Freigeben über

Why Exchange Databases Might Remain Dirty After ESEUTIL /R Recovery

  • Artikel

You’re trying to recover your Exchange database from the “dirty shutdown” state to “clean shutdown.” You use ESEUTIL /R and after several ill-fated attempts the databases remain dirty. What’s happening? Danijel Klaric. a Microsoft Premier Field Engineer based in Germany, sheds some light on why the Exchange 2007/2010 databases might remain dirty after a seemingly “successful” ESEUTIL /R recovery, and provides pointers on how to solve this. Enjoy his article!

Normally I wouldn't think that this following topic would ever be a problem, but as I faced the issue two times in the last three weeks, I thought it would be good to shine some light on the subject.

Both customers are using Exchange 2010 with Native Data Protection, and have enabled a seven day lag on one of their database copies to enable their admins to recover items past the “single item recovery” period, or to recover deleted folder structures. Remember that single item recovery doesn't preserve the folder structure as mails moved to the dumpster are stored in a flat hierarchy.

The Symptom

They thought they were following appropriate Microsoft guidelines to use logs needed to recover the database from the “dirty shutdown” state to “clean shutdown”, so that the database would be usable as a recovery database for extracting the needed content.

1) Collect the database and the required logs

First grab a copy of the edb file and needed logs (i.e. logs needed from database perspective and logs they would like to roll forward to). This can be accomplished by suspending the database copy, and then copying the needed files to a separate location or create a snapshot of the volume which can be reverted to at a later time.

2) Check database state

Run the following: eseutil /mh "c:\DBRecovery\Mailbox Database 0436312751.edb"

eseutil /mh "c:\DBRecovery\Mailbox Database 0436312751.edb"

Check the database header for log files generation needed for the recovery, in this case: Log Required 124-124 (0x7c-0x7c) which means file E000000007C . These log files are needed at a minimum to recover the database to a clean shutdown without data loss.

Side note: If you try to recover the database with only “Log Required” logs and NOT “Log Commited” logs it will throw the following error:

Side note: If you try to recover the database with only “Log Required logs” and NOT “Log Commited” logs it will throw the error:

You can continue with the recovery using /a. And the last committed transaction will be removed from the database and the database will have a clean and consistent state. Otherwise just add the log files mentioned in the “log committed” field to your log directory and this error will disappear.

3) Check consistency of needed logs

Before starting to apply the logs you would like to, it´s important to check if all logs are consistent and available. If you need to handle a large number of logs and have used the Windows Explorer to copy the files, occasionally I’ve seen that some files are missing when sorting them in the Windows Explorer view.

To ensure that you will not fail afterwards when performing the recovery, take a moment and check these. Use eseutil /ml together with your log directory path and log prefix, in my example E00.

Log file check within directory: eseutil /ml c:\DBRecovery\E00

Log file check within directory: eseutil /ml c:\DBRecovery\E00

4) Recover database state to “clean shutdown”

After they finished both checks successfully, they started the recovery using:

eseutil /R E00 /l "c:\DBRecovery" /d "c:\DBRecovery\Mailbox Database 0436312751.edb"
eseutil /R E00 /l "c:\DBRecovery" /d "c:\DBRecovery\Mailbox Database 0436312751.edb"

It failed with an Error “-1216”. They did some Internet research and found that this could be fixed by using the “/i"

So their next try was:

eseutil /R E00 /l c:\DBRecovery /d "c:\DBRecovery\Mailbox Database 0436312751.edb" /i

eseutil /R E00 /l c:\DBRecovery /d "c:\DBRecovery\Mailbox Database 0436312751.edb" /i

And YES it results in “Operation completed successfully in 0.140 seconds.” Then they checked the Application event log and YES, there is no Error.

Application event log

Their last check before mounting the database was eseutil /mh "c:\DBRecovery\Mailbox Database 0436312751.edb."   After all that work - STILL a “dirty shutdown” Sad smile.

Note:

The get quick access to their data, they executed the eseutil command using /P for a repair to get the database into a clean shutdown. Microsoft strongly discourages using eseutil /P because it may lead to data loss. The /P should be a measure of extreme desperation when there’s no way at all to recover your database via /R.

Troubleshooting Steps – How did we solve it?

They showed me their eseutil command:

eseutil /R E00 /l "c:\DBRecovery" /d "c:\DBRecovery\Mailbox Database 0436312751.edb” /i

I saw three things I wouldn't expect to see:

  1. “/i” is a parameter for skipping missing log stream attached databases. In older versions of Exchange one log stream was used per storage group. As a storage group could have contained multiple databases, the “/i” option was provided when only one out of multiple databases has to be recovered.   As Exchange 2010 doesn’t use storage groups any more, this parameter shouldn’t be used any more.
  2. “/d” parameter with the fully qualified path to the EDB file.  You HAVE to use the directory path and NOT the full path to the edb file.
  3. They also didn’t specify a system path, so the actual path of the cmd prompt is used. This directory is used to check for, or to create, an E0x.chk file. I always recommend specifying the same path as the edb and log directory to keep the files together, and ensure that the files you expect to be used are the ones which are always used.

First, I asked them to remove the “/i” parameter and to try it again, they told me that this resulted in the previously mentioned error:  “-1216 (JET_errAttachedDatabaseMismatch)”.

Checking the EventLog after removing the “/i” parameter, it stated that the database file has not been found at path “C:\DBRecovery\Mailbox Database 0436312751.edb\Mailbox Database 0436312751.edb" which makes sense.

Checking the EventLog

After removing the file name and ending “\”, and optionally adding the system directory parameter to the command, we ran eseutil /R E00 /l “c:\DBRecovery” /s “c:\DBRecovery” /d “c:\DBRecovery”.   Running this modified command, everything worked as expected and the database ended up in a “clean shutdown” without any error message.

eseutil /R E00 /l “c:\DBRecovery” /s “c:\DBRecovery” /d “c:\DBRecovery”.

Note: If the database still stays in “dirty shutdown”, check the specified system directory for an e0x.chk file from your previous attempts. This checkpoint file can be safely removed for this recovery process if only logs that are needed for your recovery exist in the log directory. Following that, the command should complete successfully.

So why was this happening?

I was wondering why two different customers would make the “same” mistake using eseutil /r, so I started some Internet research and found sites providing examples using “eseutil /r /d” with the full path to the edb. This will simply not work.  Most of these mention that sometimes this will not work – and recommend using /p to perform a repair of the database. As mentioned, this shouldn’t be the recommended way as long as the edb file and the required logs exist and are available to be used.

Another possible misunderstanding would be that eseutil also incorporates another “MODES OF OPERATION” which use “/d” as a parameter –> Database defrag. So if you use “eseutil /d” to defrag a database you have to specify a complete file path.

Hope this helps. And after reading through this, just sit back and use the ESEUtil parameter which you should try out with your Exchange 2007/2010 server (without any risk):  “eseutil /ESE.”   And give them their credits providing such a solid database Smile.

Thanks goes to Alexandre Costa and James Cameron reviewing this content.

Posted by Frank Battiston , MSPFE Editor

Comments

  • Anonymous
    January 01, 2003
    Very Informative article on Exchange dirty shutdown which is a very common issue with Exchange server. Eseutil utility has innumerous commands to serve distinct need of the users. But if any case these inbuilt commands fails to bring in results then a third party tool always comes in use. Visit here: http://www.exchangerecover.com/recovery-tool-for-exchange.html

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Thank you, thank you, thank you

  • Anonymous
    January 01, 2003
    You can recover your deleted EDB file using EDB recovery tool from http://recoverydatatools.com/edb-to-pst-converter.html and convert EDB file to PST file format successfully. Read this post:http://edbtopstconvertertool.blogspot.com

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    It has been observed that in most of the corruption cases, ESEUTIL fails to repair the corrupt or damaged EDB file. It only works on those EDB files having minor corruption but for severe corruption, it is totally useless, even many Exchange MVPs say that. So, you can recover data from corrupt EDB file either by using the backup or by using any third party Exchange Recovery Software like Stellar Phoenix Mailbox Exchange Recovery (http://www.stellarinfo.com/edb-exchange-server-recovery.htm) . These third party recovery tools are capable enough to repair severely corrupt EDB files.

  • Anonymous
    January 01, 2003
    Great articles! Very informative !!! Thanks for clarifying, that was so ease to understand.

  • Anonymous
    January 01, 2003
    Great article! Easy to have customers follow the step by step instructions.

  • Anonymous
    January 01, 2003
    Try Exchange database recovery software and successfully recover edb files and convert in outlook pst format.
    For more information free download click http://exchangedatabase-recovery.blogspot.com

  • Anonymous
    January 01, 2003
    Very informative blog to exchange user, i have repaired exchange server edb files by an effective third party software,that provides instant solution. For more detail you can see -http://www.edbtopsttutorial.net/

  • Anonymous
    December 14, 2012
    Good one. Thanks for sharing this info.

  • Anonymous
    January 08, 2013
    Cool article Danijel. Also, I totally didn't know about the /ESE trick. Pretty cool & nerdy at the same time :D

  • Anonymous
    February 05, 2013
    Hi Daniel, very good write-up on this topic. I have encountered this scenarios several times. Thanks!

  • Anonymous
    March 14, 2013
    Wow!!!!  It is a very detailed description about how Exchange Server recovery can be possible, but in case if you need effective third party tool then you can go for Stellar Phoenix Exchange Server Recovery. I used it and it worked like a second life for my database.

  • Anonymous
    April 01, 2013
    awesome :-)... Nice one to read and understand...

  • Anonymous
    June 13, 2013
    Great Information for recovering Exchange database via ESEUTIL commands. However in case where Exchange Mailbox database is highly corrupted & Exchange server is even crashed then you can call for trusted Exchange Recovery solution ( www.pcvita.com/exchange-database-recovery.html ). ESEUTL will run only when Exchange server is live otherwise no way-out is left.

  • Anonymous
    July 12, 2013
    Lastly, I had a unusable .ost file which was not working due to sudden server crash. I needed to recover that .ost file because some crucial information was in that file. I had searched lots of tools over internet but enable to find best one.<br /> One of the user suggest me to use SysTools OST to PST converter software and i tried that many times and happily recovered all items of .OST file into PST file format.<br /> People can search this tool directly here: <a href="www.microsoftosttopstconversion.scanostfile.com/.../www.microsoftosttopstconversion.scanostfile.com </a>

  • Anonymous
    August 30, 2013
    It's really very informative article about Exchange server Recovery,If you want to know more about other option for Exchange Server Recovery, then I would like to suggest you for an professional Exchange server recovery tool like Kernel for Exchange Server recovery Tool. By using this effective software one can very easily repair EDB files of Exchange server without any hassle.

  • Anonymous
    November 22, 2013
    If we receive “-1216 (JET_errAttachedDatabaseMismatch)” best way to force them to replay the logs is mounting the database on Exchange server with required log files plus 15 - 20 log files in sequence. Just make sure you delete the Chk file before mounting it. Note : this is applicable only to Exchange 2007 and above. If we Still unable to mount its possibly page corruption which don't have other option than hard repair "eseutil /p"

  • Anonymous
    November 25, 2013
    Thanks .. it was really useful ..

  • Anonymous
    December 05, 2013
    Work with outlook conversion with the aid of ost to pst converter OST to PST Converter Toolbox works with ost and pst data Visit next resource www.osttopstconverter.convertertoolbox.com

  • Anonymous
    March 17, 2014
    I had been following the directions of the 'other' web sites that had the 'eseutil /r... .edb' and had the exact same problem you described. Your directions cleared things up. Thank you very, very much!

  • Anonymous
    March 29, 2014
    Thanks for sharing the useful information. Dirty shutdown is really a serious concern and sometimes leads to severe corruption in Exchange Server databases which can not be fixed via eseutil /r or eseutil /p utilities. In such situation, using a third party tool is a good option. One such popular application that helped us, can be downloaded from here: http://www.recover-computerdata.com/exchange-server-recovery.html

    A free trial version is also available on its official website !

    Wren

  • Anonymous
    April 11, 2014
    Informative Article. But if in case it becomes difficult to recover Exchange Mailboxes with inbuilt utilities then one can opt for GUI bases application through which it becomes easily possible recover Exchange mailbox database.

    For more info: https://sites.google.com/site/exchangeedbrecoverysoftware/

  • Anonymous
    April 19, 2014
    Excellent information...

    Could you please explain the usage of ESEUTIL /cc command while recovering a database from a online backup restore? I'm not so clear with respect to ESEUTIL /cc command as compared to ESUTIL / R and ESUTIL /p commands.

  • Anonymous
    July 24, 2014
    Tips are really useful !
    Found an another excellent solution to handle Exchange dityshutdown problem in Exchange server:http://rickytechblog.wordpress.com/2012/08/17/tips-to-fix-exchange-dirty-shutdown-state-in-exchange-server/

    Hope these step by step solution will work to those who are in need !

    Jack
    Exchange Admin

  • Anonymous
    October 16, 2014
    Eseutil is not useful in case of severe corruption of EDB file due to dirty shutdown. So, in that third party tools like Stellar Phoenix Mailbox Exchange Recovery , Kernel Exchange Recovery etc comes to the rescue. Third party exchange recovery tools are capable enough to repair any severely corrupt EDB file and restores the totally inaccessible mailboxes easily and swiftly. Find more info about the software athttp://www.stellarinfo.com/edb-exchange-server-recovery.htm

  • Anonymous
    November 23, 2014
    The best article I have ever seen. Actually it fixes my problem. Thanks.

  • Anonymous
    November 26, 2014
    i've got the same issue, my database remains in a dirty shutdown

    Eseutil /r e02 /d "E:MailboxUser Store 2User Store 2.edb" /a /i

  • Anonymous
    December 15, 2014
    Hi.....If this recovery solution doesn't work then try "Exchange Server Recovery Software". It will solve all queries related to "Exchange Server Recovery". Try its DEMO Version to test its capabilities.

    For more info visit: - http://www.outlookemails.net/recovery/edb/

  • Anonymous
    January 22, 2015
    Woow. You save us

  • Anonymous
    February 10, 2015
    I am facing the same problem, I have complete logs eseutil /r E00 command worked fine but still the Database is in the Dirty Shutdown

  • Anonymous
    February 16, 2015
    Great article. Very helpful.

  • Anonymous
    September 16, 2016
    In case of Exchange 2003 make sure you have Eseutil Hotfix installed! It took me days to find out why I couldn't recover edb to a clean shutdown state and only found the info about the Eseutil Hotfix when repair failed too (with a jcb.dll error):-> http://support.microsoft.com/kb/946111After hotfix was installed I run eseutil/r again and voila, eseutil/mh reports a clean shotdown state now.

  • Anonymous
    September 28, 2016
    Hi frank,thankyou for your explaination,for my case in Exchange Server 2013Sp1 after state showing Clean Shutdown, I try to stopped all exchange services,than rename Logs to Logs_Old,and move e00.chk file in .\Microsoft\Exchange Server\V15\Mailbox\Mailbox Database 1234567890.honestly no more than 30minutes the MailboxDatabase back to dirty shutdown after showing clean shutdown.so I cannot mounted the database, how to resolve this condition ?for alternatif solution,do you know how to reCreate Exchange database 2013?I mean leave existing *.edb on another drive,and create new MailboxDatabase,there is some scenario to rebuilt it?hope you can reply my headache topic :)

  • Anonymous
    February 23, 2017
    Thank you so much for this! Really saved my vegan bacon!

  • Anonymous
    July 15, 2017
    Use 3rd party Exchange Server Recovery utility easily repair corrupt EDB files and restores in Outlook PST format. Read more and free download this software click here : http://exchangeserverdatabaserecovery.blogspot.com

  • Anonymous
    November 26, 2017
    On Server 2008 R2, Exchange 2010 SP3 CU 14 I can confirm that eseutil /R E00 /l “c:\DBRecovery” /s “c:\DBRecovery” /d “c:\DBRecovery”doesn't work. I had to use:eseutil /R E00 /l c:\DBRecovery /s c:\DBRecovery /d c:\DBRecovery

    • Anonymous
      May 31, 2019
      Thanks MXMasterNL, I removed the quotes from the path as well to finally get this to work.

  • Anonymous
    January 03, 2018
    a Step by Step Solution for this problemhttp://www.icttoolbox.nl/info/recover-repair-exchange-databases-using-eseutil/

  • Anonymous
    July 21, 2018
    (The content was deleted per user request)

  • Anonymous
    October 18, 2018
    Thank you for sharing this informative post on Exchange dirty shutdown. Though, this blog is very helpful to fix this error. But I have found another blog too which also very helpful to accomplish your job.https://www.shoviv.com/blog/repair-exchange-2013-database-with-eseutil/Hope this blog will help you.

  • Anonymous
    December 28, 2018
    Thanks for Great Article to resolve issues regarding Dirty Shutdown, while working with Exchange face this issues, but resolved by using command mentioned in the above section. Also, find this ( https://systoolsgroup.com/exchange-recovery.html ) utility to fix corruption in Exchange Database file.

  • Anonymous
    January 03, 2019
    Nice article,I want to add more Informative information about on EDB to PST recovery.Read More: https://gust.com/accelerators/edb-to-pst-recovery-software-to-recover-edb-files-to-outlook-pst/

  • Anonymous
    May 30, 2019
    Thanks for this! I had additional issues but where I could not get the recovery to run again (Would complete in .94 seconds and remain "dirty." Since my paths do not ahve any spaces, I removed the "" aaround eacy path and voila! That worked and now my database is in a clean state (YAY).So here is what I ran:C:\Windows\system32>Eseutil /r e00 /l DRIVE:\Logs\LOGDIR /s DRIVE:\Mailbox\MAILBOXDBDIR /d DRIVE:\Mailbox\MAILBOXDBDIR

  • Anonymous
    June 16, 2019
    If we receive “-1216 (JET_errAttachedDatabaseMismatch)” best way to force them to replay the logs is mounting the database on Exchange server with required log files plus 15 – 20 log files in sequence. Just make sure you delete the Chk file before mounting it. http://drakor-ost.info