-->

Friday, January 8, 2016

Exchange 2013 Error: "The Microsoft Exchange Diagnostics service terminated unexpectedly"

I noticed on of our Exchange 2013 multi-role servers that the C:\ volume had much more free space than any of our other Exchange boxes. I started digging around and found that the Event Viewer reported the Diagnostic Service was crashing frequently. So I went and checked the Task Scheduler and sure enough, the Exchange Daily Performance Log tasks were missing.

What happened here was, during our update to CU9 the install changed the registry entries for Daily Perf Logs...c'mon Microsoft do you have to break something in every update? What's strange is that it only happened on one Exchange server, go figure.

I'll show you what it should look like on a working server, and what a broken one looks like.

The correct Task Scheduler should look like this:

Task Scheduler Correct

The Tasks looked this on the broken server:

Task Scheduler Wrong
 
The C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs directory should be like this:


DailyPerformanceLogs Correct
 
The broken DailyPerformanceLogs folder was empty:
 
DailyPerformanceLogs Empty
 
The C:\Windows\System32\Tasks\Microsoft\Windows\PLA directory should be like:
 
Windows\PLA Correct

The broken one was missing Daily Performance tasks:

Windows\PLA Empty
 
 
To fix the problem:
 
**Note** You'll need to perform these steps during a maintenance window as a reboot is necessary.
 
First, check that the Templates Keys are present in HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftPLA\Templates like so:
 
HKLM\SOFTWARE\MicrosoftPLA\Templates
 
 
Next, Navigate to:
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA
 
Delete the following entries:
 
ExchangeDiagnosticsDailyPerformanceLog
 
and
 
ExchangeDiagnosticsPerformanceLog
 
Daily Perf Logs Reg Keys To Delete
 

 
Reboot the server and go back into the registry and make sure the two above entries have been recreated.
 
**Note** It is very important to reboot the server immediately after you delete those keys. If not, they will be recreated automatically and you'll have to start over again.
 
Check to make sure that the ExchangeDiagnosticsDailyPerformanceLog and the ExchangeDiagnosticsPerformanceLog Tasks were recreated in task scheduler and performance monitor.
 
Now you should be good to go; the Events will stop throwing errors and your C:\ volume will fill up with Daily logs like usual...there's something else MS needs to fix.

8 comments:

  1. You are the MAN!
    THANK YOU FOR SAVING ME FROM A LATE STAGE REINSTALL!!!

    ReplyDelete
  2. Were there any Windows Updates or Exchange CU's applied when it reverted back to not working? Every Exchange patch that I installed would break it...until I installed CU12, which fixed it for good.

    ReplyDelete
  3. Worked for me with a little modification:

    1. Open Services
    2. Disable the “Microsoft Exchange Diagnostics” service
    3. Stop the “Microsoft Exchange Diagnostics” service
    4. Open Regedit
    5. Remove the following keys
    a. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\ExchangeDiagnosticsDailyPerformanceLog
    b. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\ExchangeDiagnosticsPerformanceLog
    6. Open Perfmon / DataCollector / User Defined / Verify that both ExchangeDiagnosticsDailyPerformanceLog and ExchangeDiagnosticsPerformanceLog DataCollector sets are removed
    7. Reboot the server
    8. Verify that all the server’s services are up and running
    9. Switch the “Microsoft Exchange Diagnostics” service back to Automatic and Start the service
    10. Check to make sure the Data Collector Sets were recreated and are running

    ReplyDelete
  4. Excellent article!! Very comprehensive and worked like a charm. Thank you SO much for taking the time to make this

    ReplyDelete
  5. Just installed CU15 and this error started happening on just one out of 5 servers.

    ReplyDelete