Microsoft Exchange Diagnostics service crashing with the event 4999, 1007 and 7031 post CU upgrade


 

Post upgrading to Exchange 2013 to CU6 from any CU level you may notice the below events are generating in every 30-45 minutes, it is the exceptional rare scenario and may encounter similar symptom post upgrade. While upgrade due to some modification in the registry hives the ExchangeDiagnosticsDailyPerformanceLog got missing from Task Scheduler, performance monitor and was also missing from the location C:\Windows\System32\Tasks\Microsoft\Windows\PLA because of which the MSExchangeDiagnostics service started crashing very frequently and it failed to create daily performance logs, since PID is not changing its first chance exception.

 

Log Name:      Application

Source:        MSExchangeDiagnostics

Date:          9/29/2014 2:47:37 PM

Event ID:      1007

Task Category: General

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      SRV1.contoso.local

Description:

Failed to create or start performance logs with error: System.ArgumentException: Value

does not fall within the expected range.

   at PlaLibrary.DataCollectorSetClass.start(Boolean Synchronous)

   at Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogSet.StartLog

(Boolean synchronous)

   at

Microsoft.Exchange.Diagnostics.PerformanceLogger.PerformanceLogMonitor.CheckPerflogSta

tus(). Performance log: ExchangeDiagnosticsPerformanceLog.

 

 

Log Name:      System

Source:        Service Control Manager

Date:          9/29/2014 2:20:27 PM

Event ID:      7031

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      SRV1.contoso.local

Description:

The Microsoft Exchange Diagnostics service terminated unexpectedly.  It has done this

577 time(s).  The following corrective action will be taken in 60000 milliseconds:

Restart the service.

 

 

Log Name:      Application

Source:        MSExchange Common

Date:          9/29/2014 3:42:18 PM

Event ID:      4999

Task Category: General

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      SRV1.contoso.local

Description:

Watson report about to be sent for process id: 16436, with parameters: E12IIS, c-RTL-

AMD64, 15.00.0995.029, M.E.Diagnostics.Service, M.E.Diagnostics.PerformanceLogger,

M.E.D.P.PerformanceLogSet.StartLog, System.ArgumentException, 95c6, 15.00.0995.012.

ErrorReportingEnabled: True

 

Before starting the troubleshooting we can first verify if Windows Scheduler Service is disabled by specific GPO. Since ExchangeDiagnosticsDailyPerformanceLog was missing in the performance monitor and task scheduler, I just thought of importing the ExchangeDiagnosticsDailyPerformanceLog template as a workaround from performance monitor of one of the working Exchange 2013 CU6 server. Though it didn’t fix the problem completely, but it’s worth reading the steps performed for understanding the cause of the problem.

 

I first exported ExchangeDiagnosticsDailyPerformanceLog template with the name ExchangeDiagnosticsDailyPerformanceLog.xml from the working Exchange 2013 CU6 server. Then while importing the ExchangeDiagnosticsDailyPerformanceLog.xml it was not picking the XML file and was showing the blank console post browsing the file from the saved location. It seems that ExchangeDiagnosticsDailyPerformanceLog.xml was already in used by other data collector. Modified the name from ExchangeDiagnosticsDailyPerformanceLog.xml to ExchangeDiagnosticsDailyPerf.xml and this time I was able to pick the template from the saved location, but if I am using the data collector name as ExchangeDiagnosticsDailyPerformanceLog then it throws an error as mentioned in the below screenshot.

 

 

 

Changed the data collector name from ExchangeDiagnosticsDailyPerformanceLog to ExchangeDiagnosticsDailyPerf and I was able to import the ExchangeDiagnosticsDailyPerf.xml template. Since ExchangeDiagnosticsDailyPerf template was imported properly, it even populated the ExchangeDiagnosticsDailyPerf task in the Task scheduler. Now the ExchangeDiagnosticsDailyPerformanceLog started getting generated at the location C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs. But the events 1007 and 4999 were still generating in every 30-45 minutes.

 

 

 

As per the above testing it is clearly reflected that cached entry of the default daily performance log name “ExchangeDiagnosticsDailyPerformanceLog” is present somewhere and since it is not able to find the ExchangeDiagnosticsDailyPerformanceLog in the perfmon and task scheduler it’s generating the error 1007 and 4999.  

  

Resolution:

We have to ensure that the templates key are present under PLA

HKLM\Software\Microsoft\PLA\Templates

 

 

Found cached entry of the default daily performance log name “ExchangeDiagnosticsDailyPerformanceLog” at the registry location

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\ExchangeDiagnosticsDailyPerformanceLog

 

 

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ )

How to back up and restore the registry in Windows

 

Deleted the ExchangeDiagnosticsDailyPerformanceLog entry from the above location and deleted the imported 'ExchangeDiagnosticsDailyPerf' from perfmon

Ensured that we only have ExchangeDiagnosticsPerformanceLog and Server Manager Performance monitor under user data collector in perfmon. Then rebooted the server, post which found that new default ExchangeDiagnosticsDailyPerformanceLog was recreated automatically in the task scheduler and performance monitor and now events were not generating any more.

Note: If we are missing both ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog then we have to delete both the entries from the above registry location and then reboot

 

Cheers!

Anil

 


Comments (22)

  1. Aniyadav says:

    Hi Sam,

    It is not related, the above solution won’t help here.

    Regards,
    Anil

  2. PHopp says:

    Hi Anil,
    I´ve try your solution, but it doen´t works. My steps:
    – check "Windows Scheduler Service", okay
    – check for entrys present at reg: "HKLMSoftwareMicrosoftPLATemplates", okay
    – delete registry-key "HKLMSoftwareMicrosoftWindows NTCurrentversionScheduleTaskCacheTreeMicrosoftWindowsPLAExchangeDiagnosticsDailyPerformanceLog"
    – found no (dynamic generated?) "ExchangeDiagnosticsDailyPerf", because I do not this step, it´s okay?
    Regards,
    Pekka

  3. Anonymous says:

    Thank you for the post. Worked like a charm for us also.

  4. Aniyadav says:

    Hi Satish,

    Are we getting the exact events as posted in this blog?

    Regards,
    Anil

  5. Anonymous says:

    Exchange server repair tool can easily fix improper server shutdown, power issues, JET errors, drive errors, corrupt header errors, server down issues, and server crash incidents etc. The software repairs corrupt exchange edb and convert edb to outlook
    pst format. For more detail –
    http://www.exchangeserver.recoveryfiles.org/

  6. Aniyadav says:

    Blog talks about the detailed troubleshooting steps with resolution, but if the troubleshooting steps are confusing then Irfan has mentioned the solution in steps in the above post that should be good enough to fix this errors..

  7. sam says:

    Hi Anil,

    After installing CU6 in my Ex2013, Im having an event ID 2 of source MsExchange Configuration Core thousands times per day.

    More info of the event:
    27152
    w3wp.exe
    Exception from CmdletLogger.AsyncCommit : System.ArgumentException: activityScope is null.
    at Microsoft.Exchange.Diagnostics.CmdletInfra.CmdletLogger.AsyncCommit(Guid cmdletUniqueId, Boolean forceSync)
    at Microsoft.Exchange.Configuration.Tasks.LoggingModule.CommitLog(String loggingStep)

    I know its not the same error. However, do you think that could be related?And aply the same solution you offered?

    Thanks!!
    Sam

  8. satish says:

    Dear Anil,
    Above solution is not working in our enviornmnet logs are not getting genarated in dailyperformace log folder.

    only few servers affected post CU6 upgrade

    Regards
    Satish

  9. Bryan says:

    Thanks a bunch for this detailed solution, I was able to follow your steps exactly and the counters were added automatically after the reboot like you indicated. 1 of my 4 servers didn’t like the CU very well.

  10. satish says:

    Dear Anil,

    Yes, mentioned events are genarting on affected servers.

    Regards
    Satish

  11. Airinen says:

    Unfortunatly, your solution doesn’t help me.

  12. Irfan says:

    Hi All,

    It works for me.

    Step -1
    Kindly delete both keys from Registry ExchangeDiagnosticsDailyPerformanceLog & ExchangeDiagnosticsPerformanceLog .

    Step -2
    Ensure Template is available on below location
    HKLMSoftwareMicrosoftPLATemplates

    Step -3
    Delete Counter from below path
    Perfmon ->DataCollector->User Define -> Delete ExchangeDiagnosticsDailyPerformanceLog counter.

    Step-4
    Restart & Check.

  13. PHopp says:

    @Irfan: Thanks, it works now!

  14. satish says:

    Thanks Anil & Irfan, it work for me also.

  15. Sufyan.samad says:

    Note : ExchangeDiagnosticsDailyPerformanceLog & ExchangeDiagnosticsPerformanceLog registry keys come back again automatically in 5 Min and a reboot after 5 Min will be of no use & ExchangeDiagnosticsDailyPerformanceLog & ExchangeDiagnosticsPerformanceLog
    will still be missing from task scheduler and perfmon. Tested on Exchange 2013 Cu7. After deleting the keys and immediate reboot is required.

  16. Gabe says:

    Thanks Anil & Irfan! it’s working. now I have other I need to deal with

  17. More problems says:

    After the above actions were errors in 1007 MSExchangeDiagnostics, 4999 MSEXCHANGE Common, 7031 microsoft-windows-service control manager, 1039 (1013) MS ExchangeDiagnostics
    The performance counters are not created new counters!
    Any idea how to fix it?

  18. Lancmire says:

    This worked for me on Cu9, Thank you for your post.

  19. Thanx Anil & Irfan, it work for me!

  20. Sergey Y. says:

    Thanks! It works for me!

  21. bidelia says:

    Exchange server database recovery software recover corrupted EDB data and save in PST file. This software successfull convert EDB to PST files data including- emails, contacts, tasks, journals, appointments, reminders, notes and calendars etc. Read more
    and free download click here
    http://exchangeserverdatabaserecovery.blogspot.com

  22. bidelia1 says:

    Exchange server database recovery software recover corrupted EDB data and save in PST file. This software successfull convert EDB to PST files data including- emails, contacts, tasks, journals, appointments, reminders, notes and calendars etc. Read more
    and free download click here
    http://exchangeserverdatabaserecovery.blogspot.com

Skip to main content