Exchange Monitor crashes

HeroldEng

Afternoon everyone,

I'm having an issue with the Exchange Monitor continuously crashing. The service will connect and operate for up to about 2 minutes and then crash.

Running Windows Server 2012R2 Exchange 2013 CU23

The server event logs report says:
Faulting application name: exchangemonitor.exe, version: 12.0.0.0, time stamp: 0x595fd3a9
Faulting module name: exchangemonitor.exe, version: 12.0.0.0, time stamp: 0x595fd3a9
Exception code: 0xc0000417
Fault offset: 0x000000000005fc1c
Faulting process id: 0x3d30
Faulting application start time: 0x01d9b117221edb18
Faulting application path: C:\Program Files\WatchGuard\WatchGuard Authentication Gateway\exchangemonitor.exe
Faulting module path: C:\Program Files\WatchGuard\WatchGuard Authentication Gateway\exchangemonitor.exe
Report Id: 7db5bb65-1d0a-11ee-8144-00155d0f1e15
Faulting package full name:
Faulting package-relative application ID:

The exchangemonitor log says:

2023-07-07T14:16:55Z [tid:10264] INFO: Log file max size is '10' MB.
2023-07-07T14:16:55Z [tid:10264] : == Launched WatchGuard Authentication Exchange Monitor (10116), Version 12, 0, 0, 0 (build 535154), Build 535154,
on Microsoft Windows Server 2012 R2 Standard Edition (build 9200), 64-bit ==
2023-07-07T14:16:55Z [tid:10264] INFO: Are you running win32 or x64 application on OS accordingly? Unknown Exchange version, so assume for Exchange 2010
2023-07-07T14:16:55Z [tid:10264] DEBUG: Process thread count 16.
2023-07-07T14:16:55Z [tid:8660] INFO: [Thread Body] #2 [Thread: Response] thread start
2023-07-07T14:16:55Z [tid:16048] INFO: [Thread Body] [3-2] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16476] INFO: [Thread Body] #1 [Thread: Connect To SSO Agent] thread start
2023-07-07T14:16:55Z [tid:16760] INFO: [Thread Body] [3-5] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:15672] INFO: [Thread Body] [3-8] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:15900] INFO: [Thread Body] [3-4] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:13744] INFO: [Thread Body] [3-7] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16332] INFO: [Thread Body] [3-11] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:12836] INFO: [Thread Body] [3-1] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:6976] INFO: [Thread Body] [3-14] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:7048] INFO: [Thread Body] [3-0] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:15468] INFO: [Thread Body] #4 [Thread: Poll Users Of Exchange] thread start
2023-07-07T14:16:55Z [tid:15056] INFO: [Thread Body] [3-12] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:15772] INFO: [Thread Body] [3-15] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16352] INFO: [Thread Body] [3-13] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16232] INFO: [Thread Body] [3-3] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16512] INFO: [Thread Body] [3-6] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:6024] INFO: [Thread Body] [3-10] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:16984] INFO: [Thread Body] [3-9] [Thread: Process] thread start
2023-07-07T14:16:55Z [tid:15468] INFO: Not initialized or no connections, wait a short while
2023-07-07T14:16:56Z [tid:16476] ERROR: [Thread Body] #1 [Thread: Connect To SSO Agent] receive sso agent connection request.
2023-07-07T14:16:56Z [tid:16476] INFO: response HashLen = 20, pHash = 128610adebeedfdb3f2f010e3d9bde084bbb545a
2023-07-07T14:16:56Z [tid:16476] ERROR: [Thread Body] #1 [Thread: Connect To SSO Agent] receive sso agent connection request.
2023-07-07T14:16:56Z [tid:16476] INFO: [Thread Body] #1 [Thread: Connect To SSO Agent] receive sso agent disconnection request.
2023-07-07T14:16:56Z [tid:16476] DEBUG: WSACloseEvent: close index 2 successfully.
2023-07-07T14:16:56Z [tid:10264] DEBUG: logpath is :C:\inetpub\logs\LogFiles\w3svc1
2023-07-07T14:16:56Z [tid:10264] INFO: Running threads: 19
2023-07-07T14:16:56Z [tid:16476] DEBUG: Received command:async-0000-000D-xx-00-0 set debug off

I'm not really sure what the issue is or how I'm supposed to keep this service running.

james.carson

Hi @HeroldEng
In general the exchange monitor doesn't work as well as some of the other options. If you're trying to get phones/tablets or something similar identified on your network, I'd suggest using RADIUS SSO (RSSO.) It works via RADIUS accounting messages (if you have a wireless network with WPA/2 enterprise set up.)

See: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/authentication/rsso_about.html

With regards to the SSO Exchange Monitor, I'd suggest opening a support case if you haven't already. The logs here don't really show a cause of the crash, they just show the crash happened.