Documente Academic
Documente Profesional
Documente Cultură
Guid
Microsoft Corporation
Abstract
When a database is corrupted or damaged, data can be restored from backup or repaired
using Eseutil. Eseutil is a command line utility that works with Extensible Storage Engine
(ESE), database (.edb) files, streaming (.stm) files, and log (.log) files associated with an
Information Store, in a given Storage Group.
Copyright................................................................................................................................ 67
5
Note:
Download Microsoft Exchange Server Database Utility Guide to print or read offline.
Eseutil Repair, mode can be used to repair a corrupt or damaged database while recovery
and restore modes can be used to replay transaction log files into a database. The file header
dump modes can be used to correlate database and transaction log files and to determine
other information about them. The checksum mode can be used to verify the file integrity of a
database. The copy file mode is useful for very rapid copying of large files. The
defragmentation mode can be used to compact a database offline, reducing the size of the
database files by removing empty space.
Topics in this guide give you an understanding of the Eseutil repair tool, tell you about
scenarios where you can use the tool, discuss the different modes giving instructions on how
to run Eseutil in those modes, and provide help with troubleshooting common Eseutil errors.
For more information about common Eseutil errors, see Reference for Common Eseutil
Errors.
6
Eseutil /D
Defragmentation Mode
Eseutil /K Checksum
Mode
ISInteg
The ISInteg utility is most often used after an Eseutil repair operation. It can also be used
when an event or error warrants it. Several Microsoft Knowledge Base articles recommend
the use of ISInteg for resolving specific issues.
9
ISInteg corrects database problems at the application level of the database. Eseutil corrects
database problems at the ESE level. ISInteg understands the database as a collection of
mailboxes and items in them, and can correlate and repair information and relationships
between mailboxes, folders, items and attachments.
ISInteg was originally created as a utility for internal use by testers in the Exchange
development group, and was released publicly because of its general usefulness. It can
perform multiple independent and interrelated tests of the database, and can fix
discrepancies found. ISInteg cannot comprehensively correct all possible problems in the
database, but it is often very successful. Over time, ISInteg has been incrementally improved
to make it more robust and useful.
For more information about common Eseutil errors, see Reference for Common Eseutil
Errors.
For more information about the ISInteg utility, see the Microsoft Knowledge Base article
182081 "Description of the Isinteg utility" (http://go.microsoft.com/fwlink/?
linkid=3052&kbid=182081).
For more information about repairing Exchange databases and disaster recovery, see the
Exchange Server 2003 Disaster Recovery Operations Guide (http://go.microsoft.com/fwlink/?
LinkId=47570).
For more information about understanding Extensible Storage Engine (ESE) file types, see
Extensible Storage Engine Files (http://go.microsoft.com/fwlink/?LinkId=68167).
Eseutil's /D switch can be used to defragment and compact a database. During typical
operations, database files never shrink below their current size. As space in the database is
freed by deletion of items, existing pages are reused where possible. Typically, a Microsoft®
Exchange Server database will grow for several months after it is put in service, but
eventually the database size stabilizes.
10
Under typical conditions, performing an offline defragmentation will not permanently recover
significant disk space. The file will usually grow again to its previous un-defragmented size.
Special circumstances, such as moving many mailboxes out of the database, may make it
worthwhile to defragment the database offline. By default, during typical operation, the
database is logically defragmented nightly. This does not reduce the size of the file on disk,
but does make the database perform efficiently.
Note:
You can use the Eseutil utility to defragment the information store and directory in
Microsoft Exchange Server 5.5 and to defragment the information store in Microsoft
Exchange 2000 and newer versions.
temporary database can be put on the same logical drive, and the final copy will complete
almost instantly.
We do not recommend that you use a network drive to hold the temporary database. When
you use a network drive for the temporary database, defragmentation will take longer, and
any transient or permanent network error will end the process. Because defragmentation
cannot be resumed, you would have to start over from the beginning.
Note:
You only need as much extra logical drive disk space as the final size of the files after
defragmentation. Although it is impossible to exactly predict how much disk space will
be reclaimed, you should leave a recommended 110% of free disk drive space to be
safe. For more information about how to determine the amount of disk space for
defragmentation, see the Microsoft Knowledge Base article 195914, "Determining
database free space with Exchange 5.5 Service Pack 1 and later versions of
Exchange" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=195914).
There is a significant amount of white space in the database that can be reclaimed and
which will not be reused. An example can be when the number of mailboxes in the
database has been significantly reduced.
An event is repeatedly logged in the Application log advising you to defragment the
database offline. This may occur rarely when typical online defragmentation is no longer
able to efficiently defragment the database.
When the 16 GB database size limit is reached on the Standard version of Exchange and
white space must be reclaimed in order to mount the database. If you are running
Exchange Server 2003, then Service Pack 2 (SP2) should be installed to raise the limit to
75 GB. For more information about increasing the database size limit, see Microsoft
Knowledge Base article 828070, "Exchange Server 2003 mailbox store does not mount
when the mailbox store database reaches the 16 GB limit"
(http://go.microsoft.com/fwlink/?linkid=3052&kbid=828070).
Note:
After defragmenting the database using Eseutil, we recommend that you perform a
full backup of the database. A full backup is needed because the database
defragmentation creates new database files which have new database signatures.
Log file replay after the restore depends on database signatures to match the
expected values recorded in transaction log files. Any database backups that are
taken before the defragmentation will contain database files that have signatures
12
different from the new defragmented database. If an older database is restored, the
new transaction logs which are bound to the new defragmented database files will
not replay.
Eseutil defrag should not be run as any kind of standard maintenance. Exchange runs an
automatic online defragmentation nightly that handles the day-to-day maintenance of
Exchange. There is no reason to periodically run an offline defragmentation unless
special circumstances apply.
Eseutil defrag cannot not be run when the database is not in a consistent state.
Note:
As a rule, unless you expect more than 20 percent of available space to be
recovered, defragmentation will likely not cause permanent shrinkage of the
database files.
1. Make sure you have free disk space equal to 110 percent of the end size of the database
that you want to process (the end size being the current file size minus the size of the
white space in the file).
Procedure
How to defragment an Exchange 2000 or Exchange 2003 database
1. In Exchange System Manager, right-click the database that you want to
defragment, and then click Dismount Store.
2. At the command prompt, change to the Exchsrvr\Bin folder, and then type the
Eseutil /d command, a database switch, and any options that you want to use. For
example, the following command (all on one command line) runs the standard
defragmentation utility on a mailbox database:
C:\program files\exchsrvr\bin> Eseutil /d
c:\progra~1\exchsrvr\mdbdata\priv1.edb
For the Exchange Directory database, stop the Microsoft Exchange Directory
service.
14
For the Exchange Mailbox or Public Folder databases, stop the Microsoft
Exchange Information Store service.
2. At the command prompt, change to the Winnt\System32 folder, and then type the
Eseutil /d command, a database switch, and any options that you want to use.
For example, the following command runs the standard defragmentation utility on the
directory and saves the copy in the user-defined file:
C:\winnt\system32> Eseutil /d /ds /tc:\dbback\tempdfrg.edb /p
Use one of the following database switches to run Eseutil on a specific database.
Option Description
----------------------------------------
/ds Directory
/ispriv Private information store
/ispub Public information store
Use one or more of the following options to specify the operations that you want to
perform on the database.
During repair, it may be necessary to discard rows from tables or even entire tables. After
completing the ESE-level repairs, it is necessary to perform an application-level repair to
correct problems that may now exist at the application level because of missing data. The
Information Store Integrity (ISInteg) utility can be used to perform this Exchange application-
level analysis and repair. The following example explains how Eseutil repair works.
For example, a table in the database stores messages for all mailboxes. A separate table is
used for each user's Inbox folder. Suppose that a message is lost when using Eseutil to
repair the message table. Eseutil will not correlate the message with the reference to it in
each Inbox folder, because Eseutil does not understand the cross-table schema of the
application. ISInteg is needed to compare the repaired message table with each Inbox folder,
and to remove a lost message from the Inbox.
In short, Eseutil looks at each Exchange database page and table and ensures consistency
and integrity within each table. ISInteg, recommended to be run after Eseutil, repairs a
database at the application level and ensures the integrity of the relationships between
tables.
2. Eseutil is run in /D mode to fully rebuild indexes and defragment the database
16
Note:
A successful repair does not necessarily mean that a database will always be
useable. The loss of system metadata may leave a database unmountable or empty.
When a database is not repairable, you can restore data from backup or create a
new database.
Both Eseutil and ISInteg generate detailed repair log files that list the errors found and
corrected. For more information about causes and consequences of specific errors, you can
search the Microsoft Knowledge Base and see the topic on Reference for Common Eseutil
Errors. Information from these areas can help you decide whether you wish to accept the
risks of leaving a repaired database in production.
Note:
If you cannot roll forward transaction log files, a hybrid strategy is best to follow. You
can restore a working version of the database from backup, repair the damaged
database in the recovery storage group, and merge the two databases.
Microsoft recommends that you follow these best practices when repairing a database:
Do not allow a repaired database to remain in production for an extended period of time.
Do not use Eseutil repair mode to expunge a -1018 error. For more information about
error -1018, see Microsoft Knowledge Base article 812531, "Support WebCast: Microsoft
Exchange: Understanding and Resolving Error -1018" (http://go.microsoft.com/fwlink/?
linkid=3052&kbid=812531).
17
There must be sufficient disk space on the local logical drive for the temporary repair
database. Keeping 20 percent of the size of the database files being repaired is
suggested, although the size of the temporary file will vary widely depending on the
nature of the repairs made. If sufficient space is unavailable, you may redirect temporary
files to a different drive, as described below.
The streaming database (.stm file) must be in the same folder as the Messaging
Application Programming Interface (MAPI) database (.edb file), or you must set a
command line switch to identify the path for the streaming database, as described below.
Procedure
To run Eseutil /P
The basic command line syntax for repairing a database with Eseutil is:
ESEUTIL /P database_filename.edb
Note:
With Exchange Server 5.5, you need to run /V to see the verbose logging
that is default with Exchange 2000 Server and later versions.
You may encounter these scenarios when running Eseutil repair against your database:
You can force repair to continue past this problem, but if the streaming file is one that does
not actually belong with the database, this will not salvage data from it. Instead, all data will
be deleted from the streaming file. Force a mismatch to be ignored only when you are very
confident that the streaming and database files belong together, and that they are close to
being in synch with each other.
19
The streaming database is composed entirely of raw user data. All logical structure and
ownership information about the data is in the MAPI database (.edb file). All data in the .stm
file that does not match the pointers in the .edb file will be lost during a repair.
Follow these steps for running Eseutil /P to ignore a streaming file mismatch:
Follow this step to run Eseutil /P when a database streaming file is missing or when repair is
unable to finish with the current streaming file:
Post-Repair Considerations
Remember the following points after you have run Eseutil /P to repair your database:
Perform a full backup of the database as soon as possible after a repair. Repair
invalidates previous backups. This does not mean that previous backups cannot be
restored or are completely worthless. It means that repair makes it impossible to
completely roll the database forward from a previous backup. If you restore a previous
backup, transaction log file replay will end at the point at which the repair was done. Any
changes to the database subsequent to the repair cannot be put back into a restored
database. Therefore it is critical that you perform a full backup of the database as soon as
possible after a repair.
Remember that you must run defrag (Esetuil /D) and ISInteg -fix to finish repair. Only if
you intend to use the repaired database for salvage and then discard it can you skip
20
these extra steps. Skipping them means that you may salvage less data than if you
completed them, but it can also mean saving several hours of recovery time.
Important:
You must perform a full backup of the database, run defrag, and run ISInteg before
placing a repaired database back in production. Microsoft IT's best practice is to
move a mailbox as soon as it is feasible rather than to leave a repaired database
indefinitely in production. For more information, see Eseutil /P Repair Mode.
The term "hard recovery" refers to the process that controls transaction log file replay into a
database that has been restored using the legacy online streaming backup application
programming interface (API). This process is different from transaction log replay that occurs
after a database crash or after restoring a database using the Volume Shadow Copy Service
(VSS) backup API.
Backup applications that implement the Exchange legacy streaming online backup API
provide a setting in the user interface to start hard recovery after the last backup set has been
restored. In Microsoft® Windows NT® NTBackup, it is called “Last Backup Set.”
If you fail to trigger hard recovery from the backup application, you must run hard recovery
manually from the command line with Eseutil before a restored database can be mounted.
Note:
If you run the Eseutil restore commands from where the Restore.env file exists, the
command syntax is very simple. Otherwise, you must add path information to the
switches. Therefore, it is strongly recommended that you run these commands from
the Restore.env location.
22
For more information, see the following topics in the Exchange Server Database Utility Guide:
For more information about this error, see Microsoft Knowledge Base article 266689, "The
"eseutil /cc" command does not work on cluster server."
23
Procedure
To run Eseutil /C
To view the Restore.env file use this basic command line syntax:
ESEUTIL /CM “d:\temp\First Storage Group”
Note:
If you run the command from the directory where Restore.env exists, it is not
necessary to specify any path information. If you specify path information, do
not append Restore.env to the end of the path.
To run hard recovery, execute the following command line syntax:
ESEUTIL /CC “d:\temp\First Storage Group”
Note:
If you run the command from the directory where Restore.env exists, it is not
necessary to specify any path information. If you specify path information, do
not append Restore.env to the end of the path.
For more information about running Eseutil /CC, see "How to Run Eseutil /cc"
(http://go.microsoft.com/fwlink/?LinkId=67228).
ESEUTIL /CC /T
Note:
Do not use any parameters with the /T switch. Use of the /T switch will cause
all transaction logs in the Restore.env location to be replayed, whether they
are listed in the Restore.env file or not. No logs in the running folder will be
replayed.
Note:
If you are unsure about the victimization status of a database, copy log files into both
the temporary and running folders. This will ensure that one log copy or the other will
be considered for replay.
24
If a database has NOT been victimized, transaction logs will be replayed as follows:
The sequence of log files listed in the Restore.env file will be replayed first.
If additional log files exist in the Restore.env location, they will not be replayed under any
circumstances.
If additional matching log files exist in the running storage group log folder and they are in
contiguous sequence with the files listed in Restore.env, they will be replayed.
If additional log files exist in the running storage group log folder and they do not match
or are not in contiguous sequence and circular logging has been disabled, then an error
will occur and hard recovery will fail. To resolve such errors, matching and contiguous log
files must be located, or you can use Eseutil /CC /T switches to ignore log files in the
running folder and to replay only log files listed in the Restore.env file.
If circular logging is currently enabled or was enabled at the time the backup was made,
then only log files listed in Restore.env will be replayed.
If no log files exist in the running storage group log folder, then recovery will complete
successfully using only the log file(s) listed in Restore.env.
If additional log files exist in the Restore.env location, and they match and are contiguous
with the logs listed in Restore.env, then they will also be replayed.
Additional log files in the running storage group log folder will not be replayed.
If a database has been restored to a Recovery Storage Group (RSG), transaction logs
will be replayed as follows:
Any other databases in the RSG must be dismounted before beginning any transaction
log file replay.
The sequence of log files listed in the Restore.env file will be replayed first.
If additional matching log files exist in the running log folder for the RSG, and they are in
contiguous sequence with the files listed in Restore.env, they will be replayed.
If additional log files exist in the Restore.env location, they will not be replayed under any
circumstances.
Important After hard recovery succeeds, all files in the temporary directory (where
Restore.env was created) are deleted. Never place your only copy of a log file in the
Restore.env temporary folder.
25
Hard recovery: A transaction log replay process that occurs after restoring a database
from an online backup.
Soft recovery: A transaction log replay process that occurs when a database is re-
mounted after an unexpected stop, or when transaction logs are replayed into an offline
file backup copy of a database.
For more information about hard and soft recoveries, see "Transaction Log File Replay: Soft
Recovery and Hard Recovery in Exchange Server 2003" (http://go.microsoft.com/fwlink/?
linkid=68147).
For more information about instructions for running Eseutil in recovery mode, see How to Run
Eseutil /R in Recovery Mode.
Hard Recovery
Hard recovery occurs when transaction log files must be replayed into a restored online
backup. In all other recovery scenarios, soft recovery is done. Hard recovery can be done
with Eseutil by using the Restore mode (/C).
Soft Recovery
In the default soft recovery scenario, an external event unexpectedly stops an Exchange
database, but the database and log files remain intact and in place. When the database is
mounted again, Exchange reads the checkpoint file and begins to replay the transaction log
that is listed as the checkpoint log. If no checkpoint file exists, replay begins with the oldest
log file available in the transaction log folder for the storage group.
Exchange writes completed transactions to the database files found in the log file that have
not already been written and reverses any incomplete transactions. Exchange never begins
writing a transaction into the database files until all the operations composing it have been
secured to the log files. You do not need to physically undo or back out a transaction in the
database if all uncommitted transaction logs present at the time of the unexpected stop are
present when replay begins.
Important:
A fundamental assumption of the soft recovery process is that no database or log
files have been moved, deleted, or destroyed by the failure—or by the administrator
after the failure.
27
Version Differences
Eseutil is always being improved, and added to from version to version. There are currently
three major versions of Eseutil /R for each of the 3 major exchange versions as follows:
In Exchange 5.5, there is almost never a good reason to perform soft recovery with
Eseutil. Each time the Information Store starts, soft recovery is run automatically, and
correctly. In Exchange 5.5, the Eseutil soft recovery function was intended mostly for test
environments where you might wish to recover a database on a server that did not have
Exchange installed.
There is a major risk in running Eseutil /R in Exchange 5.5: After restoring an online
backup, running soft recovery instead will usually corrupt the database. An online backup
needs hard recovery, not soft recovery.
Only if the following two conditions are both met is it safe to run soft recovery instead of
hard recovery in Exchange 5.5 and previous versions:
The database paths have not changed since the backup was done.
The .pat files from the online backup set are exactly 8 K in size (meaning, that they
are composed of only two header pages, and have no actual database pages in
them).
In all other circumstances, running soft recovery instead of hard recovery will corrupt the
database in proportion to the size of the .pat files.
Note:
If you divide the byte size of a .pat file by 4096, and subtract two, that is the
number of logically corrupt pages that will be in the database after improperly
running soft recovery.
There is another risk in running soft recovery with Eseutil. This risk still exists in Exchange
2000 or Exchange 2003: If you improperly specify paths to log files, to the checkpoint file or to
database files, recovery may alter the database or log files and prevent recovery from being
done again.
If existing transaction log files are not found by Eseutil when it tries to run recovery, it will
create a new transaction log file, and try to attach the database to it. If the database is
Inconsistent or in Dirty Shutdown state, the database will not be made startable. If the
database is in a Consistent state, it will be attached and then detached from the new log file.
In either case, you risk making changes to the database or adding log files to the server that
will result in the database becoming unstartable or that will confuse further recovery
troubleshooting.
Note:
Just because recovery with Eseutil reports success does not mean that the database
recovered is in a mountable state. Recovery succeeds whenever all available
transaction log data that is currently available has been applied to the database files.
Recovery success says nothing about whether the available data was sufficient to
restore the databases to consistency.
In Exchange 5.5, you were almost always better off placing files in appropriate locations and
then starting the Information Store to accomplish recovery. In Exchange 2003, there are two
improvements to the Eseutil recovery functionality that provide important advantages over
mounting a database to run recovery on it:
Eseutil can force recovery to complete even if there is a missing database. This capability
is also available in Exchange 2000.
If a storage group is unexpectedly stopped, all databases running at the time will be
Inconsistent in a Dirty Shutdown state. Suppose that the reason the storage group
stopped was that a database drive suddenly failed, and the drive is inaccessible. In this
case, you are missing one of the databases.
If you run recovery while the database is missing, it is possible that you will alter the state
of the transaction logs so that if the drive becomes accessible again, recovery will not
complete successfully with that one database.
Note:
If you restore the database from backup, recovery will be able to complete
successfully—this scenario only applies to recovering a database that was
attached to the current log at the time of the sudden stop.
If you know that the lost database will not be recovered, you can recover the rest of the
databases in the storage group without first restoring the missing database from backup
by using the Eseutil /I (ignore) switch.
29
Before using this switch to run recovery on the rest of the storage group, you should first
make a backup of all transaction log files, including the current log (Enn.log). By keeping a
copy of the current log and all the other logs, you will still be able to recover the missing
database if it unexpectedly becomes available. Once you recover the rest of the databases,
and thus write more information into Enn.log, you may not be able to recover the missing
database using that log file.
Hard recovery has always been able to finish successfully, even if Exchange databases have
been moved to different path locations since a backup was done. But until Exchange 2003,
soft recovery could only work if the database files were in the same drive path as that defined
in the transaction log files to be replayed.
In Exchange 2003, the /D switch was added to Recovery mode to allow override of the
database path hard coded in the transaction log files. This new capability is very useful when
restoring offline copies of databases to Recovery Storage Groups, or when recovering a
“missing” database as described in the scenario above.
You can now copy a database and a group of transaction logs into any folder you desire, and
successfully run soft recovery. Once the database is consistent, you can then move it to any
other path desired, and attach it to a different log stream.
For example:
ESEUTIL /R E00
Note:
The Enn specifies the log file prefix of the transaction logs you intend to play
into the database. This command line will work only when run from the folder
in which the transaction log files exist, and only when the databases to be
recovered are in their original path locations. The log prefix specifier is a
required parameter for Eseutil /R.
/Lpath_to_logfiles
For example:
ESEUTIL /R E00 /Ld:\exchsrvr\logfiles
31
If you are running recovery from a folder where a valid checkpoint file exists, and you do not
wish to have that file affect recovery, you must define a different path for a checkpoint file to
be created during recovery. This might be required after restoring an offline backup into a
storage group where databases are running
If you are running recovery from a different folder, and wish to use the checkpoint file to
control recovery, you must point to the path for the checkpoint file.
If you wish to control the use of the checkpoint file during recovery, add this switch to the
recovery command:
/Spath_to_or_away_from_current_checkpoint
For example:
ESEUTIL /R E00 /Sd:\
Important:
Before recovering while ignoring the missing database, you should make a backup
copy of all transaction log files, including the current log file (Enn.log). Once Enn.log
has been changed by recovering the other databases, it may not be useable for
recovering the missing database if it is once again made available.
To prepare to do this, you should move the database files (.edb and .stm) and all transaction
logs you intend to play into a single temporary folder.
For example:
ESEUTIL /R E00 /I /D
The /I switch may or may not be necessary, depending on whether there are Clean Shutdown
records in the transaction logs for other databases that were attached to the logs. Using the
switch in this circumstance is recommended so that you do not have to start recovery again if
there is a “hanging attachment” somewhere in a log file.
The behavior of the /D switch deserves more explanation. If the /D switch is not present at all,
then the database paths recorded in the transaction log files will be used to locate the
databases. This is the only behavior available in Eseutil for Exchange 2000 and previous
versions. If the /D switch is used without a path, then the current directory will be used as the
path for the database files. If the /D switch is immediately followed (with no intervening space)
by a file path, then that path will be used to locate the database files. For more information
about using the /D switch to resolve issues with transaction logs while moving an Exchange
database, see Issues with Transaction Log Files When Moving an Exchange Mailbox
Database.
Because of the possibility of typing errors, it is strongly recommended that you eliminate the
need for using paths with Eseutil switches by running Eseutil from a folder where all data files
already exist.
After recovery finishes and the database files are in Clean Shutdown state, they may be
moved into place in the appropriate storage group, and attached to the log files there by
mounting the databases.
Note:
It will usually be necessary to mark the checkbox for “This database can be
overwritten by a restore” on the database object properties in Exchange System
Manager before the database will mount.
specific type of anomalies or inconsistencies in order to take proper steps to fix the database.
You should recover the database to Clean Shutdown state before running an integrity check.
For more information about doing an integrity check using Eseutil, see How to Run Eseutil /G
in Integrity Mode.
Note:
An integrity check may end prematurely if damage to the database is of such a
nature that parts of the database must be repaired before other parts can be
35
checked. The fact that an integrity check ends before it finishes does not necessarily
mean that repair is unlikely to succeed. Although you can perform an integrity check
after a dirty shutdown, we do not recommend this. You should recover the database
to Clean Shutdown state before you run an integrity check if you can do so.
Procedure
To run Eseutil /G
The basic command line syntax to run an integrity check with Eseutil is:
ESEUTIL /G database_filename.edb
For example:
ESEUTIL /G priv1.edb
Note:
There must be disk space available to the equivalent of 25 percent of
combined size of the Exchange database (.edb) and streaming database
(.stm) files. The streaming database must be in the same folder as the .edb
file.
You may be faced with the following scenarios when you run an Eseutil /G integrity check on
the database:
If you do not have free disk space equivalent to 20 percent of the size of the files being
checked, then there is greater likelihood of running out of disk space during the check. You
can add this switch to the command to redirect the “scratchpad” database to a drive with
more space:
/Tpath_to_temporary_database
For example:
ESEUTIL /G priv1.edb /T\\Server2\d$\scratchpad.edb
36
Note:
There is no space between the /T switch and the path specification. You can also use
an ordinary drive letter path specification if desired.
If there are no SLV files (.stm or streaming database files) checksum errors reported in the
.raw file output, then while the two files may be formally out of synch, the likelihood of
successful repair and reintegration of the streaming file data is high.
-or-
View header information for the database, streaming database, checkpoint and
transaction log files.
Validate that a series of transaction log files forms a matched set and that all files are
undamaged.
View space allocation inside the database and streaming database files.
View metadata for all tables or for a specific table in the database file.
For more information about syntax and about running Eseutil /M in different scenarios, see
How to Run Eseutil /M in File Dump Mode.
The following table provides details of switches used to view headers of different types of
database files:
38
For more information about /ml and /mh switches, see Eseutil.exe Examples.
The most common mode modifiers that are used with Eseutil are:
Note:
To list additional options for Eseutil, type eseutil /? at a command prompt, and then
press ENTER.
For more information about Eseutil file dump mode, see Eseutil /M File Dump Mode.
There are separate switches for viewing different kinds of file headers. Be sure that you use
the correct switch with the correct file type, or the output will be invalid.
Note:
There is no space between /P and the page number.
Doing this required examining and comparing each file header. There was no way to
verify that a transaction log file was undamaged. Transaction log files in Exchange 5.5
were not checksummed.
Starting with Exchange 2000 Server, you can use the /ml switch to verify both the sequence
and the integrity of a set of log files.
For example:
Note:
By specifying only the log file prefix, rather than a particular log file name, all
log files in the current folder will be scanned and validated. You must run this
command from the folder where the log files exist. Processing each log file
will take a few seconds. To process the current log file in a running storage
group, all databases in the storage group must be dismounted.
You can also display data for a single table by specifying the name of the table. For
example, you may wish to view the Msg or attachments table:
Note:
The attachments table in an Exchange 200x database is table 1-23.
Note:
The space usage dump syntax is identical to that for metadata, except that
the switch /MS is used instead of /MM.
An aggregate total of the free pages in the database is listed on the last line of a space usage
dump. You can multiply this number by the page size for the database to get an
approximation of the space that will likely be reclaimed by defragmentation.
Notes:
In a typical database, the metadata dump will take multiple screens. To preserve the
output to a file, add a redirection command to the end of your command line, for
example:
For more information about /ml and /mh switches, see Eseutil.exe Examples.
Note:
The checksum mode does not run a database recovery. If a database is inconsistent
or is in a "dirty shutdown" state, Microsoft recommends that you perform a recovery
operation to make sure that the database operations are completed correctly. After
you perform the recovery operation, you can use the Eseutil tool to perform the
integrity check.
For more information about running Eseutil in checksum mode, see How to Run Eseutil /K in
Checksum Mode.
43
With the inclusion of ESEFile features in Eseutil, the checksumming capabilities of Eseutil are
extended to include streaming databases, log files, and checkpoint files. Note the following
uses of the Eseutil /K checksum command:
If you checksum only a streaming database, only the header pages in the database will
be checked. The data is ignored. If you wish to checksum an entire streaming database,
you must run checksum mode against the Exchange Database (.edb) file. The reason for
this is that the checksums for data in the streaming file are not actually stored in the
streaming file, but in a table in the .edb file.
The Eseutil checksum mode will not allow you to checksum individual pages in the
database. But you can use the page dump mode to determine whether the checksum on
any given page is correct.
can also use the switch to perform a checksum procedure on a streaming file. For more
information about how to use Eseutil in checksum mode, see Eseutil /K Checksum Mode.
The checksum feature does not run a database recovery. If a database is inconsistent, or in a
"dirty shutdown" state, we recommend that you perform a recovery operation to make sure
that database operations are completed correctly. After you perform the recovery operation,
you can use the Eseutil utility to perform the integrity check.
Procedure
To do a Eseutil /K checksum with basic syntax
Enter this basic syntax at the command line to checksum an ESE database,
streaming database, transaction log, or checkpoint file:
ESEUTIL /K <filename>
Note:
Replace <filename> with the path and name of the file that you want to
checksum
The following optional command-line switches are associated with the /K switch:
/s<filename> Use this switch to specify the streaming file name. The default setting is
none.
/t<db> Use this switch to specify the temporary database name. The default name is
Tempchksum*.edb.
/e Use this switch if you do not want to perform a checksum procedure on the database
file.
/i Use this switch if you do not want to perform a checksum procedure on the streaming
file.
If you want to save time by checksumming only the files in question, you can use the /E
(ignore EDB) or /I (ignore stm) switches. If you use the /E switch, the checksum table for the
streaming database is read from the edb file, but no other edb file pages are checksummed.
Using the .stm file name in checksum mode will checksum only the first two header pages of
the streaming database. For example:
Note You cannot checksum the whole streaming file unless the database files are in a Clean
Shutdown state. This is because the table storing the checksums in the streaming file is in the
edb file. If the database is not in Clean Shutdown state, you cannot know for sure that this
table is completely up to date and valid.
Note:
Since copy file mode does not accept wildcard file specifications, you must fully
specify a file name and copy one file at a time.
Depending on disk and network conditions, copy file mode may be able to copy a file up to 20
percent faster than a typical copy. It can also handle copying of very large files that previous
versions of Microsoft® Windows 2000 Service Pack 2 (SP2) would not copy.
For more information about how to run Eseutil in copy file mode, see How to Run Eseutil /Y in
Copy File Mode.
47
Procedure
To run the Eseutil /Y command
1. Type the syntax (as in examples below) at the local command prompt in the
destinationfolder.
The following is an example of how to copy the priv1.edb file from server1 to your
current location:
ESEUTIL /Y \\server1\d$\priv1.edb
The following is an example of how to copy the priv1.edb file from sever1 to
server2 specifying the full path and file names for both source and destination:
ESEUTIL /Y \\server1\d$\priv1.edb /D\\server2\d$\priv1.edb
Note:
Unlike the default copy command, you must use the /D switch when you
48
Page level: The file contains an ordered series of pages (typically 4 kilobyte or a multiple of
4 kilobytes), with each page sharing a common organizational structure. Each page has page
header information and page data. The header information includes the checksums for the
page that enable Exchange to verify data integrity and to correct single-bit errors on the page.
ESE Table level: Groups of pages are owned by tables that are managed by the ESE
database engine. A typical Exchange database contains thousands of individual tables.
Application level: ESE is a general purpose database that can be used by different
applications. For example, both Exchange and Active Directory directory service use ESE.
The ESE database engine stores information in its tables as directed by a particular
application. ESE itself does not understand the application-defined relationships between
tables or the meaning of the data stored in each table.
All transaction log files generated since the backup are available and undamaged.
The problem in the database is not caused by a logical corruption or unintended deletion.
For example, if a virus scanner was to corrupt messages or delete them, then the
corruptions and deletions would be part of the transaction log record and would be
replayed into the database after restoration from backup.
Move Mailboxes
When you move an Exchange mailbox to a different database, the contents of the mailbox
are processed by the Exchange Information Store just as when they were created. Items that
have been damaged will be skipped. Therefore, moving all mailboxes to a new database is
an excellent strategy for removing damaged items while at the same time maximizing the
amount of salvaged user content.
50
After a mailbox has been moved, Outlook client profiles will be automatically updated to point
clients to the new database or server. For this to occur, the previous server must remain
online with its Information Store service that is running until after all clients have logged on
one time and have been redirected. If the previous server is not kept online, then Outlook
client profiles must be updated manually or through scripts.
Previous offline or cached mode client files will continue to work after a mailbox has been
moved. Client rule functionality is also preserved when a mailbox is moved.
Moving a mailbox has the same effect on the destination server as redelivering all the items
in the mailbox at one time. Therefore, if you are moving many mailboxes, it is best to do the
operation at off-peak times, and to provide clients information in advance about when the
move will occur and about how to receive help if they experience problems logging on after
the move.
Moving many mailboxes will cause a larger than ordinary number of database transaction log
files to be generated for the destination database. You should closely monitor transaction log
disk space on the destination server during a bulk mailbox move operation. If you are close to
running out of transaction log disk space, you can run an online full or incremental backup to
clear the log files or enable circular logging before the move and then disable circular logging
right after the move.
Moving all mailboxes to a new database, and discarding the previous database, maximizes
the preservation of salvageable user content while at the same time minimizing database
downtime.
For information about how to move an Exchange database to another server or storage
group, see Moving an Exchange Mailbox Database to Another Server or Storage Group.
Note If the database is severely damaged, repair will take longer to run, and the probability
of a successful repair is less likely. If you run repair on an undamaged or only slightly
damaged database using typical enterprise-class server hardware, the process will usually
take about an hour for every 5 GB of data. If you are calculating repair times as part of
designing Service Level Agreements (SLAs), you should perform your own benchmarks on a
typical database running on hardware similar to that used for Exchange in your organization.
If a database has been severely damaged, repair times may increase by a factor of 10 or
more.
For more information about how to use Eseutil to repair a database, see Eseutil /P Repair
Mode.
51
In this case, you can restore the backup, and in parallel, repair the damaged copy of the
database in a Recovery Storage Group on the same server or on a laboratory server. You can
then use the Recovery Storage Group feature to mount both copies of the database
separately and merge data from the repaired database to the restored database.
Assuming the repair is successful, this strategy has a chance of recovering almost as much
data as if you had been able to use the transaction logs. For more information about several
hybrid strategies using Recovery Storage Groups, see the guide on Using Exchange Server
2003 Recovery Storage Groups (http://go.microsoft.com/fwlink/?LinkId=47589).
Note:
Deleting log files for a
Clean Shutdown
database will affect
the validity and roll
forward capabilities of
previous backups
Error -939586631 (Unknown Unknown Error This error occurs when you
try to run Eseutil /CC with an
Error, Unknown Error)
incorrect path to the
Restore.env file. The mailbox
store will fail to mount as a
result of this error. You can
resolve the issue by running
Eseutil /CC with the correct
path of the Restore.env file. If
the issue persists, you can
run Eseutil /P followed by
Eseutil /D, and then try
running Eseutil /CC again to
recover the database. For
more information about
running Eseutil /CC, see How
to Run Eseutil /C (Restore) in
Different Scenarios.
Microsoft Knowledge Base article 266361, "Extensible Storage Engine 98 Error Codes 0
to -1048"
Extensible Storage Engine Error Codes
For more information about understanding Extensible Storage Engine (ESE) file types, see
Extensible Storage Engine Files.
For more information, see the following topics in the Exchange Server Database Utility Guide:
Copyright
The information contained in this document represents the current view of Microsoft
Corporation on the issues discussed as of the date of publication. Because Microsoft must
respond to changing market conditions, it should not be interpreted to be a commitment on
the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information
presented after the date of publication.
This White Paper is for informational purposes only. MICROSOFT MAKES NO
WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS
DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting
the rights under copyright, no part of this document may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), or for any purpose, without the express
written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from Microsoft, the furnishing of this document does not give you
any license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the companies, organizations, products, domain names, e-mail
addresses, logos, people, places, and events depicted in examples herein are fictitious. No
association with any real company, organization, product, domain name, e-mail address,
logo, person, place, or event is intended or should be inferred.
Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, ActiveSync,
ActiveX, Entourage, Excel, FrontPage, Hotmail, JScript, Microsoft Press, MSDN, MSN,
Outlook, SharePoint, Visual Basic, Visual C++, Visual Studio, Win32, Windows Mobile,
Windows NT, and Windows Server System are either registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries.