Link to home
Start Free TrialLog in
Avatar of janos2
janos2

asked on

What needs to be done after running ESEUTIL /d /p

Hi All,

We are currently running Exchange 5.5 Standard edition and out IS was at 15.5GB. Therefore I ran an offline defrag with the following switches.

eseutil /d /ispriv /td:\dback\tempdfrag.edb /p

Thsi all ran through successfully but we only managed to compact the IS to 14.4GB !! :o(

My question is this...

What is the correct procedure for moving the old priv.edb out the way and moving the new tempdfrag.edb in to the mdbdata folder?? Is it as simple as using windows explorer to cut and paste and rename??

Thanks in advance
ASKER CERTIFIED SOLUTION
Avatar of Emptyone
Emptyone
Flag of Norway image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of janos2
janos2

ASKER

I did that but was a bit concerned that it was too simplistic!!
The reason I am querying it now is that the server has since crashed out twice, and the event log has numerous strange events being recorded, such as:

/// "MSExchangeIS (491) Unable to create the log. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1022. " 
--- There is plenty of space available and the drive is definitely not read-only ---

/// An error occurred while writing to the database log file. Attempting to stop the Microsoft Exchange Information Store.

/// MSExchangeIS (491) The database engine failed with error -510 while trying to log the commit of a transaction.  To ensure database consistency, the process was terminated.  Simply restart the process to force database recovery and return the database to a consistent state.

/// An error was returned from the messaging software the Internet Mail Service uses to process messages on the Microsoft Exchange Server. It is possible that the piece of mail being processed at the time will be returned to the sender as a failed delivery instead of being delivered. The message will be moved to the "BAD" folder, if possible, and the error is not a temporary error. Otherwise it will be retried when the service is restarted. Use the appropriate utilities found in the SUPPORT directory of your Exchange CD to view and manipulate messages that have been moved to the "BAD" folder.

/// A serious error has occurred while trying to send mail into the Exchange Information Store. The Internet Mail Service is being shut down.

These events have never occurred until after we ran the ESEUTIL, and now we are more than a little concerned!!

Any ideas?
Have you set compression on the driver or directory where the logs are located?
Avatar of janos2

ASKER

No neither are using compression.

when you swapped out the EDB files, did you clear out the EDB*.logs & the CHK file? They would no longer match and are not needed with the defragged file since it was in a consistent state to begin with.
Avatar of janos2

ASKER

Thanks for your help guys.

It all seems fine now.
Glad I could help. But did the error go away by itself?
Avatar of janos2

ASKER

I spoke too soon!!

The server just crashed again and the event logs have the same sequence of error messages as before...

I have no idea what the problem could be... any help is greatly appreciated.
Have you tried the solution from seeimred?
Are there any errors in the eventlog?
Also, have a look on this KB

http://support.microsoft.com/default.aspx?scid=kb;en-us;275602&Product=ech

It looks a lot like the messages you have
Avatar of janos2

ASKER

These are in the event logs:

/// "MSExchangeIS (491) Unable to create the log. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1022. " 
--- There is plenty of space available and the drive is definitely not read-only ---

/// An error occurred while writing to the database log file. Attempting to stop the Microsoft Exchange Information Store.

/// MSExchangeIS (491) The database engine failed with error -510 while trying to log the commit of a transaction.  To ensure database consistency, the process was terminated.  Simply restart the process to force database recovery and return the database to a consistent state.

/// An error was returned from the messaging software the Internet Mail Service uses to process messages on the Microsoft Exchange Server. It is possible that the piece of mail being processed at the time will be returned to the sender as a failed delivery instead of being delivered. The message will be moved to the "BAD" folder, if possible, and the error is not a temporary error. Otherwise it will be retried when the service is restarted. Use the appropriate utilities found in the SUPPORT directory of your Exchange CD to view and manipulate messages that have been moved to the "BAD" folder.

/// A serious error has occurred while trying to send mail into the Exchange Information Store. The Internet Mail Service is being shut down.
What are the Event id on these errors?
Avatar of janos2

ASKER

/// Entries in the application log + EventID's. \\\

Event ID = 125  ----- MSExchangeIS (491) Unable to create the log. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1022.


Event ID = 1111 ----- An error occurred while writing to the database log file. Attempting to stop the Microsoft Exchange Information Store.

Event ID = 193 ----- MSExchangeIS (491) The database engine failed with error -510 while trying to log the commit of a transaction.  To ensure database consistency, the process was terminated.  Simply restart the process to force database recovery and return the database to a consistent state.

Event ID = 4116 ----- An error was returned from the messaging software the Internet Mail Service uses to process messages on the Microsoft Exchange Server. It is possible that the piece of mail being processed at the time will be returned to the sender as a failed delivery instead of being delivered. The message will be moved to the "BAD" folder, if possible, and the error is not a temporary error. Otherwise it will be retried when the service is restarted. Use the appropriate utilities found in the SUPPORT directory of your Exchange CD to view and manipulate messages that have been moved to the "BAD" folder.

Event ID = 4102 ----- A serious error has occurred while trying to send mail into the Exchange Information Store. The Internet Mail Service is being shut down.
This is probably caused by your antivirus software. Exclude the exchange folder from the real time scanning of files, and you will likely be up and running as you should. What happens here is that your antivirus software finds virus in log files and removes them, and thereby giving exchange problems keeping track of its log files.
Avatar of janos2

ASKER

We don't have any AV on this particular box!?!

I have also had a look at the link you provided, and although the errors tie up to those that we are getting it refers to restoring a previous online restore, and that this affects the number generation of the transaction logs.... I am not quite sure what this means or how to find out what transaction log numbers are.??!??
I'll ask my question again as it is directly related to "transaction logs".  When you swapped out the EDB file in the \MDBDATA folder, did you clear out the existing edb*.log files and the CHK file??? These are the transaction logs and should have been removed at the time of the edb swap. They would have no longer matched the log signature with the post-defrag file.

If you did not clear those existing logs out, you need to stop the IS and do it ASAP. You may also need to run isinteg -pri -fix -test alltests while the IS is stopped.

Once you're out of the woods, you can reassess your file size situation.  Check your ISMaint schedule and adjust it to start and complete a full cycle of garbagecollect. Verify when it starts from the Event App log info event 700. Completed is registered as an info event 704, and a final summary info event of 1221 indicating the amount of space regained as whitespace inside the database after scavaging expired deleted items.  Based on the 1221 event, you can then determine how much the file will shrink physically with another pass at eseutil /d.
Avatar of janos2

ASKER

Ok,

No I didn't clear out the existing edb*.log files or the CHK file. I have looked at the mdbdata folder however and none of the edb*.log file have date stamps older than today (there also is no CHK file in this directory - not sure if there is supposed to be though)

Do I still need to run the isinteg??

The ISMaint schedule appears to be set up correctly and the 1221 log show 24 MB free space!! looks like I need to tone down the deleted item retension!!

There should be an edb.chk file somewhere. Try a file search for it.

Decreasing the Deleted Item Retention will help. When you're running standard Ed. and are bumping the 16 Gb ceiling, you walk a fine line with DIR.

You could start troubleshooting those errors by stopping the IS, run eseutil /mh and verify the State of each edb file. Make sure they are Consistent. Then clear out those logs. Start up the IS and monitor for the Events.  If they reappear, next step would probably be the isinteg.

We haven't asked about your backup situation. What are you using and is it Exchange-aware?
Avatar of janos2

ASKER

Found the edb.chk on c:\exchsrvr\mdbdata (even though the priv.edb to d:\  -- is this ok??)

We are using Arcserve 2000 with the exchange module.

When you say verify the state of each edb file does the eseutil /mh do this for you?? and if they are consistent do I just delete them??

Thanks for your help on this...
The location of the edb.chk if fine but it probably contains references to the old pre-compacted files.
I never say delete unless you have no room to spare. If you delete them first, you have no way back if something goes wrong.  Move or rename is better until you get a successful restart of the service. Then it should be safe to discard them with a delete.

Let's start with this:
Stop the IS service
run eseutil /mh -ispriv & -ispub
verify the State = consistent
clear out all the log files (including the edb.log)
clear out the edb.chk on C:
restart the IS service
monitor the event app log for a reoccurance of those errors.
Avatar of janos2

ASKER

I will give this a try over the weekend and report back..

Thanks for the continued help on this....