All email has vanished.... Am I blind or just inexperienced???

[Marty33]

On a network running Exchange with 6 users, somehow overnight all email has disappeared. None of the users are able to start outlook - a message simply appears saying that the server cannot be accessed and is likely down for maintenance. Searched the server for all .pst and .ost files and found nothing.
When trying to open the individual user folders in exchange admin, exchange simply hangs and does not respond, even after 1/2 hour waiting.
Norton corporate found the w32.netsky.c@mm virus in the edb.log file and had removed it. Not sure if this has something to do with it...
I also noted the MDBDATA fodler (I think that is what it is called) had very little in it. Only a couple of KB
Whether or not the above info makes any sense at all I dont know. Hope it does!
I will be very grateful for any info provided, and if you need to know more detail, I would be happy to provide!
Thank you in advance to anyone who replies - even if you are just saying hello...

 

[N0ktar]

Are the services running? Have you checked your event logs?

 

[LordRay1000]

Hi Marty,

This sounds like the Exchange Services either timed-out on you or perhaps (hopefully not) your antivirus was scanning your MDBDATA folder, found a virus and then quarantined it. This happened to me once and I had to restore the MDBDATA folder (specifically the PRIV & PUB files) from a backup I did off-line. What is the current status of the services? The services you should have running are:
MS Exch Directory
MS Exch Information Store
MS Exch Internet Mail Service
MS Exch Transfer Agent
MS Exch System Attendant
MS Exch Event Service
also, you may need MS Exch Directory Synchronization

Let me know how things are going!
Regards,
Ray

 

[MSawyer]

Hi Marty,

I had this problem once also - in my case the AV software detected a virus in the .edb file (information store database itself) and renamed it, producing exactly the symptoms you describe. Restoring just this file from the backup did not work (presumably because the previous backup would be out of step with the newer transaction logs), in the end we restored the whole server - which was dramatic but worked, but if we'd had more time it would have made more sense to try restoring the db, logs and chk files to see if that worked. Hope you manage to sort the problem.

All the best, Matt

 

[fuego007]

Marty,

NAV CE MUST be configured to exclude certain Exchange directories from scanning. If NAV CE did something to the edb.log file, it may have made it unuseable. Make sure NAV Ce has not quarrantined any transaction log files (edbxxxxx.log). If it has, configure the NAV realtime protection options to exclude the 'Exchsrvr' folders on all drives, then restore the files from quarrantine. Try restarting the IS.

If the Information Store has stopped and will not restart (and there are no files in quarrantine), you will have to check the state of the databases. Open a DOS window, switch to the drive and folder containing the priv.edb and run: eseutil /mh priv.edb|more. Look for the entry for 'State'. Run the same command again using pub.edb instead of priv.edb. If either one is inconsistent and you have restored files from quarrantine, try running the following

eseutil /r /is /lx:\exchsrvr\mdbdata /sy:\exchsrvr\mdbdata

where x: = the drive where the transaction log files (edbxxxxx.log) are located

and y: = the drive letter where the checkpoint file (edb.chk) is located

after stopping the Directory Service. This will attempt a soft repair.

If this fails to return the databases to a consistent state, you may have to perform a hard repair on them. Before doing this, you should try to consult with someone via phone to further analyze the problem.

Bob