Solved

Mailbox Store Problem

Posted on 2004-04-05
10
1,065 Views
Last Modified: 2008-03-04
Hi
I Have a problem with my mailbox store
In exchange server 2000 with service pack 3, suddenly mailbox and public folder stores became offline. When  I restart the and look at the event viewer of the system I saw the following error mesage in the applicvation log.

date 05.04.2004.
source MSExchange IS
Time 17:49
Category General
Type Error
Event ID 9518
User N/A
Computer SAGE

Description:
Error Current log file missing starting Storage Group /DC=TR/DC=GOV/DC=TUBITAK/DC=SAGE/CN=CONFIGURATION/CN=SERVICES/CN=MICROSOFT EXCHANGE/CN=SAGE/CN=ADMINISTRATIVE GROUPS/CN=FIRST ADMINISTRATIVE GROUP/CN=SERVERS/CN=SAGEMAIL/CN=INFORMATIONSTORE/CN=FIRST STORAGE GROUP on the Microsoft Exchange Information Store.
<NULL>.

For more information, click http://www.microsoft.com/contentredirect.asp.

What should I do to correct this error
Thanks
0
Comment
Question by:emrahtufan
  • 5
  • 4
10 Comments
 
LVL 20

Expert Comment

by:Debsyl99
ID: 10758196
Hi there
Fist have a look at this:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q294367

Deb :))
0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 10758266
And just in case this has been done:
Issues That Might Occur If You Place Exchange Data Files on Network Shares
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314916
0
 

Author Comment

by:emrahtufan
ID: 10758977
Hi
I understand the source of the problem
Norton antivures quarantines the e00.log file and the problem occurs just because of this.
The rest of the logs are complete and only missing file is the e00.log
So what should I do.
Thanks
0
 
LVL 20

Accepted Solution

by:
Debsyl99 earned 500 total points
ID: 10759205
Hi,

Read the all the following links etc very carefully and make sure that you're happy with what you're doing before you do anything.

First make sure that norton is only acessing and scanning the correct files on the exchange server - some have to be excluded or you get this kind of problem.

Here's a link so you know what you need to do re setting up antivirus on the exchange server:
Best practices for Symantec AntiVirus Corporate Edition RealTime Protection on a Microsoft Exchange Server
http://service1.symantec.com/SUPPORT/ent-security.nsf/d04e6f2f2dfad5de88256c910079502c/806e6f9b42422d6088256c2f007cd9fa?OpenDocument&src=bar_sch_nam
Preventing Symantec AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002090916040948?Open&src=bar_sch_nam&docid=2002090915484448&nsf=ent-security.nsf&view=d04e6f2f2dfad5de88256c910079502c&dtype=&prod=&ver=&osv=&osv_lvl=
Recommendations for Troubleshooting an Exchange Computer with Antivirus Software Installed
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q245822&ID=KB

Then the only suggestion that I can give you is to follow the instructions in the first link that I gave you ie
"To resolve this problem, run eseutil /mh on all available databases in the corresponding storage group. If all databases are consistent, run eseutil /ml on the E00.log file. If there is a signature mismatch between the E00.log file and the recorded log signature in the database (eseutil /mh output), you can perform the following procedure to resolve this problem:
Save your current log files.
Delete the E00.log file. While you mount your information store, a new E00.log file will be generated with the right signature and Lgeneration.
If you still cannot mount the information store, delete all transaction logs (including Exx.log files and Exxnnnnn.log files)" then try again.


About  Eseutil:
http://www.winnetmag.com/MicrosoftExchangeOutlook/Article/ArticleID/25649/MicrosoftExchangeOutlook_25649.html
http://support.microsoft.com/default.aspx?scid=kb;EN-US;317014

And a very useful PAQ here which you need to read carefully:
http:Q_20723964.html

Consider your options first - have you got a good back-up as you may need it. If you are at all unsure consider calling microsoft as I haven't needed to check the databases/stores in this way myself - I can point you to the correct resources but I can't speak through experience yet on having done this.

Deb :))




0
 

Author Comment

by:emrahtufan
ID: 10759521
Hi again
By the way our exchange server runs on a microsoft active/passive cluster
is that changes anything?
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 20

Expert Comment

by:Debsyl99
ID: 10760010
Hi - Sorry but Clustering is not my field. I would definitely take the advice given in the first link, Make a copy of the databases and transaction logs before attempting any recovery!
http://www.winnetmag.com/Articles/ArticleID/20016/pg/2/2.html
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q266/6/89.asp&NoWebContent=1

If you can I'd wait for another expert to take a look at this if you're not sure or don't have recourse to a good back-up, sorry but I don't want to comment on stuff I'm not 100% certain about ;-)

Deb :))
0
 

Author Comment

by:emrahtufan
ID: 10763434
Hello
In default configuration Norton Antivirus exclude the exchange server directory in Program files under (generally) C. But in my case the database folder of the mailboxes (MDBDATA) is under E just because of the cluster. (Our cluster implementation includes the SAN). Therefore we ignore or forget excluding the exchange folder in SAN.  Afterthat, the exchange folder in disk E is infected by the netskyQ and norton quarantines the log files which is currently written by the exchange server. Because of this, the mailbox store becomes unmounted and database of the exchange becomes inconsistent. (actually dirty shutdown).

After I defined the problem What I performed is that;
1. from the service in the control panel I disabled all the services related with the exchange for both servers in the cluster.
2. the e00.log file is under quarantine so there is no e00.log file in the MDBDATA.
3. I excluded the exchange folder in disk E.
4. I restarted the both servers.
5. Because exchange services are disabled the excahnge services in the cluster administartor are failed to start.
6. I enabled the exchange services.
7. From the cluster administartor, I brought the exchange group online.

After I Performed all the thisngs above, the new e00.log file is created and database store of the exchange is mounted.

The next thing I want to ask is ,can these procedure be a solution for this problem.
This seems to be very illogical. Everything happens out of my control which makes me very uncomfortable.

Thanks

0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 10764342
Hi there,

Yes this will act as a solution for this problem as fortunately things have gone exactly the way that they should with the E00.log being recreated -  but it would be better to exclude the E00.log in E from scanning anyway as a matter of course - you can scan everything else - just exclude the specific log files and databases listed from scanning or monitoring by the av - Do you have anitivirus scanning the mailboxes etc - ie antivirus for exchange? Some av systems detect what they assume is a virus signature in the E00.log and then quarantine it, but actually it's safe to restore the quarantined log to it's original position, hence it's better to just exclude it. You can set the av to exclude these files from monitoring and scanning as a matter of course by using the exclude specific files and folders options in the av configuration. I have done this, and we haven't had any problems with it.

Anyway, I'm glad it's back up and running but probably not as glad as you are ;-)

Deb :))
0
 

Author Comment

by:emrahtufan
ID: 10765286
H&#305; Deb,
Although it did not solve my problem, your comments gained me a better understanding of exchange server database.
Therefore I am glad to accept your answer as accepted one.
Many many thanks
0
 

Expert Comment

by:CausticFate
ID: 10992224
The same exact thing happened to my server today.  First thing tomorrow morning i will try your solution.
Thanks,
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
"Migrate" an SMTP relay receive connector to a new server using info from an old server.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now