Mailbox Store Problem

I Have a problem with my mailbox store
In exchange server 2000 with service pack 3, suddenly mailbox and public folder stores became offline. When  I restart the and look at the event viewer of the system I saw the following error mesage in the applicvation log.

date 05.04.2004.
source MSExchange IS
Time 17:49
Category General
Type Error
Event ID 9518
User N/A
Computer SAGE


For more information, click

What should I do to correct this error
Who is Participating?
Debsyl99Connect With a Mentor Commented:

Read the all the following links etc very carefully and make sure that you're happy with what you're doing before you do anything.

First make sure that norton is only acessing and scanning the correct files on the exchange server - some have to be excluded or you get this kind of problem.

Here's a link so you know what you need to do re setting up antivirus on the exchange server:
Best practices for Symantec AntiVirus Corporate Edition RealTime Protection on a Microsoft Exchange Server
Preventing Symantec AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure
Recommendations for Troubleshooting an Exchange Computer with Antivirus Software Installed;EN-US;Q245822&ID=KB

Then the only suggestion that I can give you is to follow the instructions in the first link that I gave you ie
"To resolve this problem, run eseutil /mh on all available databases in the corresponding storage group. If all databases are consistent, run eseutil /ml on the E00.log file. If there is a signature mismatch between the E00.log file and the recorded log signature in the database (eseutil /mh output), you can perform the following procedure to resolve this problem:
Save your current log files.
Delete the E00.log file. While you mount your information store, a new E00.log file will be generated with the right signature and Lgeneration.
If you still cannot mount the information store, delete all transaction logs (including Exx.log files and Exxnnnnn.log files)" then try again.

About  Eseutil:;EN-US;317014

And a very useful PAQ here which you need to read carefully:

Consider your options first - have you got a good back-up as you may need it. If you are at all unsure consider calling microsoft as I haven't needed to check the databases/stores in this way myself - I can point you to the correct resources but I can't speak through experience yet on having done this.

Deb :))

Hi there
Fist have a look at this:;en-us;Q294367

Deb :))
And just in case this has been done:
Issues That Might Occur If You Place Exchange Data Files on Network Shares;en-us;Q314916
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

emrahtufanAuthor Commented:
I understand the source of the problem
Norton antivures quarantines the e00.log file and the problem occurs just because of this.
The rest of the logs are complete and only missing file is the e00.log
So what should I do.
emrahtufanAuthor Commented:
Hi again
By the way our exchange server runs on a microsoft active/passive cluster
is that changes anything?
Hi - Sorry but Clustering is not my field. I would definitely take the advice given in the first link, Make a copy of the databases and transaction logs before attempting any recovery!

If you can I'd wait for another expert to take a look at this if you're not sure or don't have recourse to a good back-up, sorry but I don't want to comment on stuff I'm not 100% certain about ;-)

Deb :))
emrahtufanAuthor Commented:
In default configuration Norton Antivirus exclude the exchange server directory in Program files under (generally) C. But in my case the database folder of the mailboxes (MDBDATA) is under E just because of the cluster. (Our cluster implementation includes the SAN). Therefore we ignore or forget excluding the exchange folder in SAN.  Afterthat, the exchange folder in disk E is infected by the netskyQ and norton quarantines the log files which is currently written by the exchange server. Because of this, the mailbox store becomes unmounted and database of the exchange becomes inconsistent. (actually dirty shutdown).

After I defined the problem What I performed is that;
1. from the service in the control panel I disabled all the services related with the exchange for both servers in the cluster.
2. the e00.log file is under quarantine so there is no e00.log file in the MDBDATA.
3. I excluded the exchange folder in disk E.
4. I restarted the both servers.
5. Because exchange services are disabled the excahnge services in the cluster administartor are failed to start.
6. I enabled the exchange services.
7. From the cluster administartor, I brought the exchange group online.

After I Performed all the thisngs above, the new e00.log file is created and database store of the exchange is mounted.

The next thing I want to ask is ,can these procedure be a solution for this problem.
This seems to be very illogical. Everything happens out of my control which makes me very uncomfortable.


Hi there,

Yes this will act as a solution for this problem as fortunately things have gone exactly the way that they should with the E00.log being recreated -  but it would be better to exclude the E00.log in E from scanning anyway as a matter of course - you can scan everything else - just exclude the specific log files and databases listed from scanning or monitoring by the av - Do you have anitivirus scanning the mailboxes etc - ie antivirus for exchange? Some av systems detect what they assume is a virus signature in the E00.log and then quarantine it, but actually it's safe to restore the quarantined log to it's original position, hence it's better to just exclude it. You can set the av to exclude these files from monitoring and scanning as a matter of course by using the exclude specific files and folders options in the av configuration. I have done this, and we haven't had any problems with it.

Anyway, I'm glad it's back up and running but probably not as glad as you are ;-)

Deb :))
emrahtufanAuthor Commented:
H&#305; Deb,
Although it did not solve my problem, your comments gained me a better understanding of exchange server database.
Therefore I am glad to accept your answer as accepted one.
Many many thanks
The same exact thing happened to my server today.  First thing tomorrow morning i will try your solution.
All Courses

From novice to tech pro — start learning today.