Microsoft KB Archive/896143

= The Exchange database store may not mount in Exchange Server 2003 or in Exchange 2000 Server, and event IDs 9175, 486, 455, 413, and 5 may be logged =

Article ID: 896143

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Exchange Server 2003 Enterprise Edition
 * Microsoft Exchange Server 2003 Standard Edition
 * Microsoft Exchange 2000 Enterprise Server
 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition

-



This article is a consolidation of the following previously available articles: 294367, 810332, 819553, 895856, and 284205



SYMPTOMS
When you try to mount a database on a server that is running Microsoft Exchange 2000 Server or on a server that is running Microsoft Exchange Server 2003, you may receive the following error message:

An internal processing error has occurred. Try restarting the Exchange System Manager or the Microsoft Exchange Information Store service, or both.

ID no: c1041724

Exchange System Manager

Additionally, the following events may be logged in the Application log: Event Type: Error

Event Source: MSExchangeSA

Event Category: (14)

Event ID: 9175

Description: The MAPI call 'OpenMsgStore' failed with the following error: The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0526-00000000

Event Type: Error

Event Source: ESE

Event Category: General

Event ID: 486

Description: Information Store (3932) First Storage Group: An attempt to move the file &quot;E:\Program Files\Exchsrvr\mdbdata\E00.log&quot; to &quot;E:\Program Files\Exchsrvr\mdbdata\E000080A.log&quot; failed with system error 2 (0x00000002): &quot;The system cannot find the file specified.&quot; The move file operation will fail with error -1811 (0xfffff8ed).

Event Type: Error

Event Source: ESE Event

Category: Logging/Recovery

Event ID: 455

Description: eseutil (4724) Error -1811 (0xfffff8ed) occurred while opening logfile \MDBDATA\E00.log.

Event Type: Error

Event Source: ESE Event

Category: Logging/Recovery

Event ID: 455

Description: eseutil (2352) Error -1811 occurred while opening logfile \MDBDATA\E000080A.log.

Event Type: Error

Event Source: MSExchangeIS

Event Category: General

Event ID: 9518

Description: Error Current log file missing starting Storage Group /DC=COM/DC=COMPANY/CN=CONFIGURATION/CN=SERVICES/CN=MICROSOFT EXCHANGE/CN=MICROSOFT/CN=ADMINISTRATIVE GROUPS/CN=FIRST ADMINISTRATIVE GROUP/CN=SERVERS/CN=SERVER1/CN=INFORMATIONSTORE/CN=FIRST STORAGE GROUP on the Microsoft Exchange Information Store.

Event Type: Error

Event Source: ESE

Event Category: Logging/Recovery

Event ID: 413

Description: Information Store (3932) First Storage Group: Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1811.

Event Type: Error

Event Source:

Event Category: None

Event ID: 5

Description: The description for Event ID ( 5 ) in Source cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Virus Found! Virus name: W32.Netsky.P@mm in File: E:\Program Files\Exchsrvr\mdbdata\E00.log by: Realtime Protection scan. Action: Quarantine succeeded : Access denied.

Event Type: Error

Event Source:

Event Category: None

Event ID: 5

Description: The description for Event ID ( 5 ) in Source cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Virus Found! Virus name: W32.Netsky.P@mm!enc in File: E:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_216f566e01c43c76000002af.EML by: Realtime Protection scan. Action: Clean failed : Quarantine failed : Access denied.



CAUSE
 Cause 1

Error 1811 corresponds to JET_errFileNotFound. This issue may occur in an Exchange log file that has a mismatching signature and LGeneration. Typically, the Exchange log file is the E00.log file. If the E00.log file has a mismatching signature, the information store might not mount even if the database is consistent. To resolve this issue, see the &quot;Resolution 1&quot; section. Cause 2

This issue may occur if an antivirus program quarantines or deletes the current Exchange log file. To resolve this issue, see the &quot;Resolution 2&quot; section. Cause 3

This issue may occur if the eseutil /p command was run on the affected databases and if the log files were not removed. To resolve this issue, see the &quot;Resolution 3&quot; section. Cause 4

This issue may occur if you run the following command with an incorrect logfile base name, as in the following example:

eseutil /r

To resolve this issue, see the &quot;Resolution 4&quot; section.



Resolution 1
Contact Microsoft Product Support Services (PSS). For information about how to contact Microsoft PSS, visit the following Microsoft Web site:

http://support.microsoft.com

Resolution 2
 Examine the configuration of the antivirus program. <ol style="list-style-type: lower-alpha;"> Make sure that the antivirus program is not configured to scan the Exchange Server directories.</li> By default, some antivirus programs are set to scan drives and directories weekly in a manual mode or in an automatic mode. This setting may be easily overlooked. Make sure that you add the Exchange Server directories to the excluded locations for the antivirus program. For more information about how to configure antivirus programs to work together with Exchange, click the following article number to view the article in the Microsoft Knowledge Base:

823166 Overview of Exchange Server 2003 and antivirus software

</li></ol> </li> Review the log files of the antivirus program to verify whether the Exchange log file was quarantined or deleted.</li>  Use one of the following methods to recover the Exchange log file.

Method 1: If the Exchange log file was quarantined
If the Exchange log file was quarantined, follow these steps: <ol style="list-style-type: lower-alpha;"> Recover the Exchange log to the folder that contains your production log files.</li> Start the Microsoft Exchange Information Store service. If no other log files are missing, the database mounts. If other log files are missing, see if the missing log files are located in the quarantine folder of the antivirus program. If the log files are not located in the quarantine folder, follow the steps that are described in the &quot;Method 2: If the Exchange log file was deleted&quot; section.</li></ol>

Method 2: If the Exchange log file was deleted
If the Exchange log file was deleted, you must restore the Storage Group database from a backup. Then, you must play through the log files. If you cannot restore the database from a backup, see the &quot;Method 3: If you cannot restore the database from a backup&quot; section. To restore an available database, follow these steps: <ol style="list-style-type: lower-alpha;"> Move all inconsistent databases to a backup folder.</li> If a new E00.log file was created, move the new E00.log file to the backup folder. Additionally, move the E00.chk file to the backup folder.</li> Copy all existing log files to the backup folder.

Note You must copy the log files. Do not move the log files.</li> Rename the last E00*.log file to E00.log.</li> Restore the database from a backup. Then, replay the log files. This brings the database to a consistent state. However, the database does not include the E00.log file that was copied to the backup folder. Although there is some data loss, you now have a database that can be mounted.</li> Start the Microsoft Exchange Information Store service.</li></ol>

Method 3: If you cannot restore the database from a backup
If you cannot restore the database from a backup, you must run repair utilities against the database to bring the database to a consistent state. Then, follow the steps that are described in the &quot;Method 2: If the Exchange log file was deleted&quot; section. </li></ol>

Resolution 3
To determine whether the eseutil /p command was run, follow these steps: <ol> Click Start, click Run, type cmd, and then click OK.</li> Type the following at the command prompt:

c:\program files\exchsrvr\bin\eseutil /mh &quot;c:\program files\exchsrvr\mdbdata\name of Exchange database.edb&quot;

Note This example assumes the following:  The Exchange Server program files were installed in the c:\program files\exchsrvr folder.</li> <li>Your database is in the c:\program files\exchsrvr\mdbdata folder.</li></ul> </li> <li>Read the repair count attribute. If the repair count attribute is 0 (zero), the eseutil /p command was not run. If the repair count attribute is a number other than 0, the eseutil /p command was run on the database.</li></ol>

If the public and private databases are in a consistent or clean shutdown state, you can move the transaction log files to another folder. To determine whether the databases are in a consistent or clean shutdown state, follow these steps: <ol> <li>Click Start, click Run, type cmd, and then click OK.</li> <li>To examine the private information store, type the following:

c:\program files\exchsrvr\bin>eseutil /mh &quot;drive:\program files\exchsrvr\mdbdata\priv1.edb&quot;

</li> <li>To examine the public information store, type the following:

c:\program files\exchsrvr\bin>eseutil /mh &quot;drive:\program files\exchsrvr\mdbdata\pub1.edb&quot;

Note These examples assume the following: <ul> <li>The Exchange Server program files were installed in the c:\program files\exchsrvr folder.</li> <li>Your database is in the c:\program files\exchsrvr\mdbdata folder.</li></ul> </li> <li>Review the results of the consistency check. If a database is consistent (state = clean shutdown), all the log files have been committed to the information store. If the database is not consistent (state = dirty shutdown), the database may not be corrupted. The log files may not have been committed to the database yet.</li> <li>If the state reports clean shutdown, move all the log files from all the mdbdata directories to a backup folder.</li> <li>Mount the databases.</li></ol>

Resolution 4
Use the correct switch to successfully run the command. The common logfile base names are e00, e01, e02 and e03. For example, the following command contains a correct logfile base name:

eseutil /r e00

Note If none of these resolutions work, contact Microsoft Product Support Services (PSS). For information about how to contact Microsoft PSS, visit the following Microsoft Web site:

http://support.microsoft.com

<div class="references_section">