process name (process id) error codeUnable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error %4.

Details
Product: Exchange
Event ID: 413
Source: ESE
Version: 6.5.0000.0
Message: process name (process id) error codeUnable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error %4.
   
Explanation
A new log file could not be created because the database cannot write to the log file drive.

The drive may be read-only, out of disk space, misconfigured, or corrupted. 

The cause depends on the Error number in the Description section of the Event. 

The most common error codes for Event 413 are listed below.

  • Error -1032 =  0xfffffbf8 =  4294966264 = JET_errFileAccessDenied = Cannot

    access file – the file is locked or in use. Another process has “stolen” the

    file. A virus checker may mistakenly quarantine a file, or a backup process

    may temporarily deny access.  A flat file backup system or anti-virus

    software may be running against the information store, the SRS database file

    directories, or the M: drive.  This error can also occur if the permissions on

    the folder that contain the files for the information stores or the SRS are

    not sufficient for the databases to function properly.  The hardware

    device drivers may be out of date.

  • Error -1811 = 0xfffff8ed = JET_errFileNotFound = File not found. The

    log file may actually be missing or there may be other causes for this error. 

    For example, the current logfile (e.g., E00.log) may have a mismatching

    signature between the log and the database. Another reason for Error -1811

    is that the Exchange database and log files may have been put on Network
    Storage, which is not supported. Also, the checkpoint file may be corrupt, or

    the log drive itself may have failed.  The current log file may have been

    seized and deleted by anti-virus software running on the server. There have

    also been problems seen creating the temp log file for the storage group

    (e.g., e00tmp.log ).  The temp log file itself may become corrupt.

  • Error -1022 = 0xfffffc02 =

    4294966274 = JET_errDiskIO = Disk IO error.  The -1022 error is a generic

    error that appears whenever a disk input/output (I/O) problem prevents

    Exchange from gaining access to a requested page in the database or to a check

    file. A disk or controller failure may have occurred, and access to the

    entire drive has been lost, sometimes temporarily. The controller software or

    firmware may be out of date. Check the System Log for I/O or drive errors near

    the time of the 413 Event. This issue may occur because the path for the check

    file (such as E00.chk) is not correct, which may be caused by a drive failure.

   
User Action

Check the integrity of the file system. Check the system portion of the event

log for related entries. Review and change the access permissions properties,

and then note the disk space available. Review the disk and log file you are

trying to write to.

  • For Error -1811, make sure the anti-virus software is not running against

    the Information Store, the SRS database directories, or the Exchange M: drive. 

    Ensure the log file drive has not run out of space.

  • For Error

    -1032, change the permissions on the folders that contain the information

    store files to the default

    permissions.  Configure the flat file backup and anti-virus software to not scan the Exchange server Information Store subdirectories, or the M: drive. 

    Use Exchange-aware online backup and anti-virus software.

  • For Error -1022,  Ensure the drive for the information store

    files is accessible and that the path for the information store files is

    specified correctly.  If it is, run  “chkdsk /f /r” (without the quotation

    marks). If chkdsk does not resolve the issue, examine the permissions on the

    Exchsrvr folder structure. Ensure that SYSTEM has full control of Exchsrvr

    and all subfolders on each partition that contains Exchange data. If you still

    cannot mount the databases, troubleshoot any Windows NT file-level antivirus

    software running on the Exchange server.  Check the System Log for I/O or

    drive errors near the time of the 413 Event. Check and correct the path for

    the check file (such as E00.chk).

  • After correcting the root cause, if the database is inconsistent, restore

    from online backup. If there is no valid backup, you can restore the database

    to consistency using the “hard repair” (/p) functionality of the Eseutil

    utility, run isinteg -fix until all fixes are removed, and then mount the

    database and then ExMerge to a new, blank database. NOTE: Before doing this,
    you should always back up all information store files in a Storage Group

    (*.log files, *.edb files and *.stm files).

Related:

Leave a Reply