Event ID 1009 and high CPU or memory usage in noderunner.exe in Exchange Server 2013

Applies to: Exchange Server 2013 EnterpriseExchange Server 2013 Standard Edition


After you apply Cumulative Update 10 or Cumulative Update 11 for Microsoft Exchange Server 2013, you may experience some or all of the following symptoms:
  • High CPU usage in the noderunner.exe process
  • High memory usage in noderunner.exe
  • High handle count in noderunner.exe
  • Failed content indexes
  • Database failovers
Memory usage may exceed 10 GB for a single noderunner.exe process, and handle counts may exceed 20,000.

Additionally, the following event may be logged in the Application log:

If you review the Search Service logs, you may see several events that contain the following text:

Also, the following event is logged in the System log:

Finally, the Unified Logging Service (ULS) logs may contain several events with the following text:
System.TimeOutException Parsing

Operation timed out

 By default, the Search Service logs are located at %ProgramDir%\Microsoft\Exchange Server\V15\Logging\Search, and the ULS logs are located at %ProgramData%\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs.

Database failovers occur when content indexes are marked "Failed" or "Failed and Suspended." These failovers are typically indicated in the Application log through event ID 122.


This issue occurs because the Exchange Search and Microsoft Exchange Search Host Controller services are stopped by the Exchange Server 2013 Managed Availability diagnosticwhen parsing certain types of embedded OLE objects. Therefore, the content index is changed to a Failed and Suspended state. This behavior was introduced in Cumulative Update 10 and shouldn't be triggered by any earlier cumulative updates.



Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.