Knowledge Base

The Exchange database store may not mount in Exchange Server 2003 or in Exchange 2000 Server, and event IDs 9175, 486, 455, 413, and 5 may be logged

Article ID: 896143

Article Last Modified on 12/3/2007

APPLIES TO

Microsoft Exchange Server 2003 Enterprise Edition
Microsoft Exchange Server 2003 Standard Edition
Microsoft Exchange 2000 Enterprise Server
Microsoft Exchange 2000 Server Standard Edition
Microsoft Windows Small Business Server 2003 Premium Edition
Microsoft Windows Small Business Server 2003 Standard Edition

This article is a consolidation of the following previously available articles: 294367, 810332, 819553, 895856, and 284205

SYMPTOMS

When you try to mount a database on a server that is running Microsoft Exchange 2000 Server or on a server that is running Microsoft Exchange Server 2003, you may receive the following error message:

An internal processing error has occurred. Try restarting the Exchange System Manager or the Microsoft Exchange Information Store service, or both.
ID no: c1041724
Exchange System Manager

Additionally, the following events may be logged in the Application log: Event Type: Error
Event Source: MSExchangeSA
Event Category: (14)
Event ID: 9175
Description: The MAPI call 'OpenMsgStore' failed with the following error: The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0526-00000000

Event Type: Error
Event Source: ESE
Event Category: General
Event ID: 486
Description: Information Store (3932) First Storage Group: An attempt to move the file "E:\Program Files\Exchsrvr\mdbdata\E00.log" to "E:\Program Files\Exchsrvr\mdbdata\E000080A.log" failed with system error 2 (0x00000002): "The system cannot find the file specified." The move file operation will fail with error -1811 (0xfffff8ed).

Event Type: Error
Event Source: ESE Event
Category: Logging/Recovery
Event ID: 455
Description: eseutil (4724) Error -1811 (0xfffff8ed) occurred while opening logfile drive_letter:\Program Files\Exchsrvr\MDBDATA\E00.log.

Event Type: Error
Event Source: ESE Event
Category: Logging/Recovery
Event ID: 455
Description: eseutil (2352) Error -1811 occurred while opening logfile drive_letter:\Program Files\Exchsrvr\MDBDATA\E000080A.log.

Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9518
Description: Error Current log file missing starting Storage Group /DC=COM/DC=COMPANY/CN=CONFIGURATION/CN=SERVICES/CN=MICROSOFT EXCHANGE/CN=MICROSOFT/CN=ADMINISTRATIVE GROUPS/CN=FIRST ADMINISTRATIVE GROUP/CN=SERVERS/CN=SERVER1/CN=INFORMATIONSTORE/CN=FIRST STORAGE GROUP on the Microsoft Exchange Information Store.

Event Type: Error
Event Source: ESE
Event Category: Logging/Recovery
Event ID: 413
Description: Information Store (3932) First Storage Group: Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1811.

Event Type: Error
Event Source: Antivirus_Program_Name
Event Category: None
Event ID: 5
Description: The description for Event ID ( 5 ) in Source ( Antivirus_Program_Name ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Virus Found! Virus name: W32.Netsky.P@mm in File: E:\Program Files\Exchsrvr\mdbdata\E00.log by: Realtime Protection scan. Action: Quarantine succeeded : Access denied.

Event Type: Error
Event Source: Antivirus_Program_Name
Event Category: None
Event ID: 5
Description: The description for Event ID ( 5 ) in Source ( Antivirus_Program_Name ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Virus Found! Virus name: W32.Netsky.P@mm!enc in File: E:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_216f566e01c43c76000002af.EML by: Realtime Protection scan. Action: Clean failed : Quarantine failed : Access denied.

CAUSE

Cause 1
Error 1811 corresponds to JET_errFileNotFound. This issue may occur in an Exchange log file that has a mismatching signature and LGeneration. Typically, the Exchange log file is the E00.log file. If the E00.log file has a mismatching signature, the information store might not mount even if the database is consistent. To resolve this issue, see the "Resolution 1" section.
Cause 2
This issue may occur if an antivirus program quarantines or deletes the current Exchange log file. To resolve this issue, see the "Resolution 2" section.
Cause 3
This issue may occur if the eseutil /p command was run on the affected databases and if the log files were not removed. To resolve this issue, see the "Resolution 3" section.
Cause 4
This issue may occur if you run the following command with an incorrect logfile base name, as in the following example:

eseutil /r three-character logfile base name

To resolve this issue, see the "Resolution 4" section.

RESOLUTION

Resolution 1

Contact Microsoft Product Support Services (PSS). For information about how to contact Microsoft PSS, visit the following Microsoft Web site:

http://support.microsoft.com

Resolution 2

Examine the configuration of the antivirus program.
1. Make sure that the antivirus program is not configured to scan the Exchange Server directories.
2. By default, some antivirus programs are set to scan drives and directories weekly in a manual mode or in an automatic mode. This setting may be easily overlooked. Make sure that you add the Exchange Server directories to the excluded locations for the antivirus program. For more information about how to configure antivirus programs to work together with Exchange, click the following article number to view the article in the Microsoft Knowledge Base:
  
  823166 Overview of Exchange Server 2003 and antivirus software
Review the log files of the antivirus program to verify whether the Exchange log file was quarantined or deleted.
Use one of the following methods to recover the Exchange log file.

Method 1: If the Exchange log file was quarantined

If the Exchange log file was quarantined, follow these steps:
1. Recover the Exchange log to the folder that contains your production log files.
2. Start the Microsoft Exchange Information Store service. If no other log files are missing, the database mounts. If other log files are missing, see if the missing log files are located in the quarantine folder of the antivirus program. If the log files are not located in the quarantine folder, follow the steps that are described in the "Method 2: If the Exchange log file was deleted" section.
Method 2: If the Exchange log file was deleted

If the Exchange log file was deleted, you must restore the Storage Group database from a backup. Then, you must play through the log files. If you cannot restore the database from a backup, see the "Method 3: If you cannot restore the database from a backup" section. To restore an available database, follow these steps:
1. Move all inconsistent databases to a backup folder.
2. If a new E00.log file was created, move the new E00.log file to the backup folder. Additionally, move the E00.chk file to the backup folder.
3. Copy all existing log files to the backup folder.
  
  Note You must copy the log files. Do not move the log files.
4. Rename the last E00*.log file to E00.log.
5. Restore the database from a backup. Then, replay the log files. This brings the database to a consistent state. However, the database does not include the E00.log file that was copied to the backup folder. Although there is some data loss, you now have a database that can be mounted.
6. Start the Microsoft Exchange Information Store service.
Method 3: If you cannot restore the database from a backup

If you cannot restore the database from a backup, you must run repair utilities against the database to bring the database to a consistent state. Then, follow the steps that are described in the "Method 2: If the Exchange log file was deleted" section.

Resolution 3

To determine whether the eseutil /p command was run, follow these steps:

Click Start, click Run, type cmd, and then click OK.
Type the following at the command prompt:

c:\program files\exchsrvr\bin\eseutil /mh "c:\program files\exchsrvr\mdbdata\name of Exchange database.edb"

Note This example assumes the following:
- The Exchange Server program files were installed in the c:\program files\exchsrvr folder.
- Your database is in the c:\program files\exchsrvr\mdbdata folder.
Read the repair count attribute. If the repair count attribute is 0 (zero), the eseutil /p command was not run. If the repair count attribute is a number other than 0, the eseutil /p command was run on the database.

If the public and private databases are in a consistent or clean shutdown state, you can move the transaction log files to another folder. To determine whether the databases are in a consistent or clean shutdown state, follow these steps:

Click Start, click Run, type cmd, and then click OK.
To examine the private information store, type the following:

c:\program files\exchsrvr\bin>eseutil /mh "drive:\program files\exchsrvr\mdbdata\priv1.edb"
To examine the public information store, type the following:

c:\program files\exchsrvr\bin>eseutil /mh "drive:\program files\exchsrvr\mdbdata\pub1.edb"

Note These examples assume the following:
- The Exchange Server program files were installed in the c:\program files\exchsrvr folder.
- Your database is in the c:\program files\exchsrvr\mdbdata folder.
Review the results of the consistency check. If a database is consistent (state = clean shutdown), all the log files have been committed to the information store. If the database is not consistent (state = dirty shutdown), the database may not be corrupted. The log files may not have been committed to the database yet.
If the state reports clean shutdown, move all the log files from all the mdbdata directories to a backup folder.
Mount the databases.

Resolution 4

Use the correct switch to successfully run the command. The common logfile base names are e00, e01, e02 and e03. For example, the following command contains a correct logfile base name:

eseutil /r e00

Note If none of these resolutions work, contact Microsoft Product Support Services (PSS). For information about how to contact Microsoft PSS, visit the following Microsoft Web site:

http://support.microsoft.com

REFERENCES

For more information about data recovery in Exchange Server 2003 and in Exchange 2000 Server, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/library/f9a66c19-b1e0-46c4-a6a1-276a569a08bf.aspx

For information about how to contact antivirus software vendors, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and software vendor contact information, A-K

60781 Hardware and software vendor contact information, L-P

60782 Hardware and software vendor contact information, Q-Z

For more information about the Eseutil command, click the following article numbers to view the articles in the Microsoft Knowledge Base:

170091 Location of the Eseutil utility

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

245822 Recommendations for troubleshooting an Exchange Server computer with antivirus software installed

244525 How to run Eseutil on a computer without Exchange Server

317014 Exchange 2000 Server Eseutil command-line switches

261947 How to determine if hard repair (Eseutil /p) has been run on a database

255224 You receive a "Usage Error: Invalid argument" if the storage group folder name in the path contains spaces when you run Eseutil in Exchange 2000 Server

Additional query words: XADM Norton Antivirus Corporate Edition anti-virus database store not mount

Keywords: kbtshoot kbprb KB896143

Microsoft KB Archive/896143

Contents