Exchange 5.5 log file/database out of sync 1

[dpeno]

My exchange 5.5 server got a virus in a log file and the log file was put in quarentine. The server stopped and now the DB and log files are out of sync. I removed the virus but I am having a hard time getting the Information store backup because the database is damaged. I have a backup but would like to rebuild the database and not lose any data if possible.

Dave

 

[dpeno]

I have tried running eseutil defragment, repair, and recovery and get -1018 errors.

 

[zbnet]

You shouldn't be running file-based antivirus against the Exchange server files! If you must run antivirus on an Exchange server, get an Exchange-aware one that uses the proper API to access the database. If you don't sort this, you will get the same again in the future...

Do you have a clear idea about what you have been trying to achieve with ESEUTIL? You say you want to avoid data loss if possible, but the Repair option (/P) will almost always result in data loss - it removes any 4KB database pages that fail the internal checksum, regardless of what is in the page - it's very much a last resort when everything else has failed. Have a good read of

http://www.microsoft.com/exchange/techinfo/administration/55/backuprestore.asp

to familiarise yourself with the internals, and with what steps to take to try and recover an inconsistant database. But my feelings that if you cannot recover the missing transaction log file, then some level of data loss is likely.

 

[dpeno]

Thanks for the help. I was able to get Exchange running. I did not realize that the virus scanner was scanning the exchange files, one of the many things I am working on fixing since taking over recently. I will read the link you provided. Another quick question, are the pub and priv databases linked? What I mean is does repairing/recovery/defragment on one effect the other?

Thanks again

Dave

 

[zbnet]

The private information store lives in priv.edb, the public information store lives in pub.edb, but (crucially) they share the transaction log files in mdbdata. ESEUTIL works at a database level, so when you run it you specify either a full path to the database file you want to work on, or use /ds, /ispriv or /ispub to read this info from the registry; but the mdbdata transaction log files will be read when you do a Recovery (/R) regardless of which store you point ESEUTIL at.

It's worth saying the Directory lives in dir.edb, and has its own entirely seperate set of transaction log files in dsadata. It's much less common to need to work on the directory database offline.

 

[dpeno]

Thanks for the help and useful info!

Dave