Exchange 2003 Server - Troubleshooting Eseutil

Introduction to Exchange 2003 Troubleshooting Eseutil

Eseutil reminds me of a knife. How do you feel about a knife in the hand of a madman -
uneasy? How about a knife in you hand at the supper table - happier? My message is this,
please be aware that eseutil is a dangerous tool and that you ought to practice on a test
Exchange machine before taking a stab at eseutil /r on your production server. ow that !
have warned you of the dangers, there will be situations where eseutil is a life saver. "#r at
least a mail saver.$
Topics for Exchange 2003 Server - Troubleshooting Eseutil
Eseutil for Exchange
Eseutil /mh /ml /mk
Eseutil /k to check for damaged headers
Eseutil /cc for troubleshooting
Eseutil /d to defrag the .edb database
Eseutil /r to repair Exchange 2003 log files
Eseutil /p will attempt to repair a corrupted store database
Eseutil for Exchange Server
%y spelling it E&Eutil, two thoughts spring to my mind' firstly, ! am reminded that
here is a tool that manipulates E(change)s E(tensible &torage Engine. &econdly,
E&Eutil is a relative of *+&util which ! use to manipulate ,ctive +irectory from the
command line. -hether you spell it E&Eutil, Eseutil or plain eseutil, this e(ecutable
is really three tools in one.

, different switch controls each aspect of eseutil. *he first and harmless aspect, is
shown by the eseutil /k, /mh and /cc switches. *hese gentle commands give you the
ability to re-run procedures that occur naturally in E(change, for e(ample, when you
remount a store, or replay the logs after a backup.

*he second side of eseutil is to defrag E(change .//0)s databases with eseutil /d
switch. *his /d switch shrinks the .edb files and recovers disk space. Eseutil /d
performs a specialist database compaction which is not the same as -indows .//0)s
built-in disk defragmenter.

*he third and most dangerous side of eseutil is the repair function with /r or /p.
1egard eseutil /r or /p as a last resort to repair your damaged mailstore. !f the
repair fails then it can leave the store in an unusable state, so always backup your
E(change server before you unleash the /r or /p switches.
My advice is to begin by practicing with the harmless switches,
for e(ample eseutil /mh or /k. *o get started go to the
command prompt and then navigate to the E(chsrvr2%in
folder. %ecause this 2bin folder is not in the file )3ath), beware
of the notorious4 )not recognised as an internal or e(ternal
command ) error. *his does not necessarily mean there is no
eseutil on the E(change server, 5ust that you are not
e(ecuting the command from the E(chsrvr2%in folder.
avigate to the 2e(chsrvr2bin folder before typing any eseutil
commands. ,n old trick is to copy the ,ddress as seen in
E(plorer and then go to the command prompt, right click and
paste that path. "&ee diagram opposite.$
,lternatively, if you are going do a lot of command line
troubleshooting, then it)s worth editing the 3ath in the &ystem
!con, Environmental 6ariables.
Eseutil /mh
Here is a simple switch to verify the state of an E(change database. ,ll that eseutil /mh
does is to determine whether the last shutdown was clean or dirty. Eseutil /mh is ideal to
practice getting to the right path and e(ecuting eseutil without doing any harm to the
mailstore databases.
*o start with, familiarise your self with the names and location of the E(change .//0
databases, for e(ample priv7.edb is usually in the 2e(chsrvr2mdbdata folder. My suggestion
is to type this command from the e(chsrvr2bin folder4
eseutil /mh 8d42program files2e(chsrvr2mdbdata2priv7.edb8 ",ssuming E(change .//0 is
installed on the d42.$
E(amine the output for this line, )&tate4 9lean &hutdown) "or +irty &hutdown$. !n passing,
you can also see when the last backup occurred. otice how the first line of the output
changes when you substitute priv7.&*M for priv7.edb. ote the phrase4 )&treaming :ile).
,nother use of eseutil /mh is in disaster recovery where you want to see if eseutil /p has
already been run. !f )1epair 9ount) is greater than ;ero, then you can see how many times
eseutil /p has been tried already. !n general, the greater the 1epair 9ount, the less chance
of a successful repair.
Eseutil /ml
&imilar to the /mh, e(cept this switch performs an integrity check on log files, for e(ample,
E//.log.
Eseutil /mm
+umps metadata from the database file "not the logs$. &pecialist use only, ! find the output
fascinating but not very useful.
Eseutil /mk
3rovides information about the checkpoint file. Handy for troubleshooting backup / restore
problems. -here /mh used priv7.edb, remember to substitute the name of the checkpoint
file E//.chk with /mk.
Eseutil /k to check for damaged headers
*his switch, eseutil /k is new in E(change .//0. *he keyword is4 check. <ust as checksum
verifies a file)s si;e, so eseutil /k checks the integrity of E(change .//0)s information
stores. #ne application of eseutil /k is to troubleshoot an E(change .//0 database after an
unscheduled shutdown of the -indows .//0 server. *he only downside with eseutil /k is
that it does not recover the database. ":or recovery try /r or /p - but be careful.$
!f you create additional mailbo( stores, then check their corresponding .edb filenames.
E(ample4 to check the default mailbo( store = priv7.edb go to the command prompt and
type4
eseutil /k 8c4 2program files2e(chsrvr2mdbdata2priv7.edb8
"*his time ! assumed that E(change .//0 has been installed on the c42$.
+o not worry about uninititiali;ed pages, it)s normal to have several hundred in this
category. However, what you don)t want is bad checksums or wrong page numbers.
,nother scenario is that you wish to check the transaction logs, in which case here is the
command4
eseutil /k c42e(chsrvr2mdbdata2e//.log
,s there are no spaces in the above file or folder names, you do not need to enclose the
command with speech marks. However, to save disappointment, pay special attention to
the path where the databases are stored.
Eseutil /cc for replaing the logs
>ey terms4 Hard and &oft recovery. 9heckpoint file, *ransaction ?ogs
, common scenario for this /cc switch is that you have 5ust restored an E(change mailstore
from last night)s backup and you want to replay today)s logs. Eseutil /cc would achieve your
goal provided you issue the command from the folder that contains the 1estore.env file.
*his special file "1estore.env$ carries information about the restore in general and the log
se@uence numbers in particular.
9ommand4 eseutil /cc path to restore.env
*here is a sister command 5ust to check the contents of restore.env 4 eseutil /cm path to
restore.env
?ikely contents of restore.env would include paths to source files. ames of databases .edb
and .stm files. See more on restore.env here.
Terminolog check
9ases where you force a replay of the transaction logs are referred to as a hard recovery.
Eseutil /cc gets the restored database up-to-date through such a hard recovery process.
Hard recovery replays the transaction logs after a backup, either select the )?ast %ackup
&et) checkbo(, or use eseutil /cc. 1emember that eseutil /cc looks for instructions in the
1estore.env file. 3erhaps you can see what ! mean when ! say that some aspects of Eseutil
are 5ust command line methods of controlling E(change .//0.
!n cases where you are short of disk space, call for the temp switch. Eseutil /cc 8name of
temp folder8 /t. aturally you would need to substitute 8name of temp folder8 for a real
folder.
*o be sure that the recovery is complete, wait until you see an E&E event !+ ./A in
the Event 6iewer, ,pplication ?og.
&oft recovery replays the logs - but only after the last checkpoint. *he normal routine at
startup is for uncommitted transactions to be written to the database. <ust remounting the
store triggers a built-in soft recovery routine.
-ith a soft recovery, E(change processes a few recent transactions after the last
checkpoint. &oft recovery reads pointers in E//.chk, from this information it knows which
transactions to commit or roll-back in order to get the database into a consistent state. #ne
such soft recovery scenario could be a sudden )dirty) store shutdown, which resulted in
transactions being interrupted.
!f you delve more deeply, you find that eseutil /c has a whole family of commands e.g. cc
/ch
Eseutil /cm - 1ead 1estore.env
Eseutil /d to defragment the !edb database
Eseutil / d is probably the commonest and the safest of eseutil)s switches. *his switch
works in the same way that +isk >eeper defrags a physical disk. *ake the problem where
E(change)s mailstore is huge and does not shrink even after you have deleted several
mailbo(es. Bou would like to recover the space occupied by the deleted mailbo(es. &o this
is a 5ob eseutil /d.
*o prepare for eseutil /d, first dismount the store. *here is no need to stop the !nformation
&tore service, 5ust dismount the individual stores in the E(change &ystem Manager. e(t,
make sure that you have plenty of free disk space, at least as much as the priv.edb or
store.edb that you wish to defrag. avigate in the cmd window to the 2e(chsrver2bin folder
and issue a command such as this4
E(ample4 eseutil /d e42e(chsrvr2mdbdata2priv7.edb "#r other path to your store$
!f you really do not have enough free space try the Eseutil /d /t 8f42temp.edb8. -here the f
drive has enough free space. ,lways remember to remount the store once the defrag has
finished.
*ake a reading of the store si;e before and and after running eseutil /d.
Eseutil /r to repair Exchange 2003 log files
*ypical &cenario4 you have restored an E(change .//0 database but you cannot mount the
store. -hen you e(amine the event log, you see errors4 E&E !+ CDC - 1ecovery failed with
error -7.7E. :urther down in the ,pplication ?og you may see E&E %,9>F3 !+ D/C and !+
D/A.
+o not run /r 5ust for fun or merely to see what happens, eseutil /r is strictly an emergency
measure when all else fails to get the restored server working.
-hat can you do? 1eally, you should backup the E(change database as it is #-. *hen
*ry eseutil /r e// /i . ote the se@uence /r e// /i is correct. *his assumes that your first,
or base log is e// not some other number. !f you have a storage group with multiple
stores, ! am afraid that you have to dismount all stores before running the /r switch.
3erhaps this reminds you that all members of a storage group share the same transaction
log.
Eseutil /p "ill attempt to repair a corrupted store database
&cenario. Bou try to recover a store.edb database. However it fails, possibly because the
corresponding transaction logs are missing. :or e(ample, you may get an error4 )*he
database files in this storage are inconsistent). *o gather more information try eseutil /mh.
Bou determine that the state is inconsistent,
after backing up the current database, you try
eseutil /p. :ollow up with isinteg -fi(.
Summar
Eseutil is a powerful utility. !t has at least three separate 5obs, defragging stores, checking
the .edb database files, repairing corrupted priv7.edb files. My advice is to practice with the
/cc switch before you have to use the /r "repair$ switch on a live network.
!ull list of Eseutil switches
Eseutil /cc 3erforms a hard recovery after a database restore.
Eseutil /d 3erforms an offline compaction of a database.
Eseutil /g 6erifies the integrity of a database.
Eseutil /k 6erifies the checksums of a database.
Eseutil /m Generates formatted output of various database file types. e.g. /mh
Eseutil /p 1epairs a corrupted or damaged database.
Eseutil /r 3erforms soft recovery to bring a single database into a consistent or clean
shutdown state.
Eseutil /y 9opies a database, streaming file, or log file.