Mailbox Store Problem

Posted on 2004-04-05
Last Modified: 2008-03-04
I Have a problem with my mailbox store
In exchange server 2000 with service pack 3, suddenly mailbox and public folder stores became offline. When  I restart the and look at the event viewer of the system I saw the following error mesage in the applicvation log.

date 05.04.2004.
source MSExchange IS
Time 17:49
Category General
Type Error
Event ID 9518
User N/A
Computer SAGE


For more information, click

What should I do to correct this error
Question by:emrahtufan
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
LVL 20

Expert Comment

ID: 10758196
Hi there
Fist have a look at this:;en-us;Q294367

Deb :))
LVL 20

Expert Comment

ID: 10758266
And just in case this has been done:
Issues That Might Occur If You Place Exchange Data Files on Network Shares;en-us;Q314916

Author Comment

ID: 10758977
I understand the source of the problem
Norton antivures quarantines the e00.log file and the problem occurs just because of this.
The rest of the logs are complete and only missing file is the e00.log
So what should I do.
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 20

Accepted Solution

Debsyl99 earned 500 total points
ID: 10759205

Read the all the following links etc very carefully and make sure that you're happy with what you're doing before you do anything.

First make sure that norton is only acessing and scanning the correct files on the exchange server - some have to be excluded or you get this kind of problem.

Here's a link so you know what you need to do re setting up antivirus on the exchange server:
Best practices for Symantec AntiVirus Corporate Edition RealTime Protection on a Microsoft Exchange Server
Preventing Symantec AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure
Recommendations for Troubleshooting an Exchange Computer with Antivirus Software Installed;EN-US;Q245822&ID=KB

Then the only suggestion that I can give you is to follow the instructions in the first link that I gave you ie
"To resolve this problem, run eseutil /mh on all available databases in the corresponding storage group. If all databases are consistent, run eseutil /ml on the E00.log file. If there is a signature mismatch between the E00.log file and the recorded log signature in the database (eseutil /mh output), you can perform the following procedure to resolve this problem:
Save your current log files.
Delete the E00.log file. While you mount your information store, a new E00.log file will be generated with the right signature and Lgeneration.
If you still cannot mount the information store, delete all transaction logs (including Exx.log files and Exxnnnnn.log files)" then try again.

About  Eseutil:;EN-US;317014

And a very useful PAQ here which you need to read carefully:

Consider your options first - have you got a good back-up as you may need it. If you are at all unsure consider calling microsoft as I haven't needed to check the databases/stores in this way myself - I can point you to the correct resources but I can't speak through experience yet on having done this.

Deb :))


Author Comment

ID: 10759521
Hi again
By the way our exchange server runs on a microsoft active/passive cluster
is that changes anything?
LVL 20

Expert Comment

ID: 10760010
Hi - Sorry but Clustering is not my field. I would definitely take the advice given in the first link, Make a copy of the databases and transaction logs before attempting any recovery!

If you can I'd wait for another expert to take a look at this if you're not sure or don't have recourse to a good back-up, sorry but I don't want to comment on stuff I'm not 100% certain about ;-)

Deb :))

Author Comment

ID: 10763434
In default configuration Norton Antivirus exclude the exchange server directory in Program files under (generally) C. But in my case the database folder of the mailboxes (MDBDATA) is under E just because of the cluster. (Our cluster implementation includes the SAN). Therefore we ignore or forget excluding the exchange folder in SAN.  Afterthat, the exchange folder in disk E is infected by the netskyQ and norton quarantines the log files which is currently written by the exchange server. Because of this, the mailbox store becomes unmounted and database of the exchange becomes inconsistent. (actually dirty shutdown).

After I defined the problem What I performed is that;
1. from the service in the control panel I disabled all the services related with the exchange for both servers in the cluster.
2. the e00.log file is under quarantine so there is no e00.log file in the MDBDATA.
3. I excluded the exchange folder in disk E.
4. I restarted the both servers.
5. Because exchange services are disabled the excahnge services in the cluster administartor are failed to start.
6. I enabled the exchange services.
7. From the cluster administartor, I brought the exchange group online.

After I Performed all the thisngs above, the new e00.log file is created and database store of the exchange is mounted.

The next thing I want to ask is ,can these procedure be a solution for this problem.
This seems to be very illogical. Everything happens out of my control which makes me very uncomfortable.


LVL 20

Expert Comment

ID: 10764342
Hi there,

Yes this will act as a solution for this problem as fortunately things have gone exactly the way that they should with the E00.log being recreated -  but it would be better to exclude the E00.log in E from scanning anyway as a matter of course - you can scan everything else - just exclude the specific log files and databases listed from scanning or monitoring by the av - Do you have anitivirus scanning the mailboxes etc - ie antivirus for exchange? Some av systems detect what they assume is a virus signature in the E00.log and then quarantine it, but actually it's safe to restore the quarantined log to it's original position, hence it's better to just exclude it. You can set the av to exclude these files from monitoring and scanning as a matter of course by using the exclude specific files and folders options in the av configuration. I have done this, and we haven't had any problems with it.

Anyway, I'm glad it's back up and running but probably not as glad as you are ;-)

Deb :))

Author Comment

ID: 10765286
H&#305; Deb,
Although it did not solve my problem, your comments gained me a better understanding of exchange server database.
Therefore I am glad to accept your answer as accepted one.
Many many thanks

Expert Comment

ID: 10992224
The same exact thing happened to my server today.  First thing tomorrow morning i will try your solution.

Featured Post

[Webinar] Learn How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
This video discusses moving either the default database or any database to a new volume.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit If you want to manage em…
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question