It becomes quite difficult to handle the Exchange server corrupt database files. The major cause of this difficulty is lack of awareness about a free tool to repair corrupt Exchange mailbox database i.e., ESEUTIL. Here, in this technical article I am going to tell my readers brief about this tool. It will be helping an administrator to tackle with corruption in the Exchange server.
ESEUTIL is the Exchange server utility, provided by Microsoft since 4.0 version. It was developed with variety of aims like fixing corrupt Exchange database files, reducing their size, fragmenting them, and examining their integrity. There are one or the other reasons due to which users may face problem in the server. No matter what is the cause but, when users try to manage database they might encounter error messages like edb file is severely damaged, unable to mount edb file, edb file is highly corrupted, etc. Such situations causes a sudden breakdown, resulting in calling of Dirty Shutdown. These type of problem may also occur when users are recovering the Exchange backup file. To overcome from all these problems, the first approach should run and use ESEUTIL utility.
Now a question arises that ‘How to run ESEUTIL (Exchange Extensible Storage Engine Utilities) tool in Exchange 2016 / 2013 / 2010 / 2007 / 2003 and below?
Not only one but, there are many administrators / users who are asking queries like this. So, here is the answer for all those users. Lets Begin!!
After completion of the Exchange installation, a database file automatically gets created on its default location i.e.,
C:\Program Files\Microsoft\Exchange Server\V15\Mailbox\database_name
At this path, open the database file to view list of following files stored within it :
- Mailbox Database.edb: This represents the Exchange server database file. If required then, you can customize the file name and locate file at some another location. This customization can be performed by executing cmdlets in the Exchange Management Shell.
- E00.log: All the transactions made in the server are stored in this log file. For example : Creation of a new directory or message comes under transaction and is recorded in log file.
- E000000001F.log, E000000001E.log: Archive transactions are stored in this file, which are accepted and implemented in the database. These file type prove themselves useful at the time of data recovery.
- E00.chk: This is termed as a checkpoint file in the Exchange sever. It is used to hold the connection between information of the database and logs.
- E00res00001.jrs, E00res00002.jrs: The files are created with archive transaction logs. When the disk space gets full, these files are taken into consideration.
- E00tmp.log: When a new log file is created, this file originates to act like a temporary file.
Interesting Fact: The activities processed by the Exchange gets automatically recorded in its log file i.e., E00.log. If the size of this file exceeds its limit (i.e., 1024KB) then, second file is created by the server itself. The name of this newly created file is in this pattern – ‘originalname’ ‘hexadecimal value’.
In case of any physical server damage, users will be able to the retrieve entire data. It is just because of the smart database mechanism rendered by the Exchange server. Log files also plays a very vital role to start procedure from were it was interrupted. Well, some conditions arises where the server is unable to determine the previous state due to which administrator help is needed.
Table of Contents
Location and Switches of ESEUTIL Utility
In the Exchange 2016 and 2013 program, this program is available at the following location :
C:\Program Files\Microsoft\Exchange Server\V15\Bin
The path is almost similar in all versions of the Exchange server. Talking about switches then, the tool is having a wide range for helping its users :
- ESEUTIL /R : Function to restore database
- ESEUTIL /G : Command to check database integrity
- ESEUTIL /D : Cmdlet to defragment the database file
- ESEUTIL /P : Option to repair Exchange server corrupt database
- ESEUTIL /K : Functionality to examine database checksums
- ESEUTIL /Y : Copy the database and log files in effective manner
- ESEUTIL /C : Option to perform the hard recovery of database
- ESEUTIL /M : Show the header of database file, log as well as checkpoint files
Perform Different Functionalities with ESEUTIL Tool
Note: Create a backup file of Exchange database files and log files, before working with ESEUTIL utility.
Functionality #1: Read headers using ESEUTIL
Execute following command to view the header part of database file: ESEUTIL /MH ‘database_name’
Note: Database should be in the offline mode
Once the command gets executed successfully, following attributes will be listed :
- Clean Shutdown: This is a database state that gives information that there is no relation between information of the database and log files.
- DB Signature: It indicates the digital signature of Exchange database
- Log Signature: This attribute denotes the last signature of the log
- Log Required: The log files needed to start the database are displayed through this attribute. If its displayed value is 0-0 then, it means that all is going fine and there is no file needed.
Apart from database files, there are many other files available in the Exchange database. Now I will tell you command to view header part of the left files.
ESEUTIL /ML E00.log
Execute above given command for task accomplishment. Following screenshot shows the result of the cmdlet execution:
- Igeneration number: This attribute indicates the log number in consecutive manner, used for future reference.
- Signature: This header parameter is same as that of the database file. This means that the log file is the part of the previous Exchange database.
It is possible to determine log sequence and its state with help of following cmdlet: ESEUTIL /ML E00
You will find that the sequence comprises of two logs i.e., E00.log and E000000001B.log. This is providing a security based information that the files are not going to generate any problem at this time.
Now comes the last and crucial file of the Exchange i.e., checkpoint file E00.chk. Execute following command: ESEUTIL /MK E00.chk
Here, you will find the last checkpoint i.e., the file, which has already being appended to the database. In provided screenshot, it is 1C that indicates E00.log file that is shown with E000000001C.log name. The last thing of the header part i.e., Signature is also displayed on black screen. It is pointing out towards the log file that is corresponding to the E00.chk file.
Functionality #2: Database Defragmentation Using ESEUTIL
The reorganization of database for reducing fragmentation level and generate new database is known as defragmentation. It will contribute in improving the server performance as well as the reading speed.
Recent Exchange versions does not recommend utilization of defragmentation. It helps in eliminating white spaces that are available spaces with the database filled with information in one or the other way. But, there are few conditions that arises need for defragmentation:
- Absence of storage space for the new database
- Decrease in free space of the disk with database
To determine the available free space amount, execute ‘Get-MailboxDatabase -Status | ft name,databasesize,availablenewmailboxspace’ command.
The provided screenshot is result of command execution. Clearly, it is understood that total size of the database is 247.9 MB and free space left is only 83.81 MB. In this case, defragmentation will be helping in regaining those 83 MB. For this, go through following set of instructions:
-
- Execute following command to dismount the database : Dismount-Database –Identity ‘database_name’
- Remember that for defragmentation, you have to free up space when temporary database is created. Following formula can be used to calculate this: (DatabaseSize – AvailableNewMailboxSpace) x 1.1
- Run ESEUTIL command with two switches i.e., /d and /t
ESEUTIL /D ‘database_name’ /T ‘UNC_path’
-
- Mount the database, which you have dismounted in Step (1) by executing ‘Mount-Database –Identity ‘database_name’ command.
Functionality #3: Use ESEUTIL Tool for Repairing Database
After execution of command to view header message of the database, a State attribute is available. If the situation mentioned for this attribute is Dirty shutdown then, it means that some thing is missing.
You can also see that Log Required header is needing some log files. The range mentioned is from 23 to 27 stating that E0000000017.log to E000000001B.log files are absent. This is the reason why dirty shutdown occurs. To resolve dirty shutdown problem, you will have to perform recovery in the Exchange server with help of ESEUTIL commands.
1. Soft Recovery via ESEUTIL tool: To retrieve back the lost files, the process is easy. What you just need to do is execute following cmdlet :
ESEUTIL /r ‘log_prefix’ /l ‘path_to_the_folder_with_log_files’ /d ‘path_to_the_folder_with_the_database’
The missing logs get restored after successful execution of cmdlet.
Once again check the state of database one more time and if the state is Clean then, it means that missing files are recovered.
2. Hard Recovery through ESEUTIL utility: It is strongly recommended to end users that implementing these type of recovery procedures might cause data loss. Therefore, use this hard recovery only when last resort is left without any alternative.
The hard recovery procedure involves 3 steps :
- Use ESEUTIL and /p switch to repair database
- Through /D switch, perform defragmentation of the database and reconstruct it
- Perform index repairing in database via Islnteg tool
Also Read : How to Find Inactive Exchange Server
Time to Sum Up
It is hard to extract lost files, if proper knowledge of ESEUTIL tool is unknown. To have an easy solution for recovering hard deleted data, users can opt for Export EDB to PST tool. It supports severely corrupted EDB file and performs a deep scanning on it. At the end of the day, it is all users choice want they want to leverage for their comfort and reliability.
