I recently used the Exchange User Monitor tool to check the connections because the exchange server was running at 100% CPU constantly. When Exmon.exe crashed I weren’t able to restart it again as it presented an error. A quick Google query pointed me in the right direction.
An Exchange trace is initiated when the Exmon.exe tool is started. The trace is not closed properly when the tool crashes and it has to be closed manually.
- Make sure that Exmon.exe is not running (use CTRL+SHIFT+ESC)
- From a CMD run:
logman query -ets
This will show you all tracers that are currently running. Notice the Exchange Event Trace that’s used by Exmon
- Stop the Exchange Event Trace:
Logman stop "Exchange Event Trace" –ets
If that didn’t resolve the issue, check if there’s still some space left on the disk or if another user is already running the Exmon tool.