My adventures in Exchange Log Replaying.

I wanted to restore our exchange environment in an off line VM. One of my goals was to take an information store and mount it – just to prove that I can access the data.

At our off site business continuity location, we have a Double-Take replica of our production Exchange 2003 server, including replicas of all our information stores. Those replicated store are on an Dell Equallogic SAN, which has snapshot capabilities.

I figured I could take a snapshot of the volume that contains the information store I want present it to my offline exchange, and just mount the store. When I tried to mount the store, I realized this would not be be easy. Time to do some learning.
First Error:

The log version stamp of logfile Drive:\PATH\mdbdata\E01.log does not match the database engine version stamp. The logfiles may be the wrong version for the database.

This one was easy. I was too lazy to install SP2 on the recovery server. Seems that I needed to as the logs are stamped with a version number. Quick Fix – install Exchange 2003 Sp2.

Next error:

ESA: The Exchange Virtual Server needs to be upgraded before coming online. From the Cluster Administrator program, select ‘Upgrade Exchange Virtual Server’ from the resource’s context menu to upgrade this Exchange virtual server.

Again another easy one. I just had to go into the cluster admin and right click “Upgrade Exchange Virtual Server”

Next error:

An internal processing error has occurred. Try restarting the Exchange System Manager or the Microsoft Exchange Information Store service, or both

I was using a Standby Exchange Cluster as described here. This error suggested that I did not have al my drives and paths right. For some reason this inherited Exchange 2003 cluster had the exchange program files installed to an “E:” drive. I added another drive and re-installed exchange with Sp2.

Next error:

Database recovery/restore failed with unexpected error -515.

Alright! This was a good one. I suspected my snapshot of a replicated information store might not be happy. How do I make it happy? So begins my adventures in replay logs. Here is the summary of what I learned. I understood how what to do, I just did not know how to do it!

If you suspect you are having an issue with an information store that you can not mount, run (here is your only warning – backup before you try anything.) :

eseutil.exe /mh MailStore.edb

If you see: State: Clean Shutdown – there is something else going on.
If you see: State: Dirty Shutdown – you need to get the mail store to a clean state.

AFIAK, you can get a mailstore to a clean state one of two ways. The first is to replay the missing logs and the second it to repair. The second results in loss of data.

To replay logs, look at the output of the above command again and you will see :
Log Required: 30012-30013 (0x753c-0x753d).

If you have these log files (they will have a prefix like E00 or E01), all you should need to do is run

eseutil.exe /r E01

This will find the files and replay them into the MailStore.

I tried this but I was missing a log file. I received the following error:

Operation terminated with error -515 (JET_errInvalidLogSequence, Timestamp in next log does not match expected) after 4.16 seconds.

Since I was missing a log file, and I had no other option to get it (like from a backup (this is all dev so there was need no to panic)). I had to resort to the “I loss data” method:

eseutil.exe" /p MailStore.edb

This took several hours and the output looks like this:

Initiating REPAIR mode…
Database: MailStore.edb
Streaming File: MailStore.STM
Temp. Database: TEMPREPAIR3692.EDB

Checking database integrity.

The database is not up-to-date. This operation may find that
this database is corrupt because data from the log files has
yet to be placed in the database.

To ensure the database is up-to-date please use the ‘Recovery’ operation.

Scanning Status (% complete)

0 10 20 30 40 50 60 70 80 90 100

Scanning the database.

Scanning Status (% complete)

0 10 20 30 40 50 60 70 80 90 100

Repairing damaged tables.

Scanning Status (% complete)

0 10 20 30 40 50 60 70 80 90 100
Deleting unicode fixup table.

Repair completed. Database corruption has been repaired!


Now when I run:

eseutil.exe /mh MailStore.edb

I see “State: Clean Shutdown” and I can mount my MailStore. That was fun.


Comments are closed.