RE: Exchange 2003 Crisis
Good news - ESEUtil didn't find any errors. One article I read said ISInteg is the only repair utility that understands the Exchange database as an Exchange Database. ... ESEUtil looks into the database as just another ESE database, and can see their tables and indexes. ESEUtil just fixes the database tables. ... ISInteg is aware of relation between database tables and records that turn them into folders and messages. So, it sounds like ISInteg might do a better job of checking for corruption. Is that true? Would there be any value in running it? If I did, could I run it without -fix and have it just test without changing anything? There are a ton of different tests. Is there one or two that tests pretty much everything? Thanks again for all your help. Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Monday, June 13, 2011 4:12 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis To do any testing you would dismount the store and use eseutil. On Mon, Jun 13, 2011 at 3:30 PM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Is there a way to test for a corrupt info store or can I just assume since there aren't any unusual messages in the logs that the info store is OK? Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Monday, June 13, 2011 10:13 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren't new. It's been happening for years. They are always in the early AM - perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn't anything out of the ordinary in the logs - certainly nothing really scary like your Your IS is corrupt or even an IS error was detected and resolved. Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he
RE: Exchange 2003 Crisis
Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren't new. It's been happening for years. They are always in the early AM - perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn't anything out of the ordinary in the logs - certainly nothing really scary like your Your IS is corrupt or even an IS error was detected and resolved. Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: Exchange 2003 Crisis
Thanks for your response. I've unbound the sinks and unregistered the AV and the problem has not reoccurred. Of course - I don't want to run that way. GFI/Sunbelt wants me to turn on a crash dump debugger and wait for the system to crash. I hate to do that since I lose all incoming mail when it crashes and the senders aren't even getting notice that their message was not delivered. It may be my only option but I thought if I could rule out a corrupt IS first, then I might be able to avoid the pain of lost messages. See my previous reply - the only entry that is somewhat new is the calendar entry error (See my previous reply) Yes, deleted items retention is turned on and I can have him check that although, if the message just disappeared then I doubt it would be there. I would be inclined to blame it on user error but this guy is actually pretty good and things disappeared on him twice so that is why I'm questioning the integrity of my IS. Curt From: gswe...@acts360.com [mailto:gswe...@acts360.com] Sent: Sunday, June 12, 2011 11:22 AM To: MS-Exchange Admin Issues Subject: RE: Exchange 2003 Crisis Are you unbinding the sink? If you unbind do your problems go away? Don't forget to unbind the smtp and AV scanner. Do you have any IS store errors? Do you have Deleted Item Retention turned on? Go to his folder that the files were missing and see if you can do a Deleted Item Recovery on it. Greg Sweers CEO ACTS360.com http://www.acts360.com/ P.O. Box 1193 Brandon, FL 33509 813-657-0849 Office 813-758-6850 Cell 813-341-1270 Fax From: Jim Dandy [mailto:jda...@asmail.ucdavis.edu] Sent: Sunday, June 12, 2011 2:14 AM To: MS-Exchange Admin Issues Subject: Exchange 2003 Crisis Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: Exchange 2003 Crisis
The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.eduwrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren’t new. It’s been happening for years. They are always in the early AM – perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn’t anything out of the ordinary in the logs – certainly nothing really scary like your “Your IS is corrupt” or even “an IS error was detected and resolved.” Curt *From:* Todd Lemmiksoo [mailto:tlemmik...@gmail.com] *Sent:* Sunday, June 12, 2011 8:15 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy’s claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: Exchange 2003 Crisis
Is there a way to test for a corrupt info store or can I just assume since there aren't any unusual messages in the logs that the info store is OK? Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Monday, June 13, 2011 10:13 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren't new. It's been happening for years. They are always in the early AM - perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn't anything out of the ordinary in the logs - certainly nothing really scary like your Your IS is corrupt or even an IS error was detected and resolved. Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com
Re: Exchange 2003 Crisis
To do any testing you would dismount the store and use eseutil. On Mon, Jun 13, 2011 at 3:30 PM, Jim Dandy jda...@asmail.ucdavis.eduwrote: Is there a way to test for a corrupt info store or can I just assume since there aren’t any unusual messages in the logs that the info store is OK? Curt *From:* Todd Lemmiksoo [mailto:tlemmik...@gmail.com] *Sent:* Monday, June 13, 2011 10:13 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren’t new. It’s been happening for years. They are always in the early AM – perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn’t anything out of the ordinary in the logs – certainly nothing really scary like your “Your IS is corrupt” or even “an IS error was detected and resolved.” Curt *From:* Todd Lemmiksoo [mailto:tlemmik...@gmail.com] *Sent:* Sunday, June 12, 2011 8:15 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy’s claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http
Re: Exchange 2003 Crisis
Can you run eseutil /mh against a mounted store? - Sean On Mon, Jun 13, 2011 at 3:12 PM, Todd Lemmiksoo tlemmik...@gmail.comwrote: To do any testing you would dismount the store and use eseutil. On Mon, Jun 13, 2011 at 3:30 PM, Jim Dandy jda...@asmail.ucdavis.eduwrote: Is there a way to test for a corrupt info store or can I just assume since there aren’t any unusual messages in the logs that the info store is OK? Curt *From:* Todd Lemmiksoo [mailto:tlemmik...@gmail.com] *Sent:* Monday, June 13, 2011 10:13 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren’t new. It’s been happening for years. They are always in the early AM – perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn’t anything out of the ordinary in the logs – certainly nothing really scary like your “Your IS is corrupt” or even “an IS error was detected and resolved.” Curt *From:* Todd Lemmiksoo [mailto:tlemmik...@gmail.com] *Sent:* Sunday, June 12, 2011 8:15 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy’s claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send
Re: Exchange 2003 Crisis
I wouldn't run any tool against a mounted store. John W. Cook Systems Administrator Partnership for Strong Families From: Sean Martin seanmarti...@gmail.com To: MS-Exchange Admin Issues exchangelist@lyris.sunbelt-software.com Sent: Mon Jun 13 19:15:18 2011 Subject: Re: Exchange 2003 Crisis Can you run eseutil /mh against a mounted store? - Sean On Mon, Jun 13, 2011 at 3:12 PM, Todd Lemmiksoo tlemmik...@gmail.commailto:tlemmik...@gmail.com wrote: To do any testing you would dismount the store and use eseutil. On Mon, Jun 13, 2011 at 3:30 PM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Is there a way to test for a corrupt info store or can I just assume since there aren’t any unusual messages in the logs that the info store is OK? Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.commailto:tlemmik...@gmail.com] Sent: Monday, June 13, 2011 10:13 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren’t new. It’s been happening for years. They are always in the early AM – perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edumailto:myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edumailto:myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn’t anything out of the ordinary in the logs – certainly nothing really scary like your “Your IS is corrupt” or even “an IS error was detected and resolved.” Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.commailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy’s claims seem possible that messages are just disappearing? Details Exchange Server
RE: Exchange 2003 Crisis
Go ahead. It’ll just fail. Exchange 2003 locks exclusively everything in use. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: John Cook [mailto:john.c...@pfsf.org] Sent: Monday, June 13, 2011 7:33 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis I wouldn't run any tool against a mounted store. John W. Cook Systems Administrator Partnership for Strong Families From: Sean Martin seanmarti...@gmail.com To: MS-Exchange Admin Issues exchangelist@lyris.sunbelt-software.com Sent: Mon Jun 13 19:15:18 2011 Subject: Re: Exchange 2003 Crisis Can you run eseutil /mh against a mounted store? - Sean On Mon, Jun 13, 2011 at 3:12 PM, Todd Lemmiksoo tlemmik...@gmail.commailto:tlemmik...@gmail.com wrote: To do any testing you would dismount the store and use eseutil. On Mon, Jun 13, 2011 at 3:30 PM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Is there a way to test for a corrupt info store or can I just assume since there aren’t any unusual messages in the logs that the info store is OK? Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.commailto:tlemmik...@gmail.com] Sent: Monday, June 13, 2011 10:13 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis The 8000 messages are for a bad appointment in his calendar. He needs to delete (remove) the appointment and re-enter it. It will cause more problems the long it is in his calendar. The ESE messages are informational, and appear then Exchange maintenance runs. On Mon, Jun 13, 2011 at 11:23 AM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Thanks for your response back Here are some event log entries that may be of interest There are a bunch of these. Although they may be more frequent, they aren’t new. It’s been happening for years. They are always in the early AM – perhaps backup related? Source: ESE Category: General Event ID: 101 Description: ESEUTIL (6048) The database engine stopped. Source: ESE Category: General Event ID: 100 Description: ESEUTIL (5372) The database engine 6.05.7638.0002 started. These have occurred in the past but not frequently. He uses an iPhone. I suppose it could have something to do with it. My concern is that these might be generated if the IS is corrupted and looses the time of an appointment? Source: EXCDO Category: General EventID: 8206 Description: Calendaring agent failed with error code 0x80040229 while saving appointment. Source: EXCDO Category: General EventID: 8239 Description: An appointment with the subject Working Group Mtg. was saved to mailbox myu...@ucdavis.edumailto:myu...@ucdavis.edu. The start time is missing, so the calendaring agent cannot publish the free/busy information for this appointment. To correct this, please delete the appointment and recreate it. Source: EXCDO Category: General EventID: 8241 Description: An existing appointment with the subject Working Group Mtg. in mailbox myu...@ucdavis.edumailto:myu...@ucdavis.edu was modified. The start time, or both the duration and end time of the existing appointment were missing. Other than that, there isn’t anything out of the ordinary in the logs – certainly nothing really scary like your “Your IS is corrupt” or even “an IS error was detected and resolved.” Curt From: Todd Lemmiksoo [mailto:tlemmik...@gmail.commailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message
Exchange 2003 Crisis
Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Re: Exchange 2003 Crisis
before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.eduwrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I’m using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I’ll just say the info store wasn’t working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I’ve had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy’s claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: Exchange 2003 Crisis
Looks like your AV is the reason From: Todd Lemmiksoo [mailto:tlemmik...@gmail.com] Sent: Sunday, June 12, 2011 8:15 PM To: MS-Exchange Admin Issues Subject: Re: Exchange 2003 Crisis before trying to do anything ...is the store still mounded, look in event log for Information store messages. Then post back On Sun, Jun 12, 2011 at 1:13 AM, Jim Dandy jda...@asmail.ucdavis.edumailto:jda...@asmail.ucdavis.edu wrote: Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist -- T. Todd Lemmiksoo --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: Exchange 2003 Crisis
Are you unbinding the sink? If you unbind do your problems go away? Don't forget to unbind the smtp and AV scanner. Do you have any IS store errors? Do you have Deleted Item Retention turned on? Go to his folder that the files were missing and see if you can do a Deleted Item Recovery on it. Greg Sweers CEO ACTS360.comhttp://www.acts360.com/ P.O. Box 1193 Brandon, FL 33509 813-657-0849 Office 813-758-6850 Cell 813-341-1270 Fax From: Jim Dandy [mailto:jda...@asmail.ucdavis.edu] Sent: Sunday, June 12, 2011 2:14 AM To: MS-Exchange Admin Issues Subject: Exchange 2003 Crisis Thursday morning I came to work and my exchange server was not receiving mail. The antivirus engine had stopped and after that the event log registered thousands of entries that the Ninja VSAPI had refused Microsoft Exchange InfoStore request to scan a message because the Ninja Store Scanner is down. (I'm using Vipre E-mail Security for antivirus/antispam). No other unusual entries were found in the event log. I rebooted the server and it took a really long time to shut down. When it came back up the Ninja Store scanner service was not started but I was able to start it manually. Without going into a lot more detail I'll just say the info store wasn't working right. Subsequent attempts to stop the IS service failed. I disabled Vipre, rebooted again and everything resumed normal function (except no antivirus/antispam). I updated Vipre and reenabled its services. The following morning the server had crashed in the same way. When it crashes messages are not delivered to inboxes and the sender does not get an NDR. Since then I've had a user claim that he tried to move some messages from one folder to another and they disappeared. Later he told me that he had an important message in his inbox and when he tried to open it, it disappeared. So, the questions I have are 1) Could a corrupt info store cause the av scanner to fail like this? If so, how can I check for/repair the store? 2) Does this guy's claims seem possible that messages are just disappearing? Details Exchange Server 2003 with both front and backend servers. Vipre E-mail security latest version. Thanks for your help. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
