Tuesday, July 17, 2012

Unknown StartTrace error (183)

If the Exchange User Monitor (ExMon) crashes, when relaunching the ExMon application you will get the following error:

Unknown StartTrace error (183)

This error occurs because there is still an active Event Trace open.  To resolve this problem you need to kill the active Event Trace.  In Windows Server 2000/2003 the Event Trace can be killed using a tool called Tracelog.exe which can be downloaded from the following URL:


In Windows Server 2008 the Event Trace can be killed using a tool called Logman.exe

To view all Data Collector Sets currently running on a Windows 2008 server with Logman run the following command:

logman query -ets

To kill the event trace use the following command:

Logman stop "Exchange Event Trace" -ets

After stopping the Event Trace, ExMon will now load correctly.


  1. You can easily stop it in Server manager. When you run ExMon util it creates own Event Trace Session under:
    Server Manager / Diagnostics / Performance / Data Collector Sets / Event Trace Sessions / Exchange Event Trace
    Sometimes it couldn't stop longman using command line util ...

  2. sweet..been looking for the replacement for tracelog..awesome!

  3. I don't have Exchange Event Trace running and disk space is about 30% free
    I believe server restart will help, but I don't want to restart Exchange server every time this error occured