%1 (%2) %3Unable to read the header of logfile %4. Error %5.

Details
Product: Exchange
Event ID: 412
Source: ESE
Version: 8.0
Symbolic Name: LOG_HEADER_READ_ERROR_ID
Message: %1 (%2) %3Unable to read the header of logfile %4. Error %5.
   
Explanation

This Warning event indicates that the database engine is unable to read the log file header specified in the event description. This may be because of a mismatching log signature, a corrupted log file, or a corrupted log header.

The cause depends on the ESE error code in the Description section of the event. The most common causes are in the following list.

  • Error 530 = Jet_errBadLogSignature = Bad signature for a log file. A signature for log files is used only to make sure that we are replaying the “right” set of log files. For example, if Log 45 from another storage group ended up in the set of log files of another storage group, then ESE will detect a signature mismatch and not replay this log file. A part of each database header includes the signature of the current log file generation; if they do not match, then we error out indicating a mismatch.

  • Error 501 = Jet_errLog fileCorrupt = Log file corrupt. Error 1022 is returned from corrupting the header of a log file. Corrupting other areas of the log file returns 501 Jet_errLog fileCorrupt errors.

  • Error 1022 = Jet_errDiskIO = disk I/O error. The 1022 error is a generic error that appears whenever a disk I/O problem prevents Exchange from gaining access to a requested page in the database or to a transaction log. The most common reason for a 1022 error is a database file that was severely damaged or truncated. If this issue occurs, Exchange requests a page number that is larger than the number of pages in the database file, and a 1022 error results. This issue can occur because of issues in the file system or because of incorrect transaction log replay. In a log file, error 1022 is returned from corrupting the header of a log file.

   
User Action

To resolve the warning, use one of the following procedures:

  • Restore data from online backup.

  • If there is no valid backup, repair the database by running the Eseutil /p command, and then run the isinteg -fix command on the affected store repeatedly until you receive 0 fixes or the same result for fixes two times. After you repair the database by using the Eseutil /p command and isinteg -fix, the database may not be stable and reliable. Because the repair process deletes database pages, data loss is likely. If you have to run a hard repair on your production database, we recommend that you move the data out of the repaired database to a new database or rebuild the database using the Move Mailbox command.

For information about ESE error codes other than the ones explained in this topic, see the following Microsoft Knowledge Base articles:

For more information about ESE error 1022, see 314917, Understanding and Analyzing -1018, -1019, and -1022 Exchange database errors.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

%1 (%2) %3An attempt to read from the file “%4” at offset %5 for %6 bytes failed after %10 seconds with system error %8: “%9”. The read operation will fail with error %7. If this error persists then the file may be damaged and may need to be restored from a previous backup.

Details
Product: Exchange
Event ID: 481
Source: ESE
Version: 8.0
Symbolic Name: OSFILE_READ_ERROR_ID
Message: %1 (%2) %3An attempt to read from the file “%4” at offset %5 for %6 bytes failed after %10 seconds with system error %8: “%9”. The read operation will fail with error %7. If this error persists then the file may be damaged and may need to be restored from a previous backup.
   
Explanation

This Warning event indicates that an unexpected error occurred while reading the file specified in the message. ESE Event ID 481 refers to a failed read attempt from the database. For comparison, ESE Event ID 482 refers to a failed write operation to a log file or a database.

The cause depends on the error number in the Description section of the event. The most common error codes for event 481 are as follows:

  • Error -1022 = 0xfffffc02 = 4294966274 = Jet_errDiskIO = Disk I/O error. The -1022 error is a generic error that appears whenever a disk I/O problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. Check the System log for I/O or drive errors near the time of the 490 event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure.

  • Error -1811 = 0xfffff8ed = Jet_errFileNotFound = File not found. The database may be missing or there may be other causes for this error. Another reason for error -1811 could be that the Exchange database and log files may have been put on network storage, which is not supported. Also, the checkpoint file may be corrupt, or the log drive itself may have failed. Exchange will disconnect from the storage group due to an inability to locate the database files. Typically, this is due to a hardware problem.

  • Error -1011 = 0xfffffc0d = Jet_errOutOfMemory = Out of Memory. This error indicates that there is no more available memory and the read operation has failed. Other ESE events with out-of-memory errors in the Description section for reading the header of a database, recovery/restore, and starting a storage group are often seen in the application event log at the same time. Review these events for further information.

  • Error -1003 = 0xfffffc15 = Jet_errInvalidParameter = Incorrect API parameter. This error generally means that the file size of the database is not a multiple of 4,096 bytes.

   
User Action

To resolve this warning, do one or more of the following:

  • Review the disk and file that you are trying to read. Check the integrity of the file system. Check the memory usage. Check the system portion of the event log for related entries. Review and change the access permissions properties and then note the disk space available. Check the file size of the database in bytes.

  • For error -1022, check to ensure that the drive for the Exchange store files is accessible and that the path for the Exchange store files is specified correctly. If it is, run chkdsk /f /r. If chkdsk does not resolve the issue, examine the permissions on the C:\Program Files\Microsoft\Exchange Server folder, where C:\ is the directory to which you installed Exchange 2007. Ensure that System has full control of the Exchange Server folder and all subfolders on each partition that contain Exchange data. If you still cannot mount the databases, troubleshoot any Windows NT file-level antivirus software running on the Exchange server. Check the System log for I/O or drive errors near the time of the 413 event.

  • For error -1811, ensure that the antivirus software is not running against the Exchange store, the SRS database directories. Make sure that you have properly configured your antivirus software. For more information, see the Microsoft Knowledge Base article 328841, Exchange and Antivirus Software.

  • Ensure that the database drive has not run out of space. Ensure that the database file is where it is supposed to be.

  • For error -1011, check the memory usage of the server. Check the settings for the page file. Check for memory-related events in the application event log and in the System log and check the Microsoft Knowledge Base for troubleshooting of the events found. For error -1003, check the size of the database in bytes. It must be a multiple of 4,096 bytes, or 1 page. If it is not, contact Microsoft Product Support Services.

  • For information about ESE error codes other than the ones explained in this topic, see the following Microsoft Knowledge Base articles:

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related: