Share via

Exchange server crashed after lost connection in DAG configuration.

ShamVMH 21 Reputation points
2020-09-16T14:58:48.263+00:00

Hi,

We have configured two Ms Exchange servers and they both DAG members. Last Saturday we had a network outage and one lost connection which caused a crash. Both servers are VMs and running Windows 2012 R2.

Any idea why lost connection crashed a whole server? Thanks for help.

Here is a debugged memory.dmp:

  • *
  • Bugcheck Analysis *
  • *

CRITICAL_PROCESS_DIED (ef)

    A critical system process died

Arguments:

Arg1: ffffe0010a455900, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

*** WARNING: Unable to verify timestamp for System.ni.dll

*** WARNING: Unable to verify checksum for Microsoft.Exchange.Cluster.Replay.ni.dll

KEY_VALUES_STRING: 1

PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 9600.19629.amd64fre.winblue_ltsb_escrow.200127-1700

SYSTEM_MANUFACTURER: VMware, Inc.

VIRTUAL_MACHINE: VMware

SYSTEM_PRODUCT_NAME: VMware Virtual Platform

SYSTEM_VERSION: None

BIOS_VENDOR: Phoenix Technologies LTD

BIOS_VERSION: 6.00

BIOS_DATE: 12/12/2018

BASEBOARD_MANUFACTURER: Intel Corporation

BASEBOARD_PRODUCT: 440BX Desktop Reference Platform

BASEBOARD_VERSION: None

DUMP_TYPE: 1

BUGCHECK_P1: ffffe0010a455900

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: wininit.exe

CRITICAL_PROCESS: wininit.exe

EXCEPTION_CODE: (Win32) 0x22a0 (8864) - <Unable to get error code text>

ERROR_CODE: (NTSTATUS) 0x22a0 - <Unable to get error code text>

CPU_COUNT: 6

CPU_MHZ: 960

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2d

CPU_STEPPING: 2

CPU_MICROCODE: 6,2d,2,0 (F,M,S,R) SIG: 43'00000000 (cache) 43'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xEF

CURRENT_IRQL: 0

MANAGED_CODE: 1

MANAGED_ENGINE_MODULE: clr

MANAGED_ANALYSIS_PROVIDER: SOS

MANAGED_THREAD_ID: 4

STACK_TEXT:

ffffd0003015f948 fffff80226070f4c : 00000000000000ef ffffe0010a455900 0000000000000000 0000000000000000 : nt!KeBugCheckEx

ffffd0003015f950 fffff80225fbad86 : ffffe0010a455900 0000000000000000 0000000000000000 00000000ffffffff : nt!PspCatchCriticalBreak+0xa4

ffffd0003015f990 fffff80225e95c3f : ffffe0010df96580 0000000000000000 ffffe0010a455900 ffffe0010a455900 : nt! ?? ::NNGAKEGL::`string'+0x32a66

ffffd0003015f9f0 fffff8022607090c : ffffffffffffffff ffffd0003015fa99 ffffe0010a455900 ffffe001324a9880 : nt!PspTerminateProcess+0x67

ffffd0003015fa30 fffff80225bc43e3 : 00007ff96b491000 00000000000022a0 ffffe001324a9880 00000000ffffffff : nt!NtTerminateProcess+0xe0

ffffd0003015fb00 00007ff97cdf0a1a : 00007ff97a2f0379 000000000c446630 000000002eeeede0 0000000000003024 : nt!KiSystemServiceCopyEnd+0x13

000000002eeeed28 00007ff97a2f0379 : 000000000c446630 000000002eeeede0 0000000000003024 00000000ffffffff : ntdll!NtTerminateProcess+0xa

000000002eeeed30 00007ff970c8a23c : 000000000c37d8f0 00000000ffffffff 000000000c444130 00007ff9707aa146 : KERNELBASE!TerminateProcess+0x25

000000002eeeed60 000000000c37d8f0 : 00000000ffffffff 000000000c444130 00007ff9707aa146 000000002eeeed60 : System_ni+0x7da23c

000000002eeeed68 00000000ffffffff : 000000000c444130 00007ff9707aa146 000000002eeeed60 0000ba27fe24e675 : 0xc37d8f0

000000002eeeed70 000000000c444130 : 00007ff9707aa146 000000002eeeed60 0000ba27fe24e675 00007ff97369b9f0 : 0xffffffff

000000002eeeed78 00007ff9707aa146 : 000000002eeeed60 0000ba27fe24e675 00007ff97369b9f0 000000002eeef9b0 : 0xc444130

000000002eeeed80 000000002eeeed60 : 0000ba27fe24e675 00007ff97369b9f0 000000002eeef9b0 00007ff9706789b8 : System_ni+0x2fa146

000000002eeeed88 0000ba27fe24e675 : 00007ff97369b9f0 000000002eeef9b0 00007ff9706789b8 00007ff9706789b8 : 0x2eeeed60

000000002eeeed90 00007ff97369b9f0 : 000000002eeef9b0 00007ff9706789b8 00007ff9706789b8 000000002eeeed60 : 0x0000ba27`fe24e675

000000002eeeed98 000000002eeef9b0 : 00007ff9706789b8 00007ff9706789b8 000000002eeeed60 00007ff970c8a23c : clr!InlinedCallFrame::`vftable'

000000002eeeeda0 00007ff9706789b8 : 00007ff9706789b8 000000002eeeed60 00007ff970c8a23c 000000002eeeee20 : 0x2eeef9b0

000000002eeeeda8 00007ff9706789b8 : 000000002eeeed60 00007ff970c8a23c 000000002eeeee20 00007ff9706789b8 : System_ni+0x1c89b8

000000002eeeedb0 000000002eeeed60 : 00007ff970c8a23c 000000002eeeee20 00007ff9706789b8 000000004b22b070 : System_ni+0x1c89b8

000000002eeeedb8 00007ff970c8a23c : 000000002eeeee20 00007ff9706789b8 000000004b22b070 00007ff95eb9a5e0 : 0x2eeeed60

000000002eeeedc0 000000002eeeee20 : 00007ff9706789b8 000000004b22b070 00007ff95eb9a5e0 00007ff900000001 : System_ni+0x7da23c

000000002eeeedc8 00007ff9706789b8 : 000000004b22b070 00007ff95eb9a5e0 00007ff900000001 000000000c37d8f0 : 0x2eeeee20

000000002eeeedd0 000000004b22b070 : 00007ff95eb9a5e0 00007ff900000001 000000000c37d8f0 000000000c43bd78 : System_ni+0x1c89b8

000000002eeeedd8 00007ff95eb9a5e0 : 00007ff900000001 000000000c37d8f0 000000000c43bd78 000000000c444130 : 0x4b22b070

000000002eeeede0 00007ff900000001 : 000000000c37d8f0 000000000c43bd78 000000000c444130 0000000003fe48d8 : Microsoft_Exchange_Cluster_Replay_ni+0xaa5e0

000000002eeeede8 000000000c37d8f0 : 000000000c43bd78 000000000c444130 0000000003fe48d8 000000000c7313f8 : 0x00007ff9`00000001

000000002eeeedf0 000000000c43bd78 : 000000000c444130 0000000003fe48d8 000000000c7313f8 000000000c37c318 : 0xc37d8f0

000000002eeeedf8 000000000c444130 : 0000000003fe48d8 000000000c7313f8 000000000c37c318 0000000000000006 : 0xc43bd78

000000002eeeee00 0000000003fe48d8 : 000000000c7313f8 000000000c37c318 0000000000000006 000000002eeeee70 : 0xc444130

000000002eeeee08 000000000c7313f8 : 000000000c37c318 0000000000000006 000000002eeeee70 00007ff970dfa262 : 0x3fe48d8

000000002eeeee10 000000000c37c318 : 0000000000000006 000000002eeeee70 00007ff970dfa262 000000000c446630 : 0xc7313f8

000000002eeeee18 0000000000000006 : 000000002eeeee70 00007ff970dfa262 000000000c446630 000000000c444130 : 0xc37c318

000000002eeeee20 000000002eeeee70 : 00007ff970dfa262 000000000c446630 000000000c444130 000000000c43bd78 : 0x6

000000002eeeee28 00007ff970dfa262 : 000000000c446630 000000000c444130 000000000c43bd78 000000000c37d8f0 : 0x2eeeee70

000000002eeeee30 000000000c446630 : 000000000c444130 000000000c43bd78 000000000c37d8f0 000000002eeeee30 : System_ni+0x94a262

000000002eeeee38 000000000c444130 : 000000000c43bd78 000000000c37d8f0 000000002eeeee30 000000000c446630 : 0xc446630

000000002eeeee40 000000000c43bd78 : 000000000c37d8f0 000000002eeeee30 000000000c446630 000000000c43bd78 : 0xc444130

000000002eeeee48 000000000c37d8f0 : 000000002eeeee30 000000000c446630 000000000c43bd78 000000000c444130 : 0xc43bd78

000000002eeeee50 000000002eeeee30 : 000000000c446630 000000000c43bd78 000000000c444130 000000002eeeeee0 : 0xc37d8f0

000000002eeeee58 000000000c446630 : 000000000c43bd78 000000000c444130 000000002eeeeee0 00007ff95f2f63e2 : 0x2eeeee30

000000002eeeee60 000000000c43bd78 : 000000000c444130 000000002eeeeee0 00007ff95f2f63e2 000000000c43bd78 : 0xc446630

000000002eeeee68 000000000c444130 : 000000002eeeeee0 00007ff95f2f63e2 000000000c43bd78 0000000000000001 : 0xc43bd78

000000002eeeee70 000000002eeeeee0 : 00007ff95f2f63e2 000000000c43bd78 0000000000000001 0000000000000000 : 0xc444130

000000002eeeee78 00007ff95f2f63e2 : 000000000c43bd78 0000000000000001 0000000000000000 000000000c37d8f0 : 0x2eeeeee0

000000002eeeee80 00007ff95f0a6846 : 000000000c37d890 0000000000000000 0000000000000000 0000000000000000 : Microsoft_Exchange_Cluster_Replay_ni+0x8063e2

000000002eeeeef0 000000000c37d890 : 0000000000000000 0000000000000000 0000000000000000 000000002eeeeef0 : Microsoft_Exchange_Cluster_Replay_ni+0x5b6846

000000002eeeeef8 0000000000000000 : 0000000000000000 0000000000000000 000000002eeeeef0 0000000000000000 : 0xc37d890

THREAD_SHA1_HASH_MOD_FUNC: 57090fbb3c6d83896f560c4a0117b06c433378b6

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 78f9a514115b0bb3aa2cf81df3faa292cd22d75e

THREAD_SHA1_HASH_MOD: 8e5b85a067ed032f1020c85446f507fc36c905ee

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0xEF_wininit.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_MSExchangeHMWorker.exe_22a0_ANALYSIS_INCONCLUSIVE!unknown_function

BUCKET_ID: 0xEF_wininit.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_MSExchangeHMWorker.exe_22a0_ANALYSIS_INCONCLUSIVE!unknown_function

PRIMARY_PROBLEM_CLASS: 0xEF_wininit.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_MSExchangeHMWorker.exe_22a0_ANALYSIS_INCONCLUSIVE!unknown_function

TARGET_TIME: 2020-09-12T12:30:31.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 400

PRODUCT_TYPE: 3

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 Server TerminalServer DataCenter SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2020-01-28 05:29:11

BUILDDATESTAMP_STR: 200127-1700

BUILDLAB_STR: winblue_ltsb_escrow

BUILDOSVER_STR: 6.3.9600.19629.amd64fre.winblue_ltsb_escrow.200127-1700

ANALYSIS_SESSION_ELAPSED_TIME: 19344

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xef_wininit.exe_bugcheck_critical_process_terminated_by_msexchangehmworker.exe_22a0_analysis_inconclusive!unknown_function

FAILURE_ID_HASH: {c8eab423-1f87-9210-c29d-922a68b8b79e}

Followup: MachineOwner

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,440 questions
0 comments
Accepted answer
  1. Lucas Liu-MSFT 6,161 Reputation points
    2020-09-17T03:14:01.04+00:00

    Hi @ShamVMH ,
    Agree with Andy, It’s likely Managed Availability try to fix the error and rebooting server. You could following the path to check if there are any related logs in Event Viewer. These logs could show more detailed information about what caused the server reboot.
    Event Viewer -> Application Logs -> Microsoft -> Exchange -> ManageAvailability -> Monitoring

    ----------

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 143.8K Reputation points MVP
    2020-09-16T15:35:43.713+00:00

    Notice:
    BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_MSExchangeHMWorker.exe_

    More than likely the Managed Availability service was trying to correct it and bug-checked the server in order to attempt to restart the system.

    I have seen this before and its sort of "by design" :)

    See:
    https://learn.microsoft.com/en-us/exchange/managed-availability-exchange-2013-help?redirectedfrom=MSDN

    https://social.technet.microsoft.com/Forums/office/en-US/df3a7f34-bdf1-45ef-a05a-1d37fbfcb810/exchange-2013-unexpected-reboot-by-msexchangehmworker?forum=exchangesvrdeploy

    0 comments
  2. ShamVMH 21 Reputation points
    2020-09-17T08:14:14.99+00:00

    Hi Guys,

    Thank you for your answers. They are both correct but second one directed me straight to source.
    I found a "Force reboot" event caused by ManagedAvailability against a server in ManagedAvailability -> RecoveryActionResults.

    Thank you once again.

    Sham