I have an Exchange 2013 server installed and noticed that the server unexpectedly rebooted itself. It created a dump file and within the dump file it states that it was caused be the MSExchangeHMWorker.
I know that Exchange 2013 has the Managed Availabilty concept and will attempt to "fix" itself if there is an issue however I would like to know why or what prompted exchange to do this so i don't have this in the future. Is there any known logs that records why this happened? I am not seeing anything in the event logs.
Thanks
Memory dump info below:
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffe001d1930900, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
----- ETW minidump data unavailable-----
PROCESS_OBJECT: ffffe001d1930900
IMAGE_NAME: wininit.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: wininit
FAULTING_MODULE: 0000000000000000
PROCESS_NAME: MSExchangeHMWo
BUGCHECK_STR: 0xEF_MSExchangeHMWo
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff8011bc89dcc to fffff8011b7cdfa0
STACK_TEXT:
ffffd000`2b8a79a8 fffff801`1bc89dcc : 00000000`000000ef ffffe001`d1930900 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffd000`2b8a79b0 fffff801`1bbac23e : ffffe001`d1930900 00000000`00000000 00000000`00000000 fffff801`1b7e353c : nt!PspCatchCriticalBreak+0xa4
ffffd000`2b8a79f0 fffff801`1ba090e9 : ffffe001`d1930900 ffffe001`d8eb6900 ffffe001`d1930900 ffffe001`d1930900 : nt! ?? ::NNGAKEGL::`string'+0x7bce
ffffd000`2b8a7a50 fffff801`1ba08e76 : ffffffff`ffffffff ffffe001`d8eb6900 ffffe001`d1930900 ffffe001`d9d89880 : nt!PspTerminateProcess+0xe5
ffffd000`2b8a7a90 fffff801`1b7d97b3 : ffffe001`d1930900 ffffe001`d9d89880 ffffd000`2b8a7b80 00000000`ffffffff : nt!NtTerminateProcess+0x9e
ffffd000`2b8a7b00 00007ffc`4bc5afca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`2d58e3f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`4bc5afca
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
IMAGE_VERSION:
FAILURE_BUCKET_ID: 0xEF_MSExchangeHMWo_IMAGE_wininit.exe
BUCKET_ID: 0xEF_MSExchangeHMWo_IMAGE_wininit.exe
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xef_msexchangehmwo_image_wininit.exe
WWT IT