&id=TECH209938
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Hope it can be helpful.
Best regards,
Eric

Microsoft Exchange Replication Service keep stopping

Not sure what is going on here. The replication service keep stopping on one of my servers within the DAG. I cant think of anything different about this server compared to others (anything known at least). This server sits at our DR facility and is the host
of the 3rd copy to a few of our databases, which primary and secondary ones live at our HQ. The application log reports this every 5-10 seconds
Watson report about to be sent for process id: 31860, with parameters: E12IIS, c-RTL-AMD64, 15.00.0995.029, msexchangerepl, M.Exchange.Common, M.E.C.H.DatabaseFailureItem.Parse, System.ArgumentOutOfRangeException, fe19, 15.00.0995.012.
ErrorReportingEnabled: False
The system log reports this every 5-10 seconds also:
The Microsoft Exchange Replication service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
I have ran windows update, and it seems that every time I reboot the machine, the shutdown tracker comes up. I think it has something to do with hardware, but no idea where to look next.

Hi,
This issue occurred because Microsoft Exchange Replication Services Was Unable to Write In "Microsoft-Exchange-MailboxDatabaseFailureItems/Operational"
The fix for the issue will be available in next cumulative update. Meanwhile, please follow the steps below for a workaround to resolve the issue. This workaround is to clear the entries log storing mailbox database failure items.
On problem server, open command prompt in administrator privileges.
Run following command to clear the even entries from the log
Wevtutil.exe cl "Microsoft-Exchange-MailboxDatabaseFailureItems/Operational"
Best Regards.

Microsoft.Exchange.AddressBook.Service.exe 100% CPU Usage

Hi,
We have an exchange server 2010 and the Microsoft.Exchange.AddressBook.Service.exe used 100% CPU Usage suddenly. However, after rebooting the server, the CPU Usage of the above .exe is back to normal. Client cannot connect to the exchange server during
the high CPU Usage of the above .exe.
Any ideas for the above problems? Thank You.

Hi
Microsoft.Exchange.AddressBook.Service.exe is related to OAB function.
Maybe mobile or client fails to download will cause this problem.
What was the fix for this?

Can't install Microsoft Exchange Web Services Managed API 2.0 - message says it is already installed but it is not.

I tried to install the Microsoft Exchange Web Services Managed API 2.0 but I got a message saying it was already installed and that I should un-install it. However it does not appear in the control panel un-install a program list. I am using
VS2013 on windows 8. What can I do to get it to work?
Mike VE

Hello,
Thank you for your sharing.
If you have any feedback on our support, please click
here
Cara Chen
TechNet Community Support

Microsoft Exchange Transport Service has been stopped.

I changed out failing drives on a customers SBS 2011 which uses Intel Rapid Storage Technology. I saw that it had an option to email a failing condition to up to three addresses. I configured it but got the Could Not Connect error from the RST software.
I Googled the condition and determined that I needed to install another Receive Connector on a different port, which is what I tried.
I opened all of the receive connectors in the MS Exchange Console - Server Configuration - Hub Transport section. As far as I know I did not change anything there, I just looked and cancelled. None of the new receive connectors I configured worked., Everytime
one configuration made no difference I deleted the connector, re added a connector using different options and tried the RST email test again.
Getting nowhere, I deleted the last new connector I configured, Closed the Exchange management console figuring I had a job for some time in the future when things were slow.
This morning I get the call No e-mail, and found the Exchange Transport Service stopped. I restarted it, made sure it was set to automatic, and it ran for about 3 minutes and then stopped. Right now I am keeping my customer working by starting the service
every 5 to 10 minutes.
Since I am not going to stay here indefinitely restarting the service, I need help!
J R Weymouth

Thanks for the links, I'll check them out. I finally got an error from the logs, in fact there are so many errors in the log I don't even know which one to follow. It gets a cluster of errors every 5 minutes (6 errors one critical) but that is when the transport
is shut down. I am relaying the first message that comes up after I restart the transport.
Log Name:      Application
Source:
MSExchangeTransport
Date:
9/16/2014 9:11:48 AM
Event ID:      17003
Task Category: Storage
Level:
Error
Keywords:      Classic
User:
N/A
Computer:      SBSSRVR2011.MyDomain.local
Description:
Sender Reputation Database: An operation has encountered a fatal error. The database may be corrupted. The Microsoft Exchange Transport service is shutting down. Manual database recovery or repair may be required. Exception details: Microsoft.Exchange.Isam.IsamDbTimeCorruptedException:
Dbtime on current page is greater than global database dbtime (-344)
   at Microsoft.Exchange.Isam.JetInterop.MJetDelete(MJET_TABLEID tableid)
   at Microsoft.Exchange.Isam.Interop.MJetDelete(MJET_TABLEID tableid)
   at Microsoft.Exchange.Transport.Storage.DataTableCursor.DeleteCurrentRow()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MSExchangeTransport" />
    <EventID Qualifiers="49156">17003</EventID>
    <Level>2</Level>
    <Task>17</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-09-16T16:11:48.000000000Z" />
    <EventRecordID>1141638</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SBSSRVR2011.BainInsuranceAgency.local</Computer>
    <Security />
</System>
<EventData>
    <Data>Sender Reputation Database</Data>
    <Data>Microsoft.Exchange.Isam.IsamDbTimeCorruptedException: Dbtime on current page is greater than global database dbtime (-344)
   at Microsoft.Exchange.Isam.JetInterop.MJetDelete(MJET_TABLEID tableid)
   at Microsoft.Exchange.Isam.Interop.MJetDelete(MJET_TABLEID tableid)
   at Microsoft.Exchange.Transport.Storage.DataTableCursor.DeleteCurrentRow()</Data>
</EventData>
</Event>
J R Weymouth

Microsoft Exchange Transport Service....Starting (Does not reach a running state, stops and tries starting again)

Hi All,
After installing the lovely update (https://technet.microsoft.com/library/security/ms14-068) that Microsoft released last week. I restarted my exchange 2013 server and now the Microsoft Exchange Transport Service will not start. It is pretty much constantly
in a starting state. Tried all the standard stuff, restarting the server etc.
Running on Server 2012 R2
Hopefully someone can shed some light.
Pete

Hi,
A few questions here :
- Have you installed all roles on the same server ? ( MultiRole server )
- If yes, do use the preconfigured receive connectors from Exchange or did you add custom connectors ?
- Do you have any anti-spam service installed on the server that could be listening on port 25 ?

The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error. Event 1121

Hello all,
We migrated our Exchange server from 2003 to 2010. After the mailbox move requests were finished we had one that was stuck. We basically skipped it as we had a lot of other things to finish over the weekend. Here we are a year later, the old exchange server
is gone and so is an old DC. I am receiving an error every four minutes in event viewer.
The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error.
Request GUID: '3e46b7cb-2ac0-42c1-98e8-57517a19ee40'
Database GUID: '5c6c573b-4f45-4ce3-b296-11cf69c2e2b6'
Error: Unable to find 'OLD Domain Controller' computer information in domain controller 'OLD Domain Controller' to perform the suitability check. Verify the fully qualified domain name..
I have checked in EMC for move requests. None are listed. I have checked the DCs listed in EMC properties. Old DC is not listed.
I also ran these commands in shell to attempt to cancel the stuck request.
Get-MoveRequest -MoveStatus Completed;Pending;InProgress;Failed;CompletedWithWarning;Suspended;Queued;CompletionWithProgress : Remove-MoveRequest
NO changes. Still throwing error. Any suggestions? I also tried using the guid and shell to look at the move request. Systems replies no such request.

Hello,
Please try to restart iis services to check the result.
If the issue persists, I recommend you ping you DC server on your exchange server to check if your exchange server can communicate with your DC server.
If there are other DCs, please try to use set-adserversettings cmdlet to specify a DC for your exchange server.
Set-AdServerSettings
http://technet.microsoft.com/en-us/library/dd298063(v=exchg.150).aspx
Besides, please install the lasted rollup to check the result.
Cara Chen
TechNet Community Support

The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error. : Error: An Active Directory Constraint Violation error occurred

Hello,
We have a multi domain parent child AD domain infrastructure and now we upgraded our exchange from Exchange 2007 to Exchange 2013. Since last few days, we see the below error on the mailbox server event viewer.
EVENT ID : 1121
The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error.
Request GUID: '93a7d1ca-68a1-4cd9-9edb-a4ce2f7bb4cd'
Database GUID: '83d028ec-439d-4904-a0e4-1d3bc0f58809'
Error: An Active Directory Constraint Violation error occurred on <domain controller FQDN>. Additional information: The name reference is invalid.
This may be caused by replication latency between Active Directory domain controllers.
Active directory response: 000020B5: AtrErr: DSID-0315286E, #1:
Our Exchange setup is in parent domain, but we keep on getting this error for various domain controllers in each child domain in the same site. We then configured one of the parent domain domain controller on Exchange. Still we are getting this error for
the configured parent domain DC.
Verified the AD replication and there is no latency or pending stuffs.
Any support to resolve this issue will be highly appreciated. Thank you in advance.
Regards,
Jnana R Dash

Hi,
In addition to Ed's suggestion, I would like to clarify the following things for troubleshooting:
1. Please restart IIS at first.
2. If the issue persists, please ping your DC on your Exchange server to check if Exchange can communicate with DC.
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error

Since demoting a child domain a few days ago, Exchange 2013 is still trying to contact it and as a result generating errors in the application event logs. I had a similar problem which I solved by removing some old migration batches, now I have a problem
with the Microsoft Exchange Mailbox Replication service.
The event logged is:
The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error.
Request GUID: '0b6c0f5a-0563-48e2-8b97-e0781c6cc69a'
Database GUID: '23258311-ad29-41c2-a842-522f48baa267'
Error: Unable to read from Active Directory. --> The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details Unable to find a suitable directory server for
domain 'admin.riddlesdown.local'.. --> Unable to find a suitable directory server for domain 'admin.riddlesdown.local'..
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=2280). Exchange Active Directory Provider could not find an available domain controller in domain admin.riddlesdown.local. This event may be caused by network connectivity issues or
configured incorrectly DNS server.
The domain doesn't exist in AD Sites and Services, I have removed all traces from DNS but this is still occurring. When I run Get-ADServerSettings | fl it reports no trace of the domain or a DC that was previously in it.
How can I stop these events occurring and is it likely to be causing something else not to work correctly.
We are running Exchange 2013 CU1

No, that didn't work. Here are more details:
Source: MSExchange ADAccess (EventID: 2130)
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=2280). Exchange Active Directory Provider could not find an available domain controller in domain admin.riddlesdown.local. This event may be caused by network connectivity issues or configured
incorrectly DNS server.
Source: MSExchange ADAccess (EventID: 2119)
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=2280). Error DNS_ERROR_RCODE_NAME_ERROR (0x8007232B) occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain admin.riddlesdown.local
The query was for the SRV record for _ldap._tcp.dc._msdcs.admin.riddlesdown.local
Common causes of this error include the following:
- The DNS SRV records required to locate a domain controller for the domain are not registered in DNS. These records are registered with a DNS server automatically when a domain controller is added to a domain. They are updated by the domain controller
at set intervals. This computer is configured to use DNS servers with following IP addresses:
10.59.100.7
10.59.100.8
fec0:0:0:ffff::1Microsoft.Exchange.Directory.TopologyService.exe
fec0:0:0:ffff::2Microsoft.Exchange.Directory.TopologyService.exe
fec0:0:0:ffff::3Microsoft.Exchange.Directory.TopologyService.exe
- One or more of the following zones do not include delegation to its child zone:
admin.riddlesdown.local
riddlesdown.local
local
. (the root zone)
Source: MSExchange Mailbox Replication Service (EventID: 1121)
The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error.
Request GUID: '87f4b926-0621-43d3-afeb-fe475ee6d850'
Database GUID: '23258311-ad29-41c2-a842-522f48baa267'
Error: Unable to read from Active Directory. --> The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details Unable to find a suitable directory server for domain 'admin.riddlesdown.local'..
--> Unable to find a suitable directory server for domain 'admin.riddlesdown.local'..
Something is cause the Exchange server to go looking for our old domain, but what and why?

"The Microsoft Exchange Diagnostics service terminated unexpectedly"

Similar Messages

Maybe you are looking for