Event 4999 - Watson report about to be sent for process id: 27244 on Mailbox Server every five minutes

Question

_{Wednesday, June 25, 2014 6:47 PM}

On one of my DAG enabled Exchange 2013 mailbox servers, I get this error in event viewer every five minutes:

Log Name:      Application
Source:        MSExchange Common
Date:          6/25/2014 10:49:46 AM
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:    mailboxserver  
Description:
Watson report about to be sent for process id: 27244, with parameters: E12IIS, c-RTL-AMD64, 15.00.0913.022, M.E.RpcClientAccess.Service, unknown, M.E.R.S.U.DatabaseInfo..ctor, System.NullReferenceException, aba8, unknown.
ErrorReportingEnabled: True 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Common" />
    <EventID Qualifiers="16388">4999</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-25T17:49:46.000000000Z" />
    <EventRecordID>687360</EventRecordID>
    <Channel>Application</Channel>
    <Computer>mailboxserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>27244</Data>
    <Data>E12IIS</Data>
    <Data>c-RTL-AMD64</Data>
    <Data>15.00.0913.022</Data>
    <Data>M.E.RpcClientAccess.Service</Data>
    <Data>unknown</Data>
    <Data>M.E.R.S.U.DatabaseInfo..ctor</Data>
    <Data>System.NullReferenceException</Data>
    <Data>aba8</Data>
    <Data>unknown</Data>
    <Data>True</Data>
    <Data>False</Data>
    <Data>Microsoft.Exchange.RpcClientAccess.Service</Data>
    <Data>
    </Data>
  </EventData>
</Event>

Everything is working ok, but I'm concerning that I"m seeing this.  

ST

All replies (7)

_{Wednesday, June 25, 2014 11:41 PM ✅Answered}

Do you see same process id every time or different? I believe it should be different and that means its restarting RPC Client Access service...

Try increasing connection time out as per... RPC Client Access Service keeps restarting in Exchange 2013

Blog | Get Your Exchange Powershell Tip of the Day from here

_{Monday, June 30, 2014 8:56 AM ✅Answered}

Hi ST,

How about the suggestion from Amit?

If that workaround doesn't work, I suggest ignore it if everything runs well. Let's wait for the next Patch.

Found an article to stop logging a specific event:

Stop Logging a Specific Event

http://technet.microsoft.com/en-us/library/bb687437.aspx

Feel free to update if there is any problem.

Thanks

Mavis

If you have feedback for TechNet Subscriber Support, contact [email protected]

Mavis Huang
TechNet Community Support

_{Wednesday, June 25, 2014 8:19 PM}

Do you have latest CU applied? If its a known bug then it might have been fixed in latest CU...

Cumulative Update 5 for Exchange Server 2013 - http://support.microsoft.com/kb/2936880

Blog | Get Your Exchange Powershell Tip of the Day from here

_{Wednesday, June 25, 2014 11:11 PM}

Good call Amit, but I'm already at CU5.

ST

_{Wednesday, July 2, 2014 3:25 AM}

Hi ST,

I am just writing to see if you have obtained the opportunity to test the solution. If anything is unclear with the previous information I've provided to you, please don't hesitate to let me know. I am glad to be of assistance.

Thanks

Mavis

Mavis Huang
TechNet Community Support

_{Thursday, July 3, 2014 12:05 AM}

Amit,

I don't see the same type of 4999 error every five minutes anymore.  It only get the 4999 error about 3 times a day.  I get one with the same ID and other completely different process ID.  The error is below:

Log Name:      Application
Source:        MSExchange Common
Date:          7/2/2014 6:01:36 AM
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     computer
Description:
Watson report about to be sent for process id: 13152, with parameters: E12, c-RTL-AMD64, 15.00.0913.022, w3wp#MSExchangeOWAAppPool, M.E.Data.ApplicationLogic, M.E.D.S.GccUtils.GetClientIPEndpointsFromHttpRequest, System.NullReferenceException, 868, 15.00.0913.017.
ErrorReportingEnabled: True 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Common" />
    <EventID Qualifiers="16388">4999</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-07-02T13:01:36.000000000Z" />
    <EventRecordID>825358</EventRecordID>
    <Channel>Application</Channel>
    <Computer>computer</Computer>
    <Security />
  </System>
  <EventData>
    <Data>13152</Data>
    <Data>E12</Data>
    <Data>c-RTL-AMD64</Data>
    <Data>15.00.0913.022</Data>
    <Data>w3wp#MSExchangeOWAAppPool</Data>
    <Data>M.E.Data.ApplicationLogic</Data>
    <Data>M.E.D.S.GccUtils.GetClientIPEndpointsFromHttpRequest</Data>
    <Data>System.NullReferenceException</Data>
    <Data>868</Data>
    <Data>15.00.0913.017</Data>
    <Data>True</Data>
    <Data>False</Data>
    <Data>w3wp#MSExchangeOWAAppPool</Data>
    <Data>
    </Data>
  </EventData>
</Event>

Going to keep an eye on it, but its not causing any issues. 

ST

_{Thursday, July 3, 2014 12:07 AM}

Mavis,

Thanks for the follow up.  I'm not getting a flood of the 4999 errors anymore.  The only thing I've changed is removed the default Exchange 2013 databases.  Will keep an eye on it though.

I appreciate the help.

ST