edb.log file accidentally deleted... info store service not starting

[sbjennifer]

The W32.Mimail.A@mm virus infected our edbtmp.log file,
whihc was deleted by Norton anti-virus.

Now, our e-mail system is completely down and we cannot
start the information store or internet mail services.

I looked in the MDBDATA folder, and did not find the
edbtmp.log or the edb.log file in that directory.

In the event viewer, we are getting the following
messages (among others):

"The Microsoft Exchange Information store service
returned service specific error 4294966782"

"Unable to initialize the Microsoft Exchange Information
store service. Error current log file missing"

"Error current log file missing initializing the
Microsoft Exchange server information store database".

"MSExchangeIS (263) Unable to create the log. The drive
may be read-only, out of disk space, misconfigured, or
corrupted Error- 1811"

Please help! If anyone knows of how to get exchange
working again... please help! We tried copying a new
edb.log file into the directory, but still no luck.
.

 

[KristeK]

Check the isinteg tool...
My first shot at this would be running isinteg -patch but read the documentation about this tool

 

[MaryAnnH]

Did you ever get an answer on this. The same thing happened to us. Differnt Virus same result of Norton deleting the edptmp.log We tried the isinteg -patch but it said it couldn't be run because the information store wasn't started and we obviously can't start the information store.

 

[GWINTO]

Isinteg doesn't require that the Info store is started it requires that the directory store is.

The more you know, the more you realise there is to know....
CCNA MCP

 

[208]

1. stop all other service for Exchange.
2. run eseutil program in exchange directory
e.g. eseutil /mh c:\exchsrvr\mdbdata\pri.edb|more
and eseutil /mh c:\exchsrvr\pub.edb|more
if found above database status is inconsistent

run eseutil /p c:\exchsrvr\pri.edb (pub.edb)
This process may result in loss of data but no other choice except restore old data.

restart all exchange server services but maybe Information store and IMC cannot start.

go to c:\exchsrvr\bin
run isinteg -patch
start other exchange server services.

run NAV on your server and add \exchsrvr directory on exclusive scan item in exclusive button

good luck!

 

[sbjennifer]

After spending hours on the phone with Microsoft support, they had us rename the most recent log file as ebd.log.

**They said this was a last resort, and was not recommended, but since we had tried to restore from a backup and the edb.log file wasn't there, this was the only thing we could do. We were told that this could result in the dayabase being corrupted, but we haven't had any problems since then.***

We also had a problem where the circular logging was off, so we had about 13 GB of log files hanging out there (our last IT guy had it disabled for some reason). So after we renamed the file and tried to start the information store service, it took about 3 hours for the system to go through and reassociate the log files. After it finished, the services started and e-mail came back up.

They also told us that Norton or other file scanning anti-virus programs should never be scanning th4e database files, so we changed the settings on Norton.

I would suggest calling Mircosoft... since the entire e-mail system was down due to a virus, they said that they would not charge us for the support call, and since they were really nervous about renaming the log file, there might be something else they can suggest in your case. (If you have a good backup, they will probably start there first).

 

[12426]

Don't waste your time (and money) calling Microsoft...

I had a similar problem with an Exchange 5.5 server that got infected by a virus (Fizzer). Norton CE server 7.6 deleted the infected edb.log.

Here is an easy fix:

I was able to recover from this situation by following these steps:

First, I excluded the exchsrvr folders in Norton CE 7.6 (it should have been done from the beginning).
Second, I stopped Norton 7.6 server and Exchange services and I renamed the existing edb.log file in MTADATA folder.
I brought up the Norton client and I recovered the infected edb.log from the quarantine folder.
Last, I restarted the Information Store service without any problems...

The NAV for Exchange should be the only anti-virus program that should be scanning databases! Not the NAV server!

I hope this helps...