ESE 455 -1811 (0xfffff8ed): Missing Current (Exx.log) Transaction Log File

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2008-01-18

The Microsoft Exchange Database Troubleshooter Tool detected one or more ESE 455 events with error code -1811 (0xfffff8ed) in the Application log. This event indicates that the current transaction log (exx.log) is missing, inaccessible, or has a mismatched signature.

Explanation

The error may be caused by the following:

  • Error 1811 that corresponds to JET_errFileNotFound. This issue may occur in an Exchange log file that has a mismatching signature and an internal log generation number (LGeneration). Typically, the Exchange log file is the E00.log file. If the E00.log file has a mismatched signature, the information store might not mount even if the database is consistent.

  • An antivirus program quarantines or deletes the current Exchange log file.

  • The eseutil /p repair command was run on the affected databases and the log files were not removed.

  • The eseutil /r recovery command was run with an incorrect log file base name, as in the example, eseutil /r Exx.log, where Exx.log is a three-character log file base name.

This error can also be identified as error -1811, JET_errFileNotFound. This error applies to the following versions of Exchange server:

  • Microsoft Exchange Server 2007

  • Microsoft Exchange Server 2003

  • Microsoft Exchange 2000 Server

User Action

To resolve the error, do one or more of the following:

  • If the log file has a mismatched signature and log generation number, contact Microsoft Customer Support Services. For more information, visit the Contact Us page of the Microsoft Help and Support Web site.

  • If an antivirus program quarantines or deletes the current Exchange log file, follow these steps:

    • Examine the configuration of the antivirus program.

    • Make sure that the antivirus program is not configured to scan the Exchange Server directories.

    • By default, some antivirus programs are set to scan drives and directories weekly in a manual mode or in an automatic mode. This setting may be easily overlooked. Make sure that you add the Exchange Server directories to the excluded locations for the antivirus program. For more information about how to configure antivirus programs to work together with Exchange, see Microsoft Knowledge Base article 823166, Overview of Exchange Server 2003 and antivirus software.

    • Review the antivirus program log files to verify that the Exchange log file was quarantined or deleted.

    Use one of the following methods to recover the Exchange log file:

Method 1: If the Exchange log file was quarantined

  1. Recover the Exchange log to the folder that contains your production log files.

  2. Start the Microsoft Exchange Information Store service. If no other log files are missing, the database mounts. If other log files are missing, see whether the missing log files are located in the quarantine folder of the antivirus program. If the log files are not located in the quarantine folder, see Method 2.

If the Exchange log file was deleted, you must restore the storage group database from a backup. Then, you must replay the log files. To restore an available database, follow these steps:

Method 2: If the Exchange log file was deleted

  1. Move all inconsistent databases to a backup folder.

  2. If a new E00.log file was created, move the new E00.log file to the backup folder. Additionally, move the E00.chk file to the backup folder.

  3. Copy all existing log files to the backup folder.

    Note

    You must copy the log files. Do not move the log files.

  4. Rename the last E00*.log file to E00.log.

  5. Restore the database from a backup. Then, replay the log files. This brings the database to a consistent state. However, the database does not include the E00.log file that was copied to the backup folder. Although there is some data loss, you now have a database that can be mounted.

    Note

    If you cannot restore the database from a backup, run repair utilities against the database to bring the database to a consistent state

  6. Start the Microsoft Exchange Information Store service.

If the eseutil /p repair command was run on the affected databases and the log files were not removed, follow these steps:

To determine whether the eseutil /p command was run

  1. Click Start, click Run, type cmd, and then click OK.

  2. Type the following at the command prompt:

    c:\program files\exchsrvr\bin\eseutil /mh "c:\program files\exchsrvr\mdbdata\<name of Exchange database.edb>"
    

    This syntax earlier assumes the following:

    • The Exchange Server program files were installed in the c:\program files\exchsrvr folder.

    • Your database is in the c:\program files\exchsrvr\mdbdata folder.

  3. Read the repair count attribute. If the repair count attribute is 0 (zero), the eseutil /p command was not run. If the repair count attribute is a number other than 0, the eseutil /p command was run on the database.

If the public and private databases are in a consistent or clean shutdown state, you can move the transaction log files to another folder. To determine whether the databases are in a consistent or clean shutdown state, follow these steps:

To determine whether the databases are in a consistent or clean shutdown state

  1. Click Start, click Run, type cmd, and then click OK.

  2. To examine the private information store, type the following:

    c:\program files\exchsrvr\bin\eseutil /mh "drive:\program files\exchsrvr\mdbdata\priv1.edb"
    
  3. To examine the public information store, type the following:

    c:\program files\exchsrvr\bin\eseutil /mh "drive:\program files\exchsrvr\mdbdata\pub1.edb"
    

    The syntax in steps 2 and 3 assume the following:

    • The Exchange Server program files were installed in the c:\program files\exchsrvr folder.

    • Your database is in the c:\program files\exchsrvr\mdbdata folder.

  4. Review the results of the consistency check. If a database is consistent (state = clean shutdown), all the log files have been committed to the information store. If the database is not consistent (state = dirty shutdown), the database may not be corrupted. The log files may not have been committed to the database yet.

  5. If the state reports clean shutdown, move all log files from all the mdbdata directories to a backup folder.

  6. Mount the databases.

If the eseutil /r recovery command was run with an incorrect log file base name, use the correct switch to successfully run the command. The common logfile base names are e00, e01, e02 and e03. For example, the following command contains a correct logfile base name:

eseutil /r e00

If the problem persists, contact Microsoft Customer Support Services. For more information, visit the Contact Us page of Microsoft Help and Support Web site.