errors in event log

errors in event log (Full Version)

All Forums >> [Microsoft Exchange 5.5] >> General

Message

cougar694u -> errors in event log (7.Oct.2005 12:57:03 PM)
I took over from the previous network admin and was kinda thrown into fixing stuff he's done. Our exchange server has two drives (120 gb SATA) with a 20gb system partion on 1 disk, another 20 gb storage partition on the 2nd drive, then the remaining 90 GB on each makes one 91.7 GB mirrored drive. All exchange databases are on this mirror (drive letter E:). Everything was working fine until a few weeks ago when I started to get these errors (along with a bunch of 116's): Event Type: Error Event Source: ESE97 Event Category: Database Page Cache Event ID: 200 Date: 10/7/2005 Time: 2:11:50 AM User: N/A Computer: KDC01E Description: MSExchangeIS (1160) A read of the database file E:\exchsrvr\MDBDATA\PRIV.EDB between offsets 0xFFFFFFFF90F3F000 and 0xFFFFFFFF90F3FFFF failed after 16 failed read attempts with error -1018. There is a software or hardware problem affecting the database drive that must be corrected to preserve database integrity. Contact Microsoft Product Support Services. For more information, search the Microsoft Knowledge Base at http: Event ID number. Event Type: Error Event Source: ESE97 Event Category: Database Page Cache Event ID: 200 Date: 10/5/2005 Time: 2:53:35 AM User: N/A Computer: KDC01E Description: MSExchangeIS (2416) A read of the database file E:\exchsrvr\MDBDATA\PRIV.EDB between offsets 0xFFFFFFFFC9012000 and 0xFFFFFFFFC9012FFF failed after 16 failed read attempts with error -1018. There is a software or hardware problem affecting the database drive that must be corrected to preserve database integrity. Contact Microsoft Product Support Services. For more information, search the Microsoft Knowledge Base at http: Event ID number. Event Type: Error Event Source: ESE97 Event Category: Database Page Cache Event ID: 200 Date: 10/6/2005 Time: 2:42:40 AM User: N/A Computer: KDC01E Description: MSExchangeIS (1540) A read of the database file E:\exchsrvr\MDBDATA\PRIV.EDB between offsets 0x000000015E7FA000 and 0x000000015E7FAFFF failed after 16 failed read attempts with error -1018. There is a software or hardware problem affecting the database drive that must be corrected to preserve database integrity. Contact Microsoft Product Support Services. For more information, search the Microsoft Knowledge Base at http: Event ID number. Event Type: Error Event Source: ESE97 Event Category: Database Page Cache Event ID: 200 Date: 9/25/2005 Time: 2:10:08 AM User: N/A Computer: KDC01E Description: MSExchangeIS (1624) A read of the database file E:\exchsrvr\MDBDATA\PRIV.EDB between offsets 0xFFFFFFFF851B1000 and 0xFFFFFFFF851B1FFF failed after 16 failed read attempts with error -1018. There is a software or hardware problem affecting the database drive that must be corrected to preserve database integrity. Contact Microsoft Product Support Services. For more information, search the Microsoft Knowledge Base at http: Event ID number. Event Type: Error Event Source: ESE97 Event Category: Database Page Cache Event ID: 201 Date: 10/7/2005 Time: 2:03:27 AM User: N/A Computer: KDC01E Description: MSExchangeIS (1160) A read of the database file E:\exchsrvr\MDBDATA\PRIV.EDB between offsets 0xFFFFFFFF83292000 and 0xFFFFFFFF83292FFF succeeded after 2 failed read attempts. The error seen during the failed attempts was -1018. There is a transient software or hardware problem affecting the database drive that must be corrected to preserve database integrity. Contact Microsoft Product Support Services. For more information, search the Microsoft Knowledge Base at http: Event ID number. The backups wouldn't run, but after a reboot, I was able to get a full backup. I read some stuff on MS's website, but am not really familiar with the utility it said to use (eseutil). Does anyone have any info or pointers for this issue?

Exchange_Admin -> RE: errors in event log (7.Oct.2005 4:42:05 PM)
"...16 failed read attempts with error -1018..." This is usually indicative of hardware issues. 99.9% of the time this is the issue. Make sure that your disks and controller cards are good. Make sure that Write Back Caching is disabled on your drives. What has happened is that Exchange wrote a page of data into the database. Prior to writing the page in the database, exchange calculates the checksum of the page and includes this when the page is written. Then when the page is later accessed, Exchange reads the page, recalculates the checksum and compares this to the checksum that was written in the initial write of the page. What you are seeing is that these checksums do not match. So this takes me back to what I said earlier. Check the physical components involved in reading/writing data. You can run ESEUTIL /P /ISPRIV to try to repair this data, but if the hardware issue has not been resolved it will just come back again. You should also run ISINTEG -FIX -PRI -TEST ALLTESTS after the ESEUTIL /P.

zbnet -> RE: errors in event log (10.Oct.2005 4:25:39 AM)
Production Exchange servers should have more than 2 drives - at the very least you should be looking to separate your databases from your logs.

cougar694u -> RE: errors in event log (10.Oct.2005 9:53:35 AM)
quote: ORIGINAL: Exchange_Admin You can run ESEUTIL /P /ISPRIV to try to repair this data, but if the hardware issue has not been resolved it will just come back again. You should also run ISINTEG -FIX -PRI -TEST ALLTESTS after the ESEUTIL /P. I purchased 3 new drives and will be installing them in the system. If I run the utilities with the switches listed, will it correct the current problem so I can transfer the edb to the new drives and no longer have these errors? Also, what risks are involved in running these utilities? I will do a full backup before hand, but I want to know I'm getting myself into. In the event they return, I build a new machine. Thanks for your help. quote: ORIGINAL: zbnet Production Exchange servers should have more than 2 drives - at the very least you should be looking to separate your databases from your logs. I wasn't the one who set it up, just trying to fix things.

Exchange_Admin -> RE: errors in event log (10.Oct.2005 10:33:03 AM)
"risks involved" Well there are some risks involved running ESEUTIL /P. You may lose data. How much is hard to say. In my past experience I have seen it range from nothing that was noticed to 13 GB (best to worst case). ESEUTIL /P reads each 4 KB page of the database. If there are errors, then ESEUTIL will try to correct them. If it cannot correct them then the database page is deleted. The ISINTEG -FIX corrects the links between the tables. "If I run the utilities with the switches listed, will it correct the current problem so I can transfer the edb to the new drives and no longer have these errors?" This may work, but what will happen if after the repair, while you are transferring the files, the problem comes back? I would stop the information store service and make an offline backup of the PRIV.EDB and PUB.EDB. Put your new drives in and move the databases to the new drives. Then run your utilities.

cougar694u -> RE: errors in event log (10.Oct.2005 11:02:12 AM)
Thanks for the info!

cougar694u -> RE: errors in event log (11.Oct.2005 9:26:56 PM)
One more question, how will exchange act being installed on a new system, but using the same databases from the previous system. I'm asking because when I install the new drives, I'm going to re-install Windows, starting with a fresh install of exchange as well. Since all it's directory info is stored in the databases, will everything work, or will I need to re-create & configure everything all over again? The OS is currently installed on one of the drives I will be removing, so I also thought about copying that partition to the new drive so there's nothing lost. Your thoughts?

zbnet -> RE: errors in event log (12.Oct.2005 6:22:55 AM)
You can restore dbs from another server fine (it's known as a hardware DR), but the new server needs to have the same name as the old (Exchange DIR demands it), same Exchange version and SP level, same hotfixes, same Org name and same Site name. http://www.microsoft.com/technet/prodtechnol/exchange/55/support/exdisrec.mspx will help - it's long, but you should know all this stuff, so get reading.

cougar694u -> RE: errors in event log (12.Oct.2005 10:02:37 AM)
Thanks, I had this bookmarked and started reading it a week or two ago.

cougar694u -> RE: errors in event log (7.Nov.2005 9:41:43 PM)
Sorry to bring this old thing back, but I had 1 more question. The new system is up and everything's working well. Apparently, the EDB inherited 1 address where the checksums do not match. With the old hard disks, it showed a handfull of random addresses, but it's only shown 1 address recently, and I have not ran the above listed utilities on it. I found who owns the data, as a user complained that when doing a find in their mailbox, it hung. I looked at the logs and saw where it tried to access that specific address and couldn't. Now, if I run those above listed utilities, 'ESEUTIL /P /ISPRIV' and 'ISINTEG -FIX -PRI -TEST ALLTESTS', roughly how long will it take to complete on a 13 GB database? The machine's not extremely fast, Athlon XP 2200+, 1 GB RAM, & SATA drives. I want to prepare for the amount of time it will take, but I've never done it before. I'm guessing 2 hours or so?

zbnet -> RE: errors in event log (8.Nov.2005 9:50:43 AM)
It really is difficult to predict what speed the utils will run at. A very general rule of thumb used to be 3 to 4 GB per hour, although more modern servers will have more/faster processors, so may be quicker. It's database pages, not addresses, that suffer corruption in a mail database. You can't really predict who the corruption affects - indeed it could affect more than one user if the corrupt item is referred to by more than one mailbox. ESEUTIL with the P option will, as has already been pointed out, potentially throw data away. Be warned.

Page: [1]