Link to home
Start Free TrialLog in
Avatar of sgcity
sgcityFlag for United States of America

asked on

Server 2012 Event 5011 followed by Exchange 2013 Event 4999, repeating error

-Edited Title and Question for clarity

Server 2012 is giving the event warning 5011 system error at the same time as 4999.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" /> 
  <EventID Qualifiers="32768">5011</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2013-08-02T21:52:52.000000000Z" /> 
  <EventRecordID>38617</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>System</Channel> 
  <Computer>server.domain.local</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="AppPoolID">MSExchangeSyncAppPool</Data> 
  <Data Name="ProcessID">2788</Data> 
  <Binary>6D000780</Binary> 
  </EventData>
  </Event>

Open in new window


Our Exchange 2013 server is throwing error 4999 every 5 to 10 minutes in the Application event log. XML Details below.
  
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="MSExchange Common" /> 
  <EventID Qualifiers="16388">4999</EventID> 
  <Level>2</Level> 
  <Task>1</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2013-08-02T21:52:52.000000000Z" /> 
  <EventRecordID>280002</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>server.domain.local</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>2788</Data> 
  <Data>E12</Data> 
  <Data>c-RTL-AMD64</Data> 
  <Data>15.00.0620.029</Data> 
  <Data>unknown</Data> 
  <Data>M.E.Data.Directory</Data> 
  <Data>M.E.D.D.ConnectionPoolManager.BlockImpersonatedCallers</Data> 
  <Data>M.E.Common.FailFastException</Data> 
  <Data>e5e6</Data> 
  <Data>15.00.0620.029</Data> 
  <Data>True</Data> 
  <Data>True</Data> 
  <Data>unknown</Data> 
  </EventData>
  </Event>

Open in new window

Avatar of Adam Farage
Adam Farage
Flag of United States of America image
What is in your environment, exactly (including OS and patch level)?
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

We have an Exchange 2013 (Server 2012) coexistence with Exchange 2007 (Server 2008).

Exchange 2013 CU1 and Exchange 2007 SP3 RU10. Server-side is all windows updated.

I just noticed CU2 was released 3 days ago... I'll try installing that.
Avatar of Adam Farage
Adam Farage
Flag of United States of America image
Ok. I have seen this when the SP level is incorrect on the lower version of Exchange (example: Exchange 2007 SP3RU9) but not sure.

Can you list the actual event viewer log events? Not the XML data.
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

Oh, yeah.. Should have done that. Here's the event details

Event ID: 5011
Source: WAS
Level: Warning
A process serving application pool 'MSExchangeSyncAppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '2788'. The data field contains the error number.

Event ID: 4999
Source: MSExchange Common
Level: Error
Watson report about to be sent for process id: 2788, with parameters: E12, c-RTL-AMD64, 15.00.0620.029, unknown, M.E.Data.Directory, M.E.D.D.ConnectionPoolManager.BlockImpersonatedCallers, M.E.Common.FailFastException, e5e6, 15.00.0620.029.
ErrorReportingEnabled: True
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

Just noticed I never posted the versions too...
Get-ExchangeServer | ft admindisplayversion,exchangeversion,identity
AdminDisplayVersion         ExchangeVersion            Identity
--------------------        ---------------            --------
Version 8.3 (Build 83.6)    0.1 (8.0.535.0)            Exch2007
Version 15.0 (Build 620.29) 0.1 (8.0.535.0)            Exch2012

Versions
Exchange 2007: 08.03.0083.000
Exchange 2013: 15.00.0620.029

Open in new window

Avatar of Adam Farage
Adam Farage
Flag of United States of America image
This was a bug in Exchange 2010....

A process serving application pool 'MSExchangeSyncAppPool' suffered a fatal communication error with the Windows Process Activation Service

Here: http://support.microsoft.com/kb/2639150

On the Exchange 2013 machine, log into the IIS and make sure all the IIS virtual directories and pools are online. If they are, try upgrading to CU2.
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

I updated to CU2. No resolution.

Something I noticed was that over the weekend on Sunday morning all our phones stopped receiving email. I checked the server and the events 4999 and 5011 had stopped.

I wanted to get phones syncing without rebooting the server so I did an iisreset and then the phones started to sync again and the errors came back.

I should also note that since I installed CU2, I am now getting a warning event id 4998 right after every 4999 in the application log.

Event: 4998
Level: Warning
ExWatson encountered an error while generating Watson report . Error is System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at Microsoft.Exchange.Diagnostics.DiagnosticsNativeMethods.WerReportCreate(String eventType, WER_REPORT_TYPE repType, WER_REPORT_INFORMATION reportInformation)
   at Microsoft.Exchange.Diagnostics.WatsonReport.CreateReportHandle()
   at Microsoft.Exchange.Diagnostics.WatsonReport.Send().
Avatar of Adam Farage
Adam Farage
Flag of United States of America image
Can you post the whole Event ID 4998, so I can see what service is causing this crash report..?
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

Event: 4998
Log: Application
Source: MSExchange Common
Level: Warning
ExWatson encountered an error while generating Watson report . Error is System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at Microsoft.Exchange.Diagnostics.DiagnosticsNativeMethods.WerReportCreate(String eventType, WER_REPORT_TYPE repType, WER_REPORT_INFORMATION reportInformation)
   at Microsoft.Exchange.Diagnostics.WatsonReport.CreateReportHandle()
   at Microsoft.Exchange.Diagnostics.WatsonReport.Send().
XML
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="MSExchange Common" />
  <EventID Qualifiers="32772">4998</EventID>
  <Level>3</Level>
  <Task>1</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2013-08-06T14:42:28.000000000Z" />
  <EventRecordID>306441</EventRecordID>
  <Channel>Application</Channel>
  <Computer>server.domain.local</Computer>
  <Security />
  </System>
- <EventData>
  <Data />
  <Data>System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at Microsoft.Exchange.Diagnostics.DiagnosticsNativeMethods.WerReportCreate(String eventType, WER_REPORT_TYPE repType, WER_REPORT_INFORMATION reportInformation) at Microsoft.Exchange.Diagnostics.WatsonReport.CreateReportHandle() at Microsoft.Exchange.Diagnostics.WatsonReport.Send()</Data>
  </EventData>
  </Event>
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

The issue we're having is described perfectly here: http://support.microsoft.com/kb/2639150

Yet it doesn't say Exchange 2013... So I'm curious why are we plagued with a 2010 issue after being on CU2.
Avatar of iftech
iftech
EXACT same issue here. It is so similar I had to double check that someone else from our company posted this.

Did you happen to find a resolution?
ASKER CERTIFIED SOLUTION
Avatar of sgcity
sgcity
Flag of United States of America image
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of sgcity
sgcity
Flag of United States of America image

ASKER

It's the only solution and MS has refused to comment (or fix it).