exchange not working

macdude

I installed the latest version of Symantec Endpoint and Mail Security for Exchange and I can't mount the Information Store. I get the error ID no: c104724 and I have tried the suggetions on Microsoft site and it still dont come up. I uinstalled the software and the problem still here. Please Help

hypnotoad

Reboot after uninstall? Check the event log for detailed error messages.

macdude

I rebootted the server. Side note is share point is not working either. I am more concred about exchagne right now. No errors in event log

sprkymrk

Sounds like you may need to call Symantec.

royal

do an eseutil /mh on the database. Dirty Shutdown or Clean Shutdown?

Example:
eseutil /mh "d:\database\db.edb"

What event id errors are there?

If the db shows it to be in an inconsistent database, it'll show what logs are missing. You'll have to find those missing logs and put them back into the log folder so the log file stream is consistent. You can then do a soft recovery (which happens either through eseutil /r or by trying to mount your db).

I would call Symantec/Microsoft for assistance as Exchange recovery can be very complicated and there's a lot to it. Most Exchange people I know even feel very uncomfortable. Before you do anything other than eseutil /mh, make sure you copy your database/logs to a separate location in case you need to retry things.

macdude

Called symnatec and they are not willing to touch it.
Trying to get in touch with my boss and our sr tech, but the are not being much help today.
Royal,

Which db should do that command on priv or pub? I am kinda of an exchang newb.

royal

The DB that isn't mounting.

Give MS a call. I'm too busy the today and the next couple days to really be much help.
Microsoft PSS - 1-800-936-4900

$250 to open a case

And just a side note, MS doesn't charge for server down issues from what I'm aware of.

hypnotoad

Did you uninstall IIS by any chance?

macdude

No I did not uinstall IIS. I will have to look at there sharepoint issue tommrrow.

I got exchange working. I did the eseutil command that royal suggested and it gave a 1032 error. Since we were looking at restoring from a tape, I decided to delete the logs files inside the mdbdata folder. AFter I did that exchange is working fine, couple of missing emails. Now to get AV on here.

royal

The technical reason why it worked is because you deleted all the logs and it started a fresh log stream and you only lost the data that wasn't written into the database while the database wasn't mounted. Doing the eseutil will show if the database is in an inconsistent state which means the database didn't shut down properly. During the dismount of a database, all remaining logs are written into the database which means the database comes into a clean shutdown state.

Apparently, something happened with the logs and the database didn't dismount properly and it went into an inconsistent state. The /mh command will tell you if it's in an inconsistent state. You can go into the log file folder and do an eseutil /ml e00 to see which log files are missing from the log stream. the /mh command will also show you which log files are making the database inconsistent.

Typically, you'd go to your backup source and find those logs, put them back in the log file folder, and do an eseutil /r to replay the logs to make the database into a clean shut down state and then mount the database.

Or you can restore and deal with the lost data since it'll restore everything from the time you last backed up. If you don't have a backup or can't find the files, you have a couple options. You can remove all the log files past the corrupt/missing logs, do the replay /r, and it'll mount.

Or you can do an eseutil /p as a last measure followed by an eseutil /d and then a isinteg -fix.

Removing all the log files like that really wasn't the best choice. But it's done with. Make sure a backup is taken of the database.

blargoe

DON'T install the Symantec Endpoint Protection Manager on any server that has a IIS Default Web Site that you care anything about. It will royally fubar it up. The client should be fine though.

Did you install the network threat protection too? I could see that causing the store not to mount if it was blocking communication with AD maybe.

Sharepoint, Exchange, on the same server?

When you get everything running again, I would strongly suggest for you to check out the Symantec forums for SEP11, there have been numerous weird issues that people have encountered with this product.

http://forums.symantec.com

macdude

Sharepoint and Exchange are on the same server. It is a SBS server. I have tried to talk my boss out of rolling out SEP11 because of issues like that. I have seen the fourms and we have had weird issues at other clients with it. But we still push it out.

HeroPsycho

Make sure you get the latest maintenance pack installed for SEP. Once you do that, the product seems to run fine. Also, with multiple Symantec AV products on the same box, be sure to disable Live Update for all but one of them, as running LU on either alone updates the definitions for both. Otherwise, your definitions are prone to get corrupted, rendering your AV products useless and often problematic.

Make sure you run SBS and Exchange Best Practices Analyzer and correct any issues identified. It would also be worthwhile to run the Sharepoint BPA and SQL one as well, although not related to this issue.

Also, next time when you have a DB problem like this, run ExTRA. It would have helped you figure out the problem, and given you guidance on how to recover with the least data loss.

http://www.microsoft.com/downloads/details.aspx?familyid=4bdc1d6b-de34-4f1c-aeba-fed1256caf9a&displaylang=en

Get that puppy installed, so it's ready next time!