When you setup your Exchange server and create a DAG, you think that all is well. But what happens when your Exchange Databases in DAG become corrupt?
Adding “Exchange trusted subsystem ” in Security Tab
There are two possible scenarios for corruption, they are:
- Physical Corruption of the Exchange Database
- Logical Corruption of the Exchange Database
Let us take a look at each one and what they mean:
Physical Corruption of the Exchange Database
This can happen when the ESE Structure is no longer valid. For Example, your Exchange databases are in a dirty shutdown state due to physical hardware failure or sudden reboots of your server.
What is a dirty shutdown of an Exchange database you may ask? Information is loaded into the cache memory but isn’t committed to the exchange database. The result is that the exchange database is flagged as “Dirty” by the Jet Engine. Until such time when all the dirty transactions are not are not resolved, the exchange database is considered inconsistent.
To fix an Exchange database in a dirty shutdown state you can try and repair the database using the tool ESEUTIL with the /k switch
Firstly you need to check if the Exchange database is in a clean shutdown state or a dirty shutdown state, you can do this running the command ESEUTIL /mh “path to your database”
if the DB state shows as “Clean Shutdown”, the database is detached from the transaction log and is consistent. However, if the DB state shows “Dirty Shutdown“, the database is still attached to the log file and is inconsistent.
The above corruption cannot replicate across as you are unable to bring the Exchange database back online.
Another application that can cause this is your Anti-Virus. If the correct exclusions are not set on your Anti-Virus application, it could go and delete files causing the inconsistency of the log files and the Exchange database will not mount if it is rebooted etc. Note that it won’t be replicated either.
To set exclusions on your Anti-Virus application like ESET, Kaspersky, System Center Endpoint protection and many others that support Microsoft Exchange, you can refer to the following link and set it according to what Microsoft outline:
Anti-Virus Software in the Operating System on Exchange Servers
Logical Corruption of the Exchange Database
This happens when the data within the database is no longer valid but the ESE structure is. This type of corruption can replicate and can also occur in a standalone Exchange Server. There are a few methods to deal with this kind of problem:
- Move mailboxes
- Perform Single Item Recovery
- Run the command New-MailboxRepairRequest
Mailbox Moves
To perform mailbox moves, you would need to create a new Exchange database and create its database copy and then start moving the mailboxes across to get rid of the current Exchange database. This is a simple task but can be very time consuming especially if the mailboxes are large, 100GB+
Single Item Recovery
The next step is to look at performing Single Item Recovery for a mailbox or mailboxes. You first need to enable it within Exchange, to do this run the following command:
Set-Mailbox -Identity Mailbox1 -SingleItemRecoveryEnabled $True -RetainDeletedItemsFor 30
Do take note, By default, the mailbox uses the deleted item retention settings of the mailbox database, but you can override the default can be overridden by setting it at the mailbox level for specific mailboxes.
Now let us look at what Single Item recovery is:
Single item recovery provides an additional layer of protection so that you can recover items accidentally deleted by a user or by automated processes such as the Managed Folder Assistant. Single item recovery simplifies recovery and reduces recovery time because you can recover items without recovering an entire mailbox or mailbox database from backup media.
You can also use the Search-Mailbox cmdlet in the Shell to search for and recover missing items.
Mailbox Repair Request
The last thing to look at is performing Mailbox Repairs. You can do so running the New-MailboxRepairRequest command from the Exchange Management Shell on a mailbox.
Let us look at some of the functionality of this command:
- The cmdlet works with the database mounted.
- You can repair logical corruption at the mailbox level.
- You can fix corrupt search folders.
- You can fix the Provisional Fid.
- You can fix Aggregate Counts.
Here is a brief explanation of what the command detects and fixes:
- Search folder corruptions (SearchFolder): Repair tasks now look for all folders named in ptagSearchBacklinks, ptagSearchFIDs, and ptagRecursiveSearchFIDs and verifies that each folder exists. If the folder no longer exists, then it will remove that folder from the list.
- Aggregate counts on folders that aren’t reflecting correct values (AggregateCounts): Repair tasks tally all messages in a folder and keep a running total of various counts and sizes. Once the iteration is complete, it will verify the computed counts against the persisted counts on the Folders table record for the folder. If there is a discrepancy, it will update the persisted counts to reflect the computed counts.
- Views on folders that aren’t returning correct contents (FolderView): Repair tasks will iterate over all views for a folder and for each one, bring the view fully up to date and then reconstruct a temp copy. If there is a discrepancy between the existing view and the contents of the temp table, it will delete the view so it can be rebuilt from scratch the next time it is requested.
- Provisioned folders that are incorrectly pointing into unprovisioned parent folders (ProvisionedFolder): Repair tasks can fix Provisioned folders incorrectly pointing into unprovisioned parents or vice versa.
A final point here, you need to ensure that you have proper backups in place in your Exchange Environment, you can also perform restores using Microsoft’s own product called Data Protection Manager then you need to ensure that you can restore the databases and they are no corrupt.
If the issue is not resolved, then you can also look to Mailbox Exchange Server Recovery tool by Stellar Data Recovery to recover data from your corrupt .EDB file.
