Daily Archives: May 18, 2006

Disaster recovery for Exchange

Wang Jijin had a bit of a problem after a catastrophic power failiure at his company:

After a site power failure (Both DC and Exchange server are affected), the Exchange server which has been up for nearly 2 months is down. The exchangeIS together with its exchangeSA service can not start. eseutil told me the database state is dirty shutdown.
There were weekly normal backups and daily incremental backup for both the Exchange Storage Group and the whole file system. However, the best db file (priv1.edb priv1.stm) I can find out from the file system backup is dated on 17th. Feb. (OH MY GOD!!!) It’s the last time the server restarts. I first tried to restore from the online Exchange Storage Backup and failed. I cleaned everything in MDBDATA folder and tried to start exchangeSA. Failed! I installed another clean exchange server, it still can not start the exchangeSA service. I guess there’s nothing to do with the DB, the problem is in the Active Directory.
After making up my mind to reinstall both DC and the Exchagne Server (which is nearly unacceptable), I tried to restore from the offline exchange backup (extracted from the file system backup). Yet, another problem, eseutil asks for log 0xA3 to recover the database, however I only have 0xA4 and after (dated from 17th. FEB, don’t know if they are still OK). The 0xA3 is probably an empty log which was generated and stored in a test backup, later thrown away by me. Am I doomed?
Can I by any means setup a viable Exchange Server without reinstalling the whole AD?
Can I recover most of the DB?
Can I fake an empty log for 0xA3?
Failure Events from exchangeSA:
Source: MSExchangeSA
Event ID: 9152
Microsoft Exchange System Attendant reported an error in its DS monitor thread “0xc1034a70”.
Source: MSExchangeSA
Event ID: 1005
Unexpected error: the specified user does not exists. Device: Win32 ID : c0070525 Microsoft Exchange System Attendant.
Source: MSExchangeSA
Event ID: 9317
Failed to register SPN for exchangeMDB. Error code: c10379bc。
Source: MSExchangeSA
Event ID: 9317
Failed to register SPN for exchangeRFR. Error code: c10379bc.

Well, What to advise?  There seemed to be so much happening here, that it was difficult to know where to start.  But there is one tool that you can use at the start.  The Disaster Recovery Analyser Tool (DRAT).  This tool programmatically collects configuration data and header information from databases and transaction log files. The tool analyses all headers and creates a detailed list of instructions explaining what the problem is, and how to resolve it.
Run this, and follow the step by step instructions on how to recover your database and logs.

So what happened?  After a week or so Wang Jijin sent me another mail

Thanks for your kindly help.
I’ve finanlly managed to restore the Exchange Server by restore the AD.
The DRAT (Disaster Recovery Analyzer Tool) told me that I only need the log files from FB to 10E. Then I just restore both the DC and the Exchange back to Just before the power failure and then rejoined the Exchange server to the domain. After my exchangeIS was running, I just followed the instructions offered by DRAT to recover my database off-place.

He also used this article to recover from his broken log set:
How to recover an Exchange 2000 Server database after error -1216.

And after reading all this, I’d also recommend that you went out and bought a decent UPS too – but those can fail too, as Mark pointed out the other day…