Exchange Recovery problem with ISINTEG

[tahoe2]

Hello. After being hit by Symantec's 'we think your edb files are a virus' snafu (and finding out that the previous NetAdmin deleted the quarantine server and all 'virus' files were deleted...) I had to recover the Exchange server.
I followed the instructions on MS's website, and one of the steps is as follows:

Using a Command Prompt, execute the following:

\EXCHSRVR\BIN\ISINTEG -PRI -test mailbox,message,folder
\EXCHSRVR\BIN\ISINTEG -PUB -test mailbox,message,folder
\EXCHSRVR\BIN\MTACHECK

When I run the first two lines, I get a Jet Error.
Jet Error Jet_errInvalidLogSequence while opening the database.

Then I run the third line and I get:
Database contains no errors.

Is this important? The system is still running, and this was yesterday morning.

Thanks,
Corie

Ps, I reinstalled Quarantine Server and stopped the scan on the exchange folder, that should take care of the initial problem.

 

[rdroske]

The MS instructions should tell you whether to expect that message or not?

Seems like it should be expected since what happened was that one of your edb.log files got deleted and that would mess up the sequence.

Seems next step would be to run with -fix option (but I haven't had to do this so this is just something to think about, don't do on my say so).


Sounds like there is a problem though, are log files just building up (not getting committed to real database)?

If you have a backup from prior to the virus I would make sure that it is not overwritten with any new ones.

 

[tahoe2]

Good idea about the backup, I'll do that. Also, MS's instructions about errors are to 'refer to your documentation.' whee.

Also I do not seem to have a buildup of log files, so I am hesitant to do anything else. However there is still the errer messages....


I'm coming in early tomorrow, so we'll see what happens.

Corie

 

[tahoe2]

OK, the second I hit POST, the exchange server shut down. There was the EDB.LOG in quarantine. I have no idea why since there is no scheduled scan, and I've removed the check next to the exchange folder in the one scan that does exist.
I tried the restore, no go. Now I'm restoring the Information Store from last nights backup.

what the heck?! it's starting to drive me nuts.

Corie

 

[rdroske]

Youch, good luck. If that was me I'd be hearing it big time about losing todays mail.

Are you sure you unchecked the right directory? Might be an exchsvr dir on another drive that actually holds the data?

 

[tahoe2]

After doing some research, I found out that exchange also uses the C:\temp folder. That needs to be excluded from the scan as well.

To be certain, I put everything to do with Exchange on the exclusion list in Norton.

We'll see what happens today...

Corie

 

[tahoe2]

Also, I found that when doing a restore from a tape backup, you don't lose data if you keep the check in the box next to NO LOSS RESTORE on the EXCHANGE tab.
Microsoft says to remove the check, but I found that it doesn't hurt to leave it there. If the restore fails, just do it again with the check removed.

Corie

 

[788928user]

Next time when you have same EDB.log error, my suggestion will solve the quarantined EDB.log file problem in 5 minutes. But make sure exclude "exchsvr" folder first on NAV client "real time protection".
I think it is better and faster than MS suggested solution.

1. Open NAV client which installed locally.
2.Go to quarantined and right click EDB.log which is quarantined.
3.Choose "undo action taken"
4.When you restore, they will ask you to overwrite and click "yes". Somehow exchange server recreate EDB.log but it wasn't working.
5.Stop all the exchange related service.
6.Start all the exchange related service.

 

[tahoe2]

Well, all seems to be in good working order. I've excluded the Exchange folders on the C and D drives, as well as the c:\temp folder.
2 days and counting.... :>)

Thanks to everyone for the suggestions!

Corie