What the crash!
An Exchange 2013 SP1 server which is also a multi-role server on which the Microsoft Exchange Transport service or Microsoft Exchange Frontend Transport service crashing frequently.
Why were we noticing this weird behavior all of a sudden?
**
**
hmmm.. let's look at what is happening here.
Started looking at the logs and observed these in the application logs:
Log Name: Application
Source: MSExchangeTransport
Event ID: 1019
Task Category: SmtpReceive
Level: Error
Computer: 2013MailboxServer
Description: Failed to start listening (Error: 10048). Binding: 0.0.0.0:25.
Log Name: Application
Source: MSExchangeTransport
Event ID: 1018
Task Category: SmtpReceive
Level: Error
Computer: 2013MailboxServer
Description: The address is already in use. Binding: 0.0.0.0:25.
Log Name: Application
Source: MSExchangeTransport
Event ID: 1036
Task Category: SmtpReceive
Level: Error
Computer: 2013MailboxServer
Description: Inbound direct trust authentication failed for certificate %1. The source IP address of the server that tried to authenticate to Microsoft Exchange is [%2]. Make sure EdgeSync is running properly.
Log Name: Application
Source: MSExchange Common
Date: 4/14/2014 3:53:16 PM
Event ID: 4999
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: 2013MailboxServer
Description:
Watson report about to be sent for process id: <PID>, with parameters: E12IIS, c-RTL-AMD64, 15.00.0847.032, MSExchangeTransport, M.Exchange.Net, M.E.P.WorkerProcessManager.HandleWorkerExited, M.E.ProcessManager.WorkerProcessRequestedAbnormalTerminationException, 5e2b, 15.00.0847.030.
ErrorReportingEnabled: False
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSExchange Common" />
<EventID Qualifiers="16388">4999</EventID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-15T19:53:16.000000000Z" />
<EventRecordID>216</EventRecordID>
<Channel>Application</Channel>
<Computer>2013MailboxServer</Computer>
<Security />
</System>
<EventData>
<Data>PID</Data>
<Data>E12IIS</Data>
<Data>c-RTL-AMD64</Data>
<Data>15.00.0847.032</Data>
<Data>MSExchangeTransport</Data>
<Data>M.Exchange.Net</Data>
<Data>M.E.P.WorkerProcessManager.HandleWorkerExited</Data>
<Data>M.E.ProcessManager.WorkerProcessRequestedAbnormalTerminationException</Data>
<Data>5e2b</Data>
<Data>15.00.0847.030</Data>
<Data>False</Data>
<Data>True</Data>
<Data>MSExchangeTransport</Data>
<Data>
</Data>
</EventData>
</Event>
First thing if we look at the events 1019 and 1018, we noticed that it is crashing because of the reasons "Failed to start listening (Error: 10048). Binding: 0.0.0.0:25." and "address is already in use 0.0.0.0:25" respectively.
So, what’s happening with the service after upgrading the server to Exchange 2013 SP1?
**
**Microsoft Exchange Frontend Transport service on Exchange 2013 service pack 1 server with both Mailbox and CAS roles on it, stop and then fail to start.
Issue is seen after upgrade to exchange 2013 service pack 1.
If you stop the Microsoft Exchange Transport service, you will be able to start the Microsoft Exchange Frontend Transport service and then when you attempt to start the Microsoft Exchange Transport service, it will fail to start with the above listed events.
Why this?
**
**This happen if on affected 2013 server there is a receive connector of Transport type HubTransport with binding set to port 25. In a multi-role 2013 server, the Microsoft Exchange Transport service should be listening on 2525 and not 25.
On a 2013 server with both backend and frontend roles on it, only the FrontendTransport server should be bind to port 25. Obviously we had messed up with the way we had created my receive connectors.
How do I fix this?
There are a couple of ways of fixing this, one of them is obviously changing the connector type from HubTransport to FrontendTransport using Exchange management shell.
Set-ReceiveConnector –Identity <“Receive connector name”> –TransportRole FrontendTransport
Or your other option is to remove and recreate the wrongly configured receive connector.
Delete the existing receive connector of type "HubTransport" and creating the new receive connector of type "FrontEndTransport"
Delete and recreate the receive connector of type "FrontendTransport"
Thank you Naveen Saini for helping and reviewing this article.
- Akshay Katti