() Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error .

Details
Product: Exchange
Event ID: 413
Source: ESE
Version: 6.5.6940.0
Component: Microsoft Exchange Extensible Storage Engine
Message: <process name> (<process id>) <storage group name>Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error <error code>.
   
Explanation

A new log file could not be created because the database cannot write to the log file drive.

The drive may be read-only, out of disk space, misconfigured, or corrupted. The cause depends on the error number in the Description section of the event. The most common error codes for Event 413 are listed below.

  • Error -1032 = 0xfffffbf8 = 4294966264 = JET_errFileAccessDenied = Cannot access file – the file is locked or in use. Another process has “stolen” the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or antivirus software may be running against the information store, the SRS database file directories, or drive M. This error can also occur if the permissions on the folder that contain the files for the information stores or the SRS are not sufficient for the databases to function properly. The hardware device drivers may be out of date.
  • Error -1811 = 0xfffff8ed = JET_errFileNotFound = File not found. The log file may actually be missing or there may be other causes for this error. For example, the current logfile (e.g., E00.log) may have a mismatching signature between the log and the database. Another reason for Error -1811 is that the Exchange database and log files may have been put on Network Storage, which is not supported. Also, the checkpoint file may be corrupt, or the log drive itself may have failed. The current log file may have been seized and deleted by antivirus software running on the server. There have also been problems encountered in creating the temp log file for the storage group (e.g., e00tmp.log ). The temp log file itself may become corrupt.
  • Error -1022 = 0xfffffc02 = 4294966274 = JET_errDiskIO = Disk IO error. The -1022 error is a generic error that appears whenever a disk input/output (I/O) problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. The controller software or firmware may be out of date. Check the System Log for I/O or drive errors near the time of the 413 Event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure.
   
User Action

Check the integrity of the file system. Check the system portion of the event log for related entries. Review and change the access permissions properties, and then note the disk space available. Review the disk and log file you are trying to write to.

  • For Error -1811, ensure that the antivirus software is not running against the Exchange Information Store, the SRS database directories, nor drive M. Ensure the log file drive has not run out of space.
  • For Error -1032, change the permissions on the folders that contain the information store files to the default permissions. Configure the flat file backup and antivirus software to not scan the Exchange server Information Store subdirectories, nor drive M. Use Exchange-aware online backup and antivirus software.
  • For Error -1022, ensure that the drive for the information store files is accessible and that the path for the information store files is specified correctly. If it is, run “chkdsk /f /r” (without the quotation marks). If chkdsk does not resolve the issue, examine the permissions on the Exchsrvr folder structure. Ensure that SYSTEM has full control of Exchsrvr and all subfolders on each partition that contains Exchange data. If you still cannot mount the databases, troubleshoot any Windows NT file-level antivirus software running on the Exchange server. Check the System Log for I/O or drive errors near the time of the 413 Event. Check and correct the path for the check file (such as E00.chk).
  • After correcting the root cause, if the database is inconsistent, restore from online backup. If there is no valid backup, you can restore the database to consistency using the “hard repair” (/p) functionality of the Eseutil utility, run isinteg -fix until all fixes are removed, and then mount the database and then ExMerge to a new, blank database. NOTE: Before doing this, you should always back up all information store files in a storage group (*.log files, *.edb files and *.stm files).

Related:

Leave a Reply