HELP - Problem with Exchange 5.5 and edb.log

Japseye

Hi,
Just wondering has anyone come on this problem. Was at an exchange server today 5.5, It has Norton AV loaded on it. The information store went down at around 1ish. Checked the Event logs and saw that norton had supposedly detected the netsky virus in the edb.log.

The cure failed and instead norton deleted the file. Now the info store service won't start. Did all the usual stuff like rebooting etc, still no good. Tried retrieving that file from backup but that didnt sort it either. Decided to run the eseutil /p on the priv.edb as there is nothing else I could think of. But this could take forever as its a 40gb database file. Anyone come across this kind of issue and how was it resolved?

Thanks
:cool:

Capt'n Midnight

You are running the enterprise version, am more familiar with the std one.

what are the Event ID's for the store when it tires to start and when Norton upset things. (you'd think that in this day and age AV products would be configured not to scan mission ciritical dB files especially when they aren't repairable and the company also makes a seperate product for scanning those dB's )

Hate when you find your question with no answer..
http://www.experts-exchange.com/Networking/Email_Groupware/Exchange_Server/emailFriend.jsp?qid=20932548

Hope this helps
http://www.jsiinc.com/SUBD/tip1700/rh1780.htm

f your Exchange information store will not start, or stops responding, and you receive:

Event ID: 145
Source: ESE97
Category: General
Description: MSExchangeIS ((%pid%) ) The database engine could not access the file called %database path%\edb.log.

where the file listed may be any file in the database directory, then some program/process has the file locked.

To determine if it is really locked:

copy <database path>\edb.log %TEMP%

If you are greeted with:

The process cannot access the file because it is being used by another process.

then the file is locked.

Common causes are ant-virus or backup software. Configure these to ignore the Exchsrvr\Mdbdata or Exchsrvr\Dsadata directories.

How big was the edb.log ?
Do you know if circular logging was enabled ?

http://support.microsoft.com/default.aspx?scid=kb;EN-US;128325
exchange 4.0 - rough guide to what you can and can't do with the edb.log

Try rest2514 or other file recover util in case the transaction log is recoverable.,

Japseye

Got eventId's 1120 and 5000, saying that the info store database was inconsistent. Saw that Experts -Exchange post too, that site drives me crazy cos people always seem to post the exact question i want to ask . Anyway, the edb log file is 5mbs .
I think the AV should have been setup originally to exclude the scanning of those log files aswell as the priv.edb and the pub.edb.
Running the eseuilt /p on it tonight so kinda prating that it will all be sorted by the morning, otherwise im looking straight at a day from hell!

Thanks for your help Midnight

Capt'n Midnight

if you get it up and running then run Exmerge on it, the ability to extract all the users emails into PST files is the only reason I'd consider using Exchange at all...