question

56522859 avatar image
0 Votes"
56522859 asked RobGarrett-2061 commented

Exchange 2019 CU10 Event ID 4999

Hi!

A week ago I installed CU10 on my Exchange 2019.
Today something happened to Transport services - users report that all mail stuck in Outbox.
After restarting all transport services everything starts to work, but I've foung that application log is full of Event ID:4999
Is there any way to fix this?


"Watson report about to be sent for process id: 3832, with parameters: E12, c-RTL-AMD64, 15.02.0922.005, MSExchangeHMHost, M.Exchange.Diagnostics, .0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, PerformActualLog, M.E.Diagnostics.BlockedDeserializeTypeException, 1193763487, 15.02.0922.005.
ErrorReportingEnabled: False
exData=|exHResult=|exStacktrace=в Microsoft.Exchange.Diagnostics.DeserializationTypeLogger.PerformActualLog(Dictionary`2 hits)
в Microsoft.Exchange.Diagnostics.DeserializationTypeLogger.ProcessCachedHits()
в System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
в System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
в System.Threading.TimerQueueTimer.CallCallback()
в System.Threading.TimerQueueTimer.Fire()
в System.Threading.TimerQueue.FireNextTimers()|exTargetSite=Microsoft.Exchange.Diagnostics, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 PerformActualLog|exSource=|exMessage=|exComplete="

office-exchange-server-administration
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ZhengqiLou-MSFT avatar image
0 Votes"
ZhengqiLou-MSFT answered 56522859 commented

Hi @56522859 ,

Are you using some third party security guards?
And are there any other events and what's the CPU usage when the error occures?

Please also try disabling AMSI intergration, more details you could find in: How to disable AMSI integration with Exchange Server part.

Best regards,
Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

No, just Windows Defender

0 Votes 0 ·
56522859 avatar image
0 Votes"
56522859 answered

The CPU usage is pretty normal about 20-25% at working hours.
At the same time error occures 3 to 5 times per minute

121905-%D0%B8%D0%B7%D0%BE%D0%B1%D1%80%D0%B0%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5.png



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ZhengqiLou-MSFT avatar image
0 Votes"
ZhengqiLou-MSFT answered RobGarrett-2061 commented

Hi @56522859 ,

What interesting is that in CU10 Microsoft has fixed a Event 4999 error, but that is about ELCAssistant.InvokeInternalAssistant and a System.NullReferenceException.

I also searched about this error, and they are pointing to other different services from what you met.
OK, the error message has some import parts:

"Watson report about to be sent for process id: 3832, with parameters: E12, c-RTL-AMD64, 15.02.0922.005, MSExchangeHMHost, M.Exchange.Diagnostics, .0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, PerformActualLog, M.E.Diagnostics.BlockedDeserializeTypeException, 1193763487, 15.02.0922.005.

MSExchangeHMHost is described here: Managed Availability
Exchange Health Manager Service (MSExchangeHMHost.exe): This is a controller process used to manage worker processes. It's used to build, execute, and start and stop the worker process, as needed. It's also used to recover the worker process in case that process fails, to prevent the worker process from being a single point of failure.

And as for the M.E.Diagnostics.BlockedDeserializeTypeException, it is like some expections that coule be ignored.

I think if your server is now running correctlly(except this error), and as it is not pointing to a normal Exchange service, we could consider ignoring this event, Stop Logging a Specific Event

Best regards,
Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I'm experiencing the same symptoms, also Exchange 2019 at CU10 level.

 Watson report about to be sent for process id: 8372, with parameters: E12, c-RTL-AMD64, 15.02.0922.005, MSExchangeHMHost, M.Exchange.Diagnostics, .0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, PerformActualLog, M.E.Diagnostics.BlockedDeserializeTypeException, 1193763487, 15.02.0922.005.
 ErrorReportingEnabled: False 
 exData=|exHResult=|exStacktrace=at Microsoft.Exchange.Diagnostics.DeserializationTypeLogger.PerformActualLog(Dictionary`2 hits)
    at Microsoft.Exchange.Diagnostics.DeserializationTypeLogger.ProcessCachedHits()
    at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
    at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
    at System.Threading.TimerQueueTimer.CallCallback()
    at System.Threading.TimerQueueTimer.Fire()
    at System.Threading.TimerQueue.FireNextTimers()|exTargetSite=Microsoft.Exchange.Diagnostics, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 PerformActualLog|exSource=|exMessage=|exComplete=

I'm not sure I'm comfortable with just ignoring this error without knowing more about the conditions that can cause this to happen. I mean, seriously - if it's not "really" an error, then why generate the event at all?

0 Votes 0 ·