Jaclynn
Mon Apr 12 12:40:32 CDT 2004
Do you use NT Backup or a third party?
First clean out all of the Exchange directories. The easiest way is to
rename the originals and then create blank directories with the same name in
the same place. For Example: say your log files are in
G:\Exchsrvr\Mdbdata. Rename that to G:\Exchsrvr\Mdbdata.old and then create
a new mdbdata folder so that you ahve G:\Exchsrvr\mdbdata. Also rename the
log file directories.
Since you do have log files since last Friday you should be able to play
those transactions in.
Here is an article with the steps:
821511 How to Replay Log Files That Have Been Generated Since the Last Full
http://support.microsoft.com/?id=821511
--
Hope that helps.
-------------------------
Jaclynn Hiranaka
Enterprise Messaging Support
This posting is provided "AS IS" with no warranties, and confers no rights.
© 2003 Microsoft Corporation. All rights reserved.
"Matthew" <thetwamNOSPAM@yahooNOSPAM.com> wrote in message
news:OGXHyPLIEHA.940@tk2msftngp13.phx.gbl...
> Yes, I have a full successful backup from Friday night.
>
> I have never restored Exchange from backup before. Any hints?
>
> Thank you!
>
> "Jaclynn Hiranaka [MSFT]" <jaclynnh@online.microsoft.com> wrote in message
> news:O4l1TMLIEHA.3444@TK2MSFTNGP10.phx.gbl...
> > Do you have a backup? You mention in a previous post that you would
like
> to
> > do an online backup. You will not be able to do an online backup if you
> are
> > not able to get your stores online.
> >
> > You should at this point restore from backup.
> >
> > If you do not have a backup you may have to run a hard repair.
> >
> > --
> > Hope that helps.
> >
> > -------------------------
> > Jaclynn Hiranaka
> > Enterprise Messaging Support
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > © 2003 Microsoft Corporation. All rights reserved.
> >
> >
> > "Matthew" <thetwamNOSPAM@yahooNOSPAM.com> wrote in message
> > news:%23L4GM$KIEHA.3248@TK2MSFTNGP12.phx.gbl...
> > > Hi, thanks for your help thus far.
> > >
> > > The registry key was already set to 0.
> > >
> > > Seems that the AV deleted the E00.log file, I cannot find it.
> > >
> > > Running Exchange service pack 3, on Small Business Server 2000. Drive
> is
> > > not read-only. Server's been running fine for almost three years.
> > >
> > > Originally I was sure that all Exchange srvr directories were excluded
> > from
> > > all scans. Then about a year ago I got more hard drive space, and
moved
> > the
> > > MDBDATA store directory to a new partition, and forgot to exclude that
> > > partition from the scans.
> > >
> > > Any other ideas what I can try?
> > >
> > > Many thanks!
> > >
> > > Matthew
> > >
> > >
> > > "Jaclynn Hiranaka [MSFT]" <jaclynnh@online.microsoft.com> wrote in
> message
> > > news:uHIlRbKIEHA.2064@TK2MSFTNGP10.phx.gbl...
> > > > First ensure that you AV has all of the Exchange server directories
> > > excluded
> > > > from all scans including the M: drive. Also ensure that your
metabase
> > > > directory is excluded.
> > > >
> > > > Now you said you disabled your AV services. Did you also ensure
that
> it
> > > is
> > > > disabled according to the registry? This is for the Exchange aware
> > > snap-in
> > > > for the AV not for the file level.
> > > >
> > > > Go into the registry
> > > > HKLM->System->CurrentControlSet->Services->MSExchangeIS->VirusScan
> There
> > > > should be a key under there that says enabled. Ensure that it is
set
> to
> > > 0.
> > > > This is just to be sure that the Exchange aware portion is disabled.
> > You
> > > > can reenable this when you finish troubleshooting.
> > > >
> > > > What does your AV do with files it finds virus for? Does it move
them
> to
> > a
> > > > separate folder? It looks from the Event ID 486 that your E00.log
> file
> > > > cannot be found. Where did it go? Did your AV move it to a
different
> > > > directory? Did it delete it? If it moved it, move it back to your
> > > > transaction log directory ( looks like it is on the G: drive).
> > > >
> > > > It doesn't sound like this is a problem with the services themselves
> but
> > > > with being able to mount your stores.
> > > >
> > > > What Service pack are you running for Exchange? What version of
> > store.exe
> > > > are you running?
> > > >
> > > > From the Event ID 413 ensure that you log drive is not read only.
> > > >
> > > > --
> > > > Hope that helps.
> > > >
> > > > -------------------------
> > > > Jaclynn Hiranaka
> > > > Enterprise Messaging Support
> > > >
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > > © 2003 Microsoft Corporation. All rights reserved.
> > > >
> > > >
> > > > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > > > news:O0l9VEKIEHA.3276@TK2MSFTNGP09.phx.gbl...
> > > > > Hello,
> > > > >
> > > > > We cannot access Exchange. Relevant error log entries pasted
> below.
> > > > >
> > > > > I've tried the following:
> > > > >
> > > > > 1. Disabled Symantec AV real time protection.
> > > > > 2. Stopped and restarted all Exchange services.
> > > > > 3. Rebooted the server.
> > > > > 4. Still not working, I tried to stop all Exchange services again,
> > they
> > > > > would not stop.
> > > > > 5. Disabled Symantec Mail Security scanning, virus & filter
> policies.
> > > > >
> > > > > Small Business Server 2000, Exchange Service Pack 3 (i think..)
> > > > >
> > > > > The following are from Application log:
> > > > >
> > > > > Source: ESE
> > > > > Event ID: 486
> > > > > 2:31 AM
> > > > > Information Store (4340) An attempt to move the file
> > > > > "G:\Exchsrvr\MDBDATA\E00.log" to
"G:\Exchsrvr\MDBDATA\E0003BAB.log"
> > > failed
> > > > > with system error 2 (0x00000002): "The system cannot find the file
> > > > > specified. ". The move file operation will fail with error -1811
> > > > > (0xfffff8ed).
> > > > >
> > > > > immediately after that...
> > > > > Source: Norton AntiVirus
> > > > > 2:31 AM
> > > > > Virus Found!Virus name: W32.Netsky.Q@mm.enc in File:
> > > > > G:\Exchsrvr\MDBDATA\E00.log by: Realtime Protection scan. Action:
> > Clean
> > > > > failed : Delete succeeded : Access denied
> > > > >
> > > > >
> > > > > Source: ESE
> > > > > Event ID: 413
> > > > > Information Store (4340) Unable to create a new logfile because
the
> > > > database
> > > > > cannot write to the log drive. The drive may be read-only, out of
> disk
> > > > > space, misconfigured, or corrupted. Error -1811.
> > > > >
> > > > >
> > > > > MSExchangeIS
> > > > > 9558
> > > > > An error occurred while writing to the database log file of
storage
> > > group
> > > > > "First Storage Group". Attempting to unmount all databases in this
> > > storage
> > > > > group.
> > > > >
> > > > > ESE
> > > > > 471
> > > > > Information Store (4340) Unable to rollback operation #9608785 on
> > > database
> > > > > G:\Exchsrvr\MDBDATA\priv1.edb. Error: -510. All future database
> > updates
> > > > will
> > > > > be rejected.
> > > > >
> > > > > ESE
> > > > > 492
> > > > > Information Store (4340) The logfile sequence in
> > "G:\Exchsrvr\MDBDATA\"
> > > > has
> > > > > been halted due to a fatal error. No further updates are possible
> for
> > > the
> > > > > databases that use this logfile sequence. Please correct the
> problem
> > > and
> > > > > restart or restore from backup.
> > > > >
> > > > > A whole slew of the following:
> > > > > MSExchangeIS Mailbox
> > > > > 1115
> > > > > Error 0xfffffbbe returned from closing database table, called from
> > > > function
> > > > > JTAB_BASE::EcCloseTable on table Msg.
> > > > >
> > > > > MSExchangeSA
> > > > > 1005
> > > > > Unexpected error <<0xc1050000 - Unknown Error. The logon to the
> > > Microsoft
> > > > > Exchange Server computer failed. Microsoft Exchange Server
> Information
> > > > Store
> > > > > ID no: 80040111-03ee-80040111>> occurred.
> > > > >
> > > > > 9175
> > > > > The MAPI call 'OpenMsgStore' failed with the following error:
> > > > > The attempt to log on to the Microsoft Exchange Server computer
has
> > > > failed.
> > > > > The MAPI provider failed.
> > > > > Microsoft Exchange Server Information Store
> > > > > ID no: 8004011d-0512-00000000
> > > > >
> > > > > MSExchangeFBPublish
> > > > > 8273
> > > > > Deletion of duplicate free/busy messages for virtual machine SAI
is
> > > > > starting.
> > > > >
> > > > > 8275
> > > > > SchedulePlusFreeBusy folder could not be opened for duplicate
> message
> > > > > deletion on virtual machine SAI. The error number is 0x80040115.
> > > > >
> > > > > 8206
> > > > > Unable to prepare message table for polling thread processing on
> > virtual
> > > > > machine SAI. The error number is 0x80040111. Make sure Microsoft
> > > Exchange
> > > > > Store is running.
> > > > >
> > > > >
> > > > > We are nonprofit and a call to PSS would hurt, please help!
> > > > >
> > > > > Thanks
> > > > >
> > > > > Matthew
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>