Eseutil.exe Examples
This section contains examples of how you can use Eseutil.exe to match databases and log files as described earlier in this section.
Eseutil /mh
Use Eseutil /mh to examine the database header. You are looking for three particular lines:
DB Signature
Log Signature
Log Required
For example:
DB Signature: Create time:12/30/2002 16:51:49 Rand:606486607 Computer:
Log Signature: Create time:12/30/2002 17:01:27 Rand:607052340 Computer:
Log Required: 44-46
If a database has been disconnected normally, the Log Required value is 0-0, meaning that no soft recovery is required to start the database. In this example, the database was unexpectedly stopped, and logs 44, 45 and 46 are required for recovery.
The Log Required range is in decimal format, so you must convert the numbers to hexadecimal format to correlate them with actual log file names. In this case, the hexadecimal equivalents of 44, 45, and 46 are 2c, 2d, and 2e. Exchange therefore typically names the required logs Enn00002c.log, Enn00002d.log and Enn.log. When Enn.log is full, Exchange automatically renames it Enn00002e.log. You can verify this by examining the lGeneration line of the Enn.log header, which reads:
lGeneration: 46 (0x2E)
You know from the Log Required values shown that you must have at least these three log files to restart this database. If you use Eseutil /mk and read the header of the checkpoint file, you will see that the checkpoint is at log 44 (0x2c). The Log Required value acts as an internal checkpoint in the database file itself, listing not only the first log required for recovery, but also the last log.
If the Log Required line reads 0-0, you do not need any log files to restart the database. Nonetheless, you can play log files forward into the database, as long as you have the Enn.log to which the database was attached when last shut down. If you have this log file and subsequent log files, you can play forward as long as log files are available. To do this, there must be no checkpoint file, or the checkpoint must be at or before the lowest log required.
Note
There is no internal value in the database header that tells you which log files are required for replay when the database has been shut down cleanly because no log files are required. However, you may still want to play additional log files. The Last Consistent value in the database header lists the log file that was in use at the time the database was last running. You can start with this log file and play forward. In Exchange 5.5, if you made a guess about which log file to start with, you could damage the database by attempting replay. Starting with Exchange 2000 Server, additional safeguards prevent inappropriate log file replay without damaging the database.
Eseutil /ml
Eseutil.exe can detect mismatched or missing logs in a sequence without having to examine individual headers. The command Eseutil /ml Enn scans the current folder for all log files whose names begin with Enn and reports damaged logs, creation time/prev gen time mismatches, and missing log files. The example below shows typical output of this command, with each kind of error shown:
D:\exchsrvr\MDBDATA\log3\test>eseutil /ml e00
Microsoft(R) Exchange Server Database Utilities
Version 6.5
Copyright (C) Microsoft Corporation 1991-2000. All Rights Reserved.
Initiating FILE DUMP mode...
Verifying log files...
Base name: e00
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000001.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000002.log
ERROR: Log damaged (unusable). Last Lgpos: (0x2,1059,0). Error -501.
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000003.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000004.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000005.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000006.log
ERROR: Invalid log sequence. Previous generation time is [12/27/
2002 13:15:24], but expected [12/30/2002 17:03:33].
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000007.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000008.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000009.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E000000A.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E000000B.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E000000C.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E000000D.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E000000E.log - OK
Missing log file: e000000f.log
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000010.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E0000011.log - OK
Log file: D:\exchsrvr\MDBDATA\log3\test\E00.log - OK
Operation terminated with error -501 (JET_errLogFileCorrupt, Log file is corrupt) after 22.272 seconds.
If you are scanning a large number of log files, it may be helpful to redirect the output of the command to a text file for review. For example:
ESEUTIL /ML E00 > LOGCHECK.TXT