Unable to create a new log file because the database can't write to the log drive. Drive may be out of space or incorrectly configured

Details

Explanation

This Warning event indicates that a new log file could not be created because the database cannot write to the log file drive.

The event may be logged if the drive is read-only, is out of disk space, is configured incorrectly, or is corrupted. The cause depends on the error number in the Description section of the event. The most common error codes for event 413 are the following:

• Error -1032 = 0xfffffbf8 = 4294966264 = Jet_errFileAccessDenied = Cannot access file - the file is locked or in use: Another process has locked the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or antivirus software may be running against the Exchange store, against the SRS database file directories, or against the M drive. This error can also occur if the permissions on the folder that contain the files for the information stores or the SRS are insufficient for the databases to function properly. The hardware device drivers may be out of date.

• Error -1811 = 0xfffff8ed = Jet_errFileNotFound = File not found. The log file may actually be missing or there may be other causes for this error: For example, the current log file (for example, E00.log) may have mismatched signatures in the log and in the database. Another reason for the -1811 error is that the Microsoft database and log files may have been put on network storage. This is not supported. Also, the checkpoint file may be corrupted, or the log drive itself may have failed. The current log file may have been seized and deleted by antivirus software that’s running on the server. There may have also been problems trying to create the temp log file for the storage group (for example, e00tmp.log ). Finally, the temp log file itself may have become corrupted.

• Error -1022 = 0xfffffc02 = 4294966274 = Jet_errDiskIO = disk I/O error: The -1022 error is a generic error that appears whenever a disk I/O problem prevents Microsoft from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. The controller software or firmware may be out of date. Check the System log for I/O or drive errors near the time of the 413 event. This issue may occur because the path for the check file (for example, E00.chk) is not correct. This problem may be caused by a drive failure.

User Action

To resolve this problem, do one or more of the following:

• Check the integrity of the file system.

• Check the System log for related entries.

• Review and change the access permissions properties, and then note the available disk space.

• Review the disk and log file to which you are trying to write.

• For error -1811, make sure that the antivirus software is not running against the Microsoft store or against the Site Replication Service (SRS) database directories. Make sure that the log file drive has not run out of space.

• For error -1032, change the permissions on the folders that contain the information store files to the default permissions. Configure the flat file backup and antivirus software not to scan the Microsoft store subdirectories. Use Microsoft-aware online backup and antivirus software.

• For error -1022, make sure that the drive for the Microsoft store files is accessible and that the path for the Microsoft store files is specified correctly. If these conditions are met, run chkdsk /f /r. If the Chkdsk tool does not resolve the issue, examine the permissions on the Microsoft folder structure. Make sure that the system user has full control of Microsoft (installation path for Microsoft) and also of all subfolders on each partition that contains Microsoft data. If you still can’t mount the databases, troubleshoot any file-level antivirus software that’s running on the server that’s running Microsoft. Check the System log for I/O or drive errors near the time of the 413 event. Check and correct the path for the check file (such as E00.chk).

After correcting the root cause, if the database is inconsistent, restore it from an online backup. If no valid backup is available, you can restore the database to consistency by doing the following: run the hard repair (/p) functionality in the Eseutil utility, run the isinteg –fix command until all fixes are removed, mount the database, and then run the move Mailbox to move to a new, blank database. However, before you do this, make sure that you back up all Microsoft store files in a storage group. This includes *.log, *.edb, and *.stm files.

For more information about the -1022 ESE error, see Microsoft Knowledge Base article 314917, Understanding and Analyzing -1018, -1019, and -1022 Exchange database errors.

For information about ESE error codes other than the codes described in this topic, see the following Microsoft Knowledge Base articles:

• 266361, Extensible Storage Engine 98 Error Codes 0 to -1048

• 266367, Extensible Storage Engine 98 Error Codes -1051 to -999999.

For information about how to configure your antivirus software correctly, see Exchange 2010 Security Guide

For More Information

If you are not already doing so, consider running the Exchange tools, which have been created to help you analyze and troubleshoot your Exchange environment. These tools can help make sure that your configuration aligns with Microsoft best practices. They can also help you identify and resolve performance issues and improve mail flow. To run these tools, go to the Toolbox node of the Exchange Management Console. To learn more about these tools, see Managing Tools in the Toolbox.