Microsoft Exchange Transport Log Search service will not start and a series of 4999 events are logged
Problem
On Exchange 2010, you may notice the below event firing rapidly. In our scenerio we were seeing the service attempt to start and go down approximatly 420 times an hour, logging the below 4999 every time. The only action that was taken prior to this problem appearing was the instalation of Exchange 2010 Sp2. It has been noted that this same problem has occured while installing various RollUps (RUs) as well.
Log Name: Application
Source: MSExchange Common
Event ID: 4999
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Description:
Watson report about to be sent for process id: #, with parameters: E12, c-RTL-AMD64, 14.02.0247.005, MSExchangeTransportLogSearch, MSExchangeTransportLogSearch, M.E.T.L.S.MailFlowStatistics.InitializeRecord, System.OutOfMemoryException, a3ee, 14.02.0247.003.
ErrorReportingEnabled: False
Resolution
When we have seen the problem in the past, the problem has happened when a function attempted to format information from these files. The end result is a IndexOutofRangeException when trying to read the contents of temporary stored statistics.
Rename the following directory (to preserve existing data for root cause if desired):
Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ActiveUsersStats\Backup
Restart the Microsoft Exchange Transport Log Search service
Upon restarting the service a new Backup directory is created by the service and the error will not persist.
Comments
Anonymous
April 28, 2013
I had a similar problem when we upgraded to Exchange 2010 SP3 and the steps outlined above worked for me........ thanks for posting it !!Anonymous
August 08, 2014
The same issue after RollUp 6 . Deleting the backup directory worked fine.
ThanksAnonymous
February 11, 2015
thanks this problem appeared without any update but it now resolved after applied this solutionAnonymous
October 07, 2015
Didn't work