locked
MMC snapin since June 2019 updates, Exchange server 2016, Exchange 2016 CU12 RRS feed

  • Question

  • Since the June 2019 updates to Server 2016 with Exchange 2016, CU12, happens on both Exchange servers:When clicking on Event Viewer / Custom Views (only with Custom Views)

    Pop-up window: “MMC has detected an error in a snap-in and will unload it. Report this error to Microsoft, and then shut down MMC / Unload the snap-in and continue running”

    When selecting running; “FX:{b0556ad-fe9c-4363-be05-7a4cbb7cb510} The process cannot access the file C:\ProgramData\Microsoft\Event Viewer\msexchangerepl_events.xml’ because it is being used by another process.

    When clicking on OK, this window appears;

    When selecting running; “FX:{b0556ad-fe9c-4363-be05-7a4cbb7cb510} The process cannot access the file C:\ProgramData\Microsoft\Event Viewer\msexchangerepl_events.xml’ because it is being used by another process.

    When clicking on OK, this window appears:

    Event Viewer (Local)

    Snap-in Unavailable

    This snap-in performed a non-valid operation and has been unloaded. To continue working with this snap-in, restart MMC or try loading the snap-in again.

    Exception Type: System.IO.IOException

    Exception Message: The process cannot access the file ‘C:\ProgramData\Microsoft\Event Viewer\msexchangerepl_events.xml’ because it is being used by another process.

    at System.IO._Error.WinIOError(Int32 errorCode, String maybeFullPath)

    at Sytem.IO.FileStream.Init(String path, FileMode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

    bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)

    at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)

     

    In Applications and Services Log – Microsoft - Windows – Event-ForwardingPlugin:

    Informational Event 106, Eventlog-ForwardingPlugin Subscription policy has changed.  Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.

    Anybody knowing what to do? I have executed FindLockingProcess.psm1 on both servers and it did not find anything. The file msexchangerepl_events.xml dates 6/11/2019, that is the update date.

    Marcel


    • Edited by Snx1 Friday, June 14, 2019 5:21 AM
    Friday, June 14, 2019 5:21 AM

Answers

  • I can confirm this affects both Exchange 2010 and 2016 (tested in dev environment) only with the latest June update.

    Uninstalling KB4503267 (Server 2016) or KB4503292 (Server 2008 R2) seems to get the functionality back.

    As it looks like a trend I imagine it's KB4503276 for Server 2012 R2 as well

    Microsoft are aware of the issue and there is a "workaround" (query the custom view using powershell) if you don't want to remove the KB, your mileage may vary.

    • Proposed as answer by Tamothy Friday, June 14, 2019 3:58 PM
    • Edited by Tamothy Friday, June 14, 2019 4:33 PM fix spelling
    • Marked as answer by Edward van BiljonMVP Thursday, November 7, 2019 7:25 PM
    Friday, June 14, 2019 3:31 PM

All replies

  • Does this happen after a reboot as well?

    If it is a bug then you will need to open a case with Microsoft.


    Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, June 14, 2019 7:08 AM
  • > Does this happen after a reboot as well?

    Yes. Just tried it again to be sure.

    > If it is a bug then you will need to open a case with Microsoft.

    Well, it's certainly not a feature. Since it appeared only after the June 2016 updates, either the 2019-06 CU or the Sec Update for Exchange 2016 CU12 and it appeared on both identical Mailers I - probably as you - see a connection btw. this bug and the updates. Any ideas how to define bugs and when to involve Microsoft?

    Friday, June 14, 2019 9:39 AM
  • Let's define it a bit better and call it an error. This error ALWAYS occurs when opening Event Viewer and just clicking on "Custom Views". Only on "Custom Views", the other display properly. Always the identical error messages appear. It is therefore very easy to replicate.

    IMO it has something to do with I/O mgmt, probably with a second process occupying memory, port etc. Probably with the file msexchangerepl_events.xml. But FindLockingProcess.psm1 did not find anything and I have no idea how the Event Viewer is working.

    Friday, June 14, 2019 9:59 AM
  • I can confirm this affects both Exchange 2010 and 2016 (tested in dev environment) only with the latest June update.

    Uninstalling KB4503267 (Server 2016) or KB4503292 (Server 2008 R2) seems to get the functionality back.

    As it looks like a trend I imagine it's KB4503276 for Server 2012 R2 as well

    Microsoft are aware of the issue and there is a "workaround" (query the custom view using powershell) if you don't want to remove the KB, your mileage may vary.

    • Proposed as answer by Tamothy Friday, June 14, 2019 3:58 PM
    • Edited by Tamothy Friday, June 14, 2019 4:33 PM fix spelling
    • Marked as answer by Edward van BiljonMVP Thursday, November 7, 2019 7:25 PM
    Friday, June 14, 2019 3:31 PM
  • Only that the function they propose is not working. The first part is to get a "List of custom views on the machine" and this returns nothing. It is therefore impossible to know what to enter with the get-eventviewer command.
    Saturday, June 15, 2019 6:24 AM
  • Hi Snx1,

     

    I tested it my Lab which installed June 2019 updates, and reproduces the issue.

     

    If Tomathy's suggestion not work, I suggest you uninstall June 2019 updates as workaround, then check the result. As the KB mentioned, Microsoft is working on a resolution and estimate a solution will be available in late June. You could re- install the updates in next month.

     

    Regards,

    Kelvin Deng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    • Proposed as answer by ThinkCenter Thursday, June 20, 2019 6:44 AM
    Monday, June 17, 2019 8:36 AM
  • Just to add another data point, I had the Exchange 2016 Management Shell loaded on Windows 10 Enterprise v 1809 (17763.557) and had exactly the same issue.  Issue remained after uninstalling Exchange 2016, currently removing KB4503327 to see if that fixes it.

    Edit: Removing KB4503327 fixed Custom Views in Event Viewer for me.

    • Edited by SoulkeepHL Tuesday, June 18, 2019 8:10 PM
    Tuesday, June 18, 2019 7:23 PM
  • Only that the function they propose is not working. The first part is to get a "List of custom views on the machine" and this returns nothing. It is therefore impossible to know what to enter with the get-eventviewer command.

    Because there's a little error in the script. This will work: the variable $view_name was not double quoted in a where-object check so it failed on unescaped spaces.

    The script output is not easily read, however, so it's  probably better saving the output and checking it in a text editor.

    function get-EventViewer {
                    Write-Output "List of custom views on the machine"
                    Write-Output ""
                    Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | % { select-xml -Path $_.FullName -xpath "//Name" } | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty InnerXml
                    Write-Output ""
                    $view_name = Read-Host "Enter the name of custom view to execute"
     
     
                    # Get the file name of the view
                    $ViewFile = Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | where-object { (Select-Xml -Path $_.FullName -xpath "//Name").Node.InnerXml -eq "$view_name" }
     
                    Get-WinEvent -FilterXml ([xml]((Select-Xml -Path $ViewFile.FullName -XPath "//QueryList").node.OuterXml))
    }

    Tuesday, June 18, 2019 10:41 PM
  • Hi Snx1,

     

    I am writing here to confirm with you how the thing going now?

     

    If you need further help, please provide more detailed information, so that we can give more appropriate suggestions

     

    Regards,

    Kelvin Deng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, June 21, 2019 7:59 AM
  • I noticed the same on our test environment. (here for the updates :-) )
    KB4503267 is installed

    • Edited by D_Goossens Monday, June 24, 2019 11:35 AM
    Monday, June 24, 2019 11:33 AM
  • Same here on Server 2016 with Exchange Server 2016 CU12 an the June Updates.

    Has someone with CU13 the same failure?

    Monday, June 24, 2019 12:36 PM

  • I'm installing it now > KB4503294, but again it's a huge one...I think it will be the same, since the problem apparently also occurs on Win10.
    https://www.ghacks.net/2019/06/12/windows-10-event-viewer-error-after-installing-kb4503293-and-kb4503327/

    PS : 
    https://support.microsoft.com/en-ca/help/4503267/windows-10-update-kb4503267

    When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, "MMC has detected an error in a snap-in and will unload it." and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

    This issue is resolved in KB4503294.



    • Edited by D_Goossens Monday, June 24, 2019 12:58 PM
    Monday, June 24, 2019 12:44 PM
  • EDIT : KB4503294 installed, and it indeed fixes the issue
    • Edited by D_Goossens Thursday, June 27, 2019 3:53 PM
    • Proposed as answer by ThinkCenter Friday, June 28, 2019 6:24 AM
    Monday, June 24, 2019 1:52 PM
  • I'm getting this error as well, Server 2016 Datacenter with Exchange 2016, precisely as described except (My two cents to this fine thread): I didn't realize the error occurred with Custom Views, because it's not "only" that. I discovered the issue attempting to "Filter Current Log...". Makes it difficult to search and sort through 72,000 events.

    KB4503267 is applied to the system. Now to get permission to remove it. Thanks all.

    Friday, December 20, 2019 3:47 PM