Microsoft Exchange Transport Log Search service will not start and a series of 4999 events are logged

  • Article

Problem

On Exchange 2010, you may notice the below event firing rapidly. In our scenerio we were seeing the service attempt to start and go down approximatly 420 times an hour, logging the below 4999 every time. The only action that was taken prior to this problem appearing was the instalation of Exchange 2010 Sp2. It has been noted that this same problem has occured while installing various RollUps (RUs) as well.

 Log Name:      Application
Source:        MSExchange Common
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Watson report about to be sent for process id: #, with parameters: E12, c-RTL-AMD64, 14.02.0247.005, MSExchangeTransportLogSearch, MSExchangeTransportLogSearch, M.E.T.L.S.MailFlowStatistics.InitializeRecord, System.OutOfMemoryException, a3ee, 14.02.0247.003.
ErrorReportingEnabled: False

 

Resolution

When we have seen the problem in the past, the problem has happened when a function attempted to format information from these files. The end result is a IndexOutofRangeException when trying to read the contents of temporary stored statistics.

  1. Rename the following directory (to preserve existing data for root cause if desired):

         Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ActiveUsersStats\Backup

  2. Restart the Microsoft Exchange Transport Log Search service

Upon restarting the service a new Backup directory is created by the service and the error will not persist.