Problems backing up Exchange 2000 - Help needed please

[deani]

Sometimes when I try to backup up an Exchange 2000 information store the job will fail with the following error:

E8604 27/07/2005 10:18:05 1416 6 Failed to start backup. (DBNAME=newsmtcmfpa, EC=FOREST:Backup Agent Error -- (1362) "Exchange Server Error. HrESEBackupEnd failed. Check Backup Agent Activity Log".)

This doen't happen every time, which is the puzzling part - one day it might work next day it will fail. Does any one have any idea why this happens and more importantly a solution ?

Running Windows 2000, Exchange 2000, BAB and Exchange Agent 11.1

Thanks in advance for any help.

Ian

 

[speshalyst]

HI,

Are you performing a FULL backup of Exchange?
If so please verifyu if the transaction logs are getting purged after the backup
If not there could be an issue with the Exchange Database.



So it Shall be Written!
So it Shall be Done!!

 

[deani]

It is a combination of full and incremental backups. The error can occur during either. In my experience the logs will only purge if the job completes succesfully, therefore the logs from yesterday are still there (I assume this is normal?)

I should have mentioned that this is happening on more than one exchange server and seems to be a problem that we have always had but have never managed to get to the bottom of.

Any more help or ideas would be appreciated.

Ian

 

[speshalyst]

HI,

Would it possible for you to try using NTbackup to perform a full backup of the Exchange Databases.
This would help you isolate the problem.

So it Shall be Written!
So it Shall be Done!!

 

[deani]

I have managed to backup the priv1.edb and priv1.stm files succesfully using NTbackup, is this what you meant ?

Though I'm not too sure what this tells us other than I can backup up the database as a flat file, I would have thought that the Exchange agent is doing something far more complicated than this and this is where the problem lies. Any ideas ?

Once again many thanks for your ongoing help.

Ian

 

[deani]

OK, I had another look at what I did and I think I may have misunderstood you (partly due to my having never used NTbackup before) I see now that there is a specific backup option for Exchange, I an currently re-running the backup again (correctly this time) and I'll post the results on here.

Thanks
Ian

 

[deani]

This is the result of running NTbackup correctly.

Backup Type: Normal

Backup started on 7/27/2005 at 4:40 PM.
Folder FOREST\Microsoft Information Store\newsmtcmfpa\newsmt
F:\newsmt\newsmt.edb
F:\newsmt\newsmt.stm
WARNING: Portions of "\newsmt" cannot be read. The backed up data is corrupt or incomplete.
This file will not restore correctly.
Folder FOREST\Microsoft Information Store\newsmtcmfpa\Log Files
F:\newsmtlogs\E0200180.log
Backup completed on 7/27/2005 at 4:43 PM.
Directories: 3
Files: 3
Bytes: 1,585,590,508
Time: 2 minutes and 43 seconds

From this I'm guessing the problems lies within our Exchange
information store. It's interesting though that the problem will seem to fix itself only to re-appear again.

Ian

 

[deani]

I have dug a little deeper, below is the contents of the dbaexch.log for last nights failed BAB backup:

07/28/05 06:00 Connect Exchange Backup Agent
07/28/05 06:06 <Staff> in Copy Backup Mode
07/28/05 06:07 <Staff> removed from Backup Mode
07/28/05 06:07 <newsmtcmfpa> in Copy Backup Mode
07/28/05 06:08 MS Exchange Server API call return hr = 0xc7ff1004
07/28/05 06:08 "MS Exchange Service Message -- Error returned from an ESE function call (183).
"
07/28/05 06:08 MS Exchange Server API call return hr = 0xc7ff1004
07/28/05 06:08 "MS Exchange Service Message -- Error returned from an ESE function call (183).
"
07/28/05 06:08 <newsmtcmfpa> removed from Backup Mode
07/28/05 06:08 MS Exchange Server API call return hr = 0xc7ff07d1
07/28/05 06:08 "MS Exchange Service Message -- The parameter is not valid.
"
07/28/05 06:08 Exchange Server Error. HrESEBackupEnd failed. Check Backup Agent Activity Log
07/28/05 06:08 Backup Agent Error -- (1362) "Exchange Server Error. HrESEBackupEnd failed. Check Backup Agent Activity Log".
07/28/05 06:08 <Newstaff> in Copy Backup Mode
07/28/05 06:18 <Newstaff> removed from Backup Mode
07/28/05 06:18 Disconnect Exchange Backup Agent

Can anybody shed any light on Error returned from an ESE function call (183) ?

Thanks again
Ian

 

[speshalyst]

HI,

Can you put the Exhcange agent in debug mode?
on the Exchnage server
HKLM\Software\CA\BAB\DSAgent\Agent\CurrentVersion\Dbaexch
Debug = 3

This would generate a *.trc on the Exhcange server

This would show you where the point of failure lies.
THe databases would get backed up properly but the fails to flush the transaction logs..

So it Shall be Written!
So it Shall be Done!!

 

[deani]

Thanks for that

I have done that and re-run the backup but it doesn't seem to have created a trc file. Where would you expect it to place the file(s) ?

Regards
Ian

 

[speshalyst]

it would be in the Exchange agent install folder on the EXchange server.

So it Shall be Written!
So it Shall be Done!!

 

[deani]

Ok, debug is working now - needed the agent's services stopping and restarting. Below is an abridged copy of the the trace.

I have omitted the header type info - it all seems ok, no errors. I have also omitted the section refering to the edb file as this completed without error.

$ Open database file OK: E:\newstud\newstuds.stm, fsize=18440 KB
$ erdr(): writes 1024 bytes(header)...
$ exch_read_db_remote(): total bytes backed up = 2585740 KB, bid=0, ioid=0
$ erdr(): writes 65536 bytes...
$ exch_read_db_remote(): total bytes backed up = 2585804 KB, bid=0, ioid=0
$ erdr(): writes 65536 bytes...

<similar lines repeated numerous times>

$ exch_read_db_remote(): total bytes backed up = 2588684 KB, bid=0, ioid=0
$ erdr(): writes 65536 bytes...
$ exch_read_db_remote(): total bytes backed up = 2588748 KB, bid=0, ioid=0
$ erdr(): writes 65536 bytes...
$ Read failed:newstudents hrStatus=-939585532/0xc7ff1004
$ MS Exchange Server API call return hr = 0xc7ff1004
$ Error returned from an ESE function call (183).

$ main_iou.status is set to STAT_ERROR
$ MS Exchange Server API call return hr = 0xc7ff1004
$ Error returned from an ESE function call (183).

$ erdr(): error: close the pipe...
$ main_iou.status is set to STAT_ERROR
$ DSAEndBackup() is called: db_name newstudents, backup_id=0
$ exch_db_end_backup db_name=newstudents, ThreadID=0x758
$ main_iou[j].status=0x181
$ local backup job status error.
$ release io_unit=0
$ calling _HrESEBackupEnd().
$ _HrESEBackupEnd() failed.
$ MS Exchange Server API call return hr = 0xc7ff07d1
$ The parameter is not valid.

$ Release dumpload_unit=0
$ DSAGetError(): errcode=1362, Exchange Server Error. HrESEBackupEnd failed. Check Backup Agent Activity Log
$ DSADisconnectAgent() is called

All I can deduce from this is that the problem lies in the streaming file, though what that problem is I have no idea. Any suggestions ?

I would like to say a big thankyou for taking the time to help me on this.

Ian

 

[speshalyst]

HI,

Looking at this entry ...
$ Read failed:newstudents hrStatus=-939585532/0xc7ff1004

I assume that the backp process is not able to move further at this point..
Could be a native Exchange problem.
Are there any events logged in the application\system logs relating to exchange when the backup fails.

IF you find any event IDs.. try searching for relevent info on eventid.net



So it Shall be Written!
So it Shall be Done!!

 

[deani]

As of yet I don't have a solution, but at least I now think I know what the problem is. Microsoft suggest that running 3rd party software to add disclaimers to email messages can cause problems with checksum errors in the streaming file, and as we do this I suspect this could be the cause. I think I can rule out hardware problems as this is happening on several servers. The only common feature is that each run F-secure which plugs into Exchange and one of it's tasks is to add disclaimer messages. The following MS article describes it further:

http://support.microsoft.com/default.aspx?scid=kb;en-us;318429

I think we can put this thread to bed now, but once again Speshalyst I would like to thank you for your help, it is much appreciated.

Regards
Ian