Exchange Transaction Log help!!

Firefly86

Firefly86

Firefly86

Associate
Joined
19 Jul 2006
Posts
258
Location
Gibraltar
Hi guys,

I need some help quite badly :P
This is really for exchange experts or people who are quite comfortable with exchange
There were some probelms with our exchange server on Friday 25th, the UPS failed and the exchange server shut down. A couple of days later we noticed problems with exchange mailboxes and decided to do a restore of the information store (using veritas daily backups). I made sure that the option to keep transaction logs was ticked! so as not to lose any work dating back to the restore date.

I performed a restore of Thursday 24th information store. The restore performed successfully, I was then uable to mount the mailbox store and received an error message which turned out to be due to the fact that the store first had to be recovered after the restore using eseutil.

So i went ahead and followed some instructions provided in the exchange troubleshooting wizard and performed the eseutil /cc command. This ran successfully. I was then able to remount the mailbox store and exchange was up and running.

However, emails as now missing dating from Thursday 24th to Wednesday 30th May (today).

I am quite comfortable with exchange however I am not an expert on it and am really not 100% sure on this issue. I made a manual backup of all the transaction logs which were present in the MDBDATA folder before I ran the eseutil command.

Is there any way to restore these logs back so that I can get those missing emails back?

Any help is appreciated
 
Last edited:
I assume you've run a full backup since the 24th. The transaction logs are usually flushed with a full backup.

So (dates estimated)...
24th Thu - Full backup - Transaction logs flushed
29th Tue - Full backup - Transaction logs flushed
30th Wed - Restore

The transaction logs would have only been from the backup performed on the 29th onwards.
 
hi there,

yes we run full backup every weekday. However I really needed to perform a restore of a backup before the power cut, so any date before the 25th.

Is it possible for me to get those missing emails back with just plain transaction logs?

For most people 1 days worth of emails isnt a big deal but for quite a few of our departments theyre crucial =(
 
To be honest with you, i don't see a "quick and easy" way of doing this with the data you have.

Do you have a spare exchange server that you can use to recover one of the later backups? You could then extract the required mailboxes with exmerge and import it to the current server.

Another option is something like Ontrack power tools that can do this straight from the MDBDATA files.
 
we have a backup exchange server but its empty atm...its just literally a server with exchange server 2003 installed and patched :s

I'l take a look at the ontrack

thanks for the help oddjob
 
Did you have circular logging turned on ?

If so then that could explain the missing emails.

I assume that you havent got any OST files on local machines that you could convert to PST and exmerge ?
 
No the main problem is he is missing the message data from the mailboxes of the users since the backup was taken on the 24th. If he uses the recovery storage group he can restore the backup from the 29th and exmerge the mail for the missing dates back into the mailboxes.
 
J1nxy said:
No the main problem is he is missing the message data from the mailboxes of the users since the backup was taken on the 24th. If he uses the recovery storage group he can restore the backup from the 29th and exmerge the mail for the missing dates back into the mailboxes.
Click to expand...

That's assuming the databases are in good shape. After all he had to do a restore due to the fact that there was a problem (although he didn't go into much details as to what that problem was)

Whether he restores to their second exchange server, or to a recovery storage group doesn't make that much difference.
 
In no expert, but would it be worth running the isinteg check to make sure the rest of the database is ok before going any further?
 
Firefly86 said:
Hi guys,

I need some help quite badly :P
This is really for exchange experts or people who are quite comfortable with exchange
There were some probelms with our exchange server on Friday 25th, the UPS failed and the exchange server shut down. A couple of days later we noticed problems with exchange mailboxes and decided to do a restore of the information store (using veritas daily backups). I made sure that the option to keep transaction logs was ticked! so as not to lose any work dating back to the restore date.

I performed a restore of Thursday 24th information store. The restore performed successfully, I was then uable to mount the mailbox store and received an error message which turned out to be due to the fact that the store first had to be recovered after the restore using eseutil.

So i went ahead and followed some instructions provided in the exchange troubleshooting wizard and performed the eseutil /cc command. This ran successfully. I was then able to remount the mailbox store and exchange was up and running.

However, emails as now missing dating from Thursday 24th to Wednesday 30th May (today).

I am quite comfortable with exchange however I am not an expert on it and am really not 100% sure on this issue. I made a manual backup of all the transaction logs which were present in the MDBDATA folder before I ran the eseutil command.

Is there any way to restore these logs back so that I can get those missing emails back?

Any help is appreciated
Click to expand...

I *think* I get what you're saying...

On Friday the 25th you had a Exchange server shutdown unexpectedly, correct?

A couple of days later you had 'mailbox issues', I'll assume Monday the 28th? You then left it 2 days before doing any investigation or maintenance?

If so, then you are in trouble.

In hindsight, and for future reference you can always see it this way:

If you have what you think may be an 'Exchange issue', and emails are 'crucial' to your (or a departments) operations check it out immediately, not a couple of days later.

If you ever have another 'dirty shutdown' run eseutil on ALL stores, this may help http://www.petri.co.il/check_exchange_2000_2003_server_databases_integrity.htm

Also, before performing a restore, and if you or your colleagues are not Exchange experts it may be wise to consult one, or call MS PSS. Do you actually know what the real issue was that made you peform a restore?

Sorry if this dosen't help you now, but it may in the future.
 
On a second note, on our exchange box I have a seperate information store setup that captures all emails (to comply with a law).

This mail store gets exmerged out to a pst file daily and archived on DVD, it may be worth you doing a similar thing. Not pretty should you need to rely on it to get email back, but it's always a good last resort.
 
You must log in or register to reply here.
Back
Top Bottom