The most common issue is that Exmon crashed while collecting data and the Exchange trace is still in progress.  Follow the steps given below to stop the Exmon trace.

  • Make sure the ExMon.exe process isn’t running.
  • From CMD, Query running traces:
    • logman query -ets
  • If running, stop Exmon trace:
    • logman stop “Exchange Event Trace” -ets
  • Verify trace is no longer running:
    • logman query -ets

If that did not resolve the issue, check the following:

  • The disk did not run out of space.
    • If it did, clear out the old ETL files, make space on the drive or move the install directory to a larger drive.
  • Another user is running Exmon already.
    • Ask the other user to stop tracing and exit Exmon. Then restart your Tracing and start saving the Trace files talks about how to use Microsoft Exchange Server User Monitor and also outlines a way in which you can use Tracelog.exe to stop the Exmon trace.

-Thanks, Jinesh.