Microsoft Exchange Health Manager (MSExchangeHM) not start properly

Question

Hi everyone,

I have recently the following problem: MSExchangeHM Service does not start properly and continuously change the state between "Starting" and "Stopping". There are 4 error messages with event ID 1011 from source "MSExchangeHM" appear in the event viewer, approximately every 15 minutes (local language ist German):

Protokollname: Application
Quelle:        MSExchangeHM
Datum:         23.06.2021 10:16:33
Ereignis-ID:   1011
Aufgabenkategorie:Worker
Ebene:         Fehler
Schlüsselwörter:Klassisch
Benutzer:      Nicht zutreffend
Computer:      SERVER-05.xxxxxx.local
Beschreibung:
Microsoft Exchange Health Manager worker process (17424) received restart request and will be stopped. Restart reason: Unknown. 

Error message: 

System.Diagnostics.Eventing.Reader.EventLogException: Ende der Datei (EOF) erreicht
   bei System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   bei System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSubscribe(EventLogHandle session, SafeWaitHandle signalEvent, String path, String query, EventLogHandle bookmark, IntPtr context, IntPtr callback, Int32 flags)
   bei System.Diagnostics.Eventing.Reader.EventLogWatcher.StartSubscribing()
   bei Microsoft.Office.Datacenter.ActiveMonitoring.CrimsonWatcher`1.Start(Boolean isSyncMode)
   bei Microsoft.Office.Datacenter.ActiveMonitoring.LocalDataAccess.InitializeProbeResultNotification()
   bei Microsoft.Office.Datacenter.ActiveMonitoring.LocalDataAccess.Initialize(IEnumerable`1 discoveryWorkItems, Boolean reinitializeTables)
   bei Microsoft.Exchange.ActiveMonitoring.MonitoringWorker.Activate()
   bei Microsoft.Exchange.ActiveMonitoring.MonitoringWorker.Run(String[] args). BuildVersion:15.02.0858.012
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeHM" />
    <EventID Qualifiers="49156">1011</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-06-23T08:16:33.417161100Z" />
    <EventRecordID>2051951</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVER-05.xxxxxxx.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>17424</Data>
    <Data>System.Diagnostics.Eventing.Reader.EventLogException: Ende der Datei (EOF) erreicht
   bei System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   bei System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSubscribe(EventLogHandle session, SafeWaitHandle signalEvent, String path, String query, EventLogHandle bookmark, IntPtr context, IntPtr callback, Int32 flags)
   bei System.Diagnostics.Eventing.Reader.EventLogWatcher.StartSubscribing()
   bei Microsoft.Office.Datacenter.ActiveMonitoring.CrimsonWatcher`1.Start(Boolean isSyncMode)
   bei Microsoft.Office.Datacenter.ActiveMonitoring.LocalDataAccess.InitializeProbeResultNotification()
   bei Microsoft.Office.Datacenter.ActiveMonitoring.LocalDataAccess.Initialize(IEnumerable`1 discoveryWorkItems, Boolean reinitializeTables)
   bei Microsoft.Exchange.ActiveMonitoring.MonitoringWorker.Activate()
   bei Microsoft.Exchange.ActiveMonitoring.MonitoringWorker.Run(String[] args)</Data>
    <Data>15.02.0858.012</Data>
  </EventData>
</Event>

---

The number in brackets after worker process changes from message to message, but the content remains the same.

Unfortunately I couldn't find nothing to the problem (-:

Does anyone have any idea how it could be fixed?

It is a virtual (Hyper-V) Exchange Server 2019 Enterprise with the current build (15.2.858.12), running on Windows Server 2019 Standard.

Thank you in advance!
Michael.

Answer 1

Hi @Xzsssss ,

sorry for late reply, was busy with other things (-;

I have tried your suggestion: by cmdlet with "RecoverServer" says Exchange Server there is always fine and is nothing to fix... |-:

But I solved the problem in a different way. Just restore the VHDX with System Partition (mailbox database is on separate partition) from backup taken before the power failure on fiber optic switch and connect to Exchange Server instead of the current one.
This way I have my server back in good health and without losing any data (-:

Thanks you (@Xzsssss and @Andy David - MVP ) for your replies and participation!
Michael

Answer 2

Any idea what changed? When did it start? Anything installed or updated on the server?

Since you are at the latest CU, I would consider:

1. Building a new server and moving mailboxes to it.
2. Opening a ticket with Microsoft Support. They should be able to get traces and tell you what is causing this.

Answer 3

Nothing installed or updated. But it started after power supply failure on fiber optic switch. I've already run the chkdsk on Exchnage Server, no success...
Latest CU was installed a couple days ago, with hope it will help.

Answer 4

Try recreating the health mailboxes

You can delete them all with powershell:
Get-Mailbox -Monitoring | Remove-Mailbox

Make sure you also read this and give the necessary permissions so the AD objects are removed:
https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/remove-mailboxdatabase-cannot-remove-health-mailboxes

Otherwise, remove the AD objects manually

Then restart the Microsoft Exchange Health Manager, MSExchangeHM service on each 2019 server to recreate them.

ALso see:
https://social.technet.microsoft.com/wiki/contents/articles/40090.exchange-2013-recreating-health-mailboxes.aspx

Answer 5

I've already tried to recreate. I couldn't do that with powershell because the service (MSExchangeHM) wasn't running, so I removed the objects from AD manually.

Now the health mailboxes cannot be restored because... the service cannot start normally and still not running )-: