This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 89%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
We have a proble with Exchange 2019 CU14, which is accompanied by event ID 5011, it means that IIS pools (MAPI, OWA, RPC, EWS etc) were crashed, of course, this is only a consequence, we cannot understand the cause yet. But there is a suspicion that the reason is in the backup driver. We have cyberprotect installed (https://cyberprotect.ru/products/backup/). After removing the agents, the problem went away.
I saw the same cases, but we don`t have problemes with resource utilization:
https://learn.microsoft.com/en-us/answers/questions/727386/exchange-2019-was-id-5011
https://www.exchangeitup.net/2017/02/exchange-2016-100-cpu-and-event-id-5011.html
Has anyone encountered a similar problem?
A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
A powerful email and collaboration platform developed by Microsoft, designed to support enterprise-level communication and productivity. Miscellaneous topics that do not fit into specific categories.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi @Иван Кордяк,
Welcome to the Microsoft Q&A platform!
Event ID 5011 typically indicates that the IIS application pool for Exchange has crashed. This can be caused by a variety of factors, including third-party software conflicts such as backup agents.
Based on your description, removing the CyberProtect backup agent seems to resolve the issue, which suggests they may be the culprit. This is consistent with other reports where third-party software, particularly backup or antivirus solutions, has caused similar issues.
Here are a few steps you can take to further investigate and potentially resolve the issue:
Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.
Best,
Jake Zhang
Thank you for youe feedback.We have just seen a little increase value of non-page, that`s it what we saw.
We don`t have these events 15004-15007
I checked, we dontt have that problem. We would have event 4999 talking about it.Thank you for youe feedback. We have just seen a little increase value of non-page, thats it what we saw.
We don`t have these events 15004-15007
How we resolved that problem temporary, we have just uninstalled backup software and driver and wait to analize from vendor of backup
I checked, we dont`t have that problem. We would have event 4999 talking about it.
Hi @Иван Кордяк,
Thanks for your response!
It sounds like the right thing to do to uninstall the backup software and wait for further analysis from the vendor. The slight increase in non-paged pool memory could be a clue, but it's good to know that you're not seeing events 15004-15007 or event 4999, which can often indicate a more specific problem.
Here are a few additional steps you can consider while you wait for the vendor analysis:
Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.
Best,
Jake Zhang
Hi @Иван Кордяк,
Please kindly consider this comment as a warm follow up, I want to know if your problem has been solved. If you still have any other questions, please feel free to comment here and I'm glad to provide further support.If the above info is helpful to this question, you can click "Accept Answer". Have a nice day!
Best,
Jake Zhang
Hello.
No, we still have a problem but we have been freezing a situation until looking for a resolve. I`ll message you if we find something. Thank you for your attention man!
You're welcome. I look forward to your good news. I wish you all the best!