Unable to create a new log file because the database cannot write to the log drive

Details

Explanation

This Warning event indicates that a new log file could not be created because the database cannot write to the log file drive.

The event may be logged if the drive is read-only, out of disk space, configured incorrectly, or corrupted. The cause depends on the error number in the Description section of the event.  The most common error codes for event 413 are listed below.

• Error -1032 = 0xfffffbf8 = 4294966264 = Jet_errFileAccessDenied = Cannot access file - the file is locked or in use. Another process has locked the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access.  A flat file backup system or antivirus software may be running against the Exchange store, the SRS database file directories, or the M drive.  This error can also occur if the permissions on the folder that contain the files for the information stores or the SRS are not sufficient for the databases to function properly.  The hardware device drivers may be out of date.

• Error -1811 = 0xfffff8ed = Jet_errFileNotFound = File not found. The log file may actually be missing or there may be other causes for this error.  For example, the current log file (such as E00.log) may have a mismatching signature between the log and the database. Another reason for error -1811 is that the Exchange database and log files may have been put on network storage, which is not supported. Also, the checkpoint file may be corrupt, or the log drive itself may have failed.  The current log file may have been seized and deleted by antivirus software running on the server. There have also been problems creating the temp log file for the storage group (such as e00tmp.log ).  The temp log file itself may become corrupted.

• Error -1022 = 0xfffffc02 = 4294966274 = Jet_errDiskIO = disk I/O error. The -1022 error is a generic error that appears whenever a disk I/O problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. The controller software or firmware may be out of date. Check the System log for I/O or drive errors near the time of the 413 event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure.

User Action

To resolve this warning, do one or more of the following:

• Check the integrity of the file system.

• Check the System log for related entries.

• Review and change the access permissions properties, and then note the disk space available.

• Review the disk and log file to which you are trying to write.

• For error -1811, ensure that the antivirus software is not running against the Exchange store, the Site Replication Service (SRS) database directories. Ensure that the log file drive has not run out of space.

• For error -1032, change the permissions on the folders that contain the information store files to the default permissions. Configure the flat file backup and antivirus software to not scan the Exchange store subdirectories. Use Exchange-aware online backup and antivirus software.

• For error -1022, ensure that the drive for the Exchange store files is accessible and that the path for the Exchange store files is specified correctly. If it is, run chkdsk /f /r. If the Chkdsk tool does not resolve the issue, examine the permissions on the Exchange Server folder structure. Ensure that System has full control of Exchange Server (install path for Exchange) and all subfolders on each partition that contains Exchange data. If you still cannot mount the databases, troubleshoot any file-level antivirus software running on the Exchange server.  Check the System log for I/O or drive errors near the time of the 413 event. Check and correct the path for the check file (such as E00.chk).

After correcting the root cause, if the database is inconsistent, restore from online backup. If there is no valid backup, you can restore the database to consistency using the hard repair (/p) functionality of the Eseutil utility, run isinteg -fix until all fixes are removed, mount the database, and then use Move Mailbox to move to a new, blank database. Before doing this, you should always back up all Exchange store files in a storage group (*.log files, *.edb files and *.stm files).

For information about ESE error -1022, see Microsoft Knowledge Base article 314917, Understanding and Analyzing -1018, -1019, and -1022 Exchange database errors.

For information about ESE error codes other than the ones explained in this topic, see the following Microsoft Knowledge Base articles:

• 266361, Extensible Storage Engine 98 Error Codes 0 to -1048

• 266367, Extensible Storage Engine 98 Error Codes -1051 to -999999.

For information about properly configuring your antivirus software, see the Microsoft Knowledge Base article 328841, Exchange and Antivirus Software.

For More Information

To search the Microsoft Knowledge Base articles based on criteria that generated this alert, visit the Search the Support Knowledge Base (KB) Web site.

To review Exchange 2007 event message articles that may not be represented by Exchange 2007 MOM alerts, see the Events and Errors Message Center.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.