%1 (%2) %3An attempt to move the file “%4” to “%5” failed with system error %7: “%8”. The move file operation will fail with error %6.

Product: Exchange
Event ID: 486
Source: ESE
Version: 8.0
Message: %1 (%2) %3An attempt to move the file “%4” to “%5” failed with system error %7: “%8”. The move file operation will fail with error %6.

This Warning indicates that the Microsoft Exchange Information Store service is denied access to its own log files (*.log). Generally, the error in the event Description refers to a failure to rename the current log file such as E00.log to the latest log file in the storage group such as E0001499.log or to rename E00tmp.log to E00.log.

The following includes information about the most frequent causes of this issue:

  • In the Description section of event 486, you may see Error -1811 = Jet_errFileNotFound. The log file may be missing or there may be other causes for this error. For example, E00.log file may have a mismatching signature between the log and the database. Another reason for error 1811 includes the Exchange database and log files may have been put on network storage, which is not supported. In addition, the checkpoint file may be corrupt, or the log drive itself may have failed.

  • Another process has locked the file. Antivirus software may mistakenly quarantine a file, or a backup process may temporarily deny access. In this case, you may see error -1032 in the Description section of event 439. Error 1032 is equivalent to Jet_errFileAccessDenied, which is defined as: cannot access file; the file is locked or in use.

  • A disk or controller failure has occurred, and access to the entire drive has been lost, sometimes temporarily. Check the System log for I/O or drive errors near the time of the 486 event. In this case, you may see error -1022 in the description of event 486. Error -1022 = Jet_errDiskIO = disk I/O error. The -1022 error is a generic error that appears whenever a disk I/O problem prevents Exchange from gaining access to a requested page in the database or to a transaction log.

  • Permissions have been removed from the folder where the file resides.

  • The file has been marked read-only.

  • The folder containing the file has been renamed or deleted.

  • The device drivers installed with the operating system for the server hardware can cause these errors.

User Action

To resolve this warning, do one or more of the following:

  • Check for alerts related to full disks and resolve as necessary. To troubleshoot such errors, you must discover what has suddenly blocked the database service from access to its files. In many cases, restarting the affected server stops the lock.

  • Confirm sufficient access to the disks.

  • Make sure that the device drivers and manager software that is compatible with the hardware are recent and fully installed.

  • If the database is still running, you may have to use Move Mailbox or ExMerge to move the mailboxes to another server.

  • If the database will not mount, you may need to restore from online backup. If there is no valid backup, as a last resort, you may need to repair the database by running eseutil /p, running isinteg -fix until all fixes are removed, and then mounting the database and using ExMerge to place the data a new, blank database.

  • For information about ESE error codes other than the ones explained in this topic, see the following Microsoft Knowledge Base articles:

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.


Leave a Reply