%1 (%2) %3Unable to write a shadowed header for file %4. Error %5.

Details
Product: Exchange
Event ID: 439
Source: ESE
Version: 8.0
Symbolic Name: SHADOW_PAGE_WRITE_FAIL_ID
Message: %1 (%2) %3Unable to write a shadowed header for file %4. Error %5.
   
Explanation

This Warning event occurs if the database engine is denied write access to its own database files (*.edb) or to the checkpoint file (*.chk). Errors similar to the following may occur: MSExchangeIS event ID: Unable to write a shadowed header for file path\filename.

Common causes of this issue include:

  • Another process is using the file. Antivirus software may mistakenly quarantine a file, or a backup process may temporarily deny access. In this case, you may see error 1032 in the Description section of event 439. Error -1032 is equivalent to Jet_errFileAccessDenied, in which the file is locked or in use.

  • A disk or controller failure has occurred, and access to the entire drive has been lost, sometimes temporarily. Check the System Log for I/O or drive errors near the time of the 439 event. In this case, you may see error -1022 in the description of event 439. Error -1022 is a Jet_errDiskIO, or disk I/O error. The -1022 error is a generic error that appears whenever a disk I/O problem prevents Exchange from gaining access to a requested page in the database or to a transaction log.

  • Permissions have been removed from the folder where the file resides.

  • The file has been marked read-only. This is most likely to happen to a checkpoint file.

  • The folder containing the file has been renamed or deleted. This is also mostly likely to happen to a checkpoint file.

   
User Action

To resolve this warning, determine what has suddenly blocked the database service from accessing its files by doing one or more of the following:

  • Review the Application log and System log for events that relate to a disk that has reached or has exceeded capacity. Resolve any disk capacity issues.

  • Restart the affected computers running Exchange.

  • Confirm that there is sufficient access to the disks.

  • If the database is still running, you may have to use the Move Mailbox tool to move the mailboxes to another server.

  • If the database will not mount, you may need to restore from online backup. If there is no valid backup, as a last resort, you may need to repair the database with eseutil /P, run isinteg -fix until all fixes are removed, and then mount the database and use ExMerge to merge to a new, blank database.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

process name (process id) error codeUnable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error %4.

Details
Product: Exchange
Event ID: 413
Source: ESE
Version: 6.5.0000.0
Message: process name (process id) error codeUnable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error %4.
   
Explanation
A new log file could not be created because the database cannot write to the log file drive.

The drive may be read-only, out of disk space, misconfigured, or corrupted. 

The cause depends on the Error number in the Description section of the Event. 

The most common error codes for Event 413 are listed below.

  • Error -1032 =  0xfffffbf8 =  4294966264 = JET_errFileAccessDenied = Cannot

    access file – the file is locked or in use. Another process has “stolen” the

    file. A virus checker may mistakenly quarantine a file, or a backup process

    may temporarily deny access.  A flat file backup system or anti-virus

    software may be running against the information store, the SRS database file

    directories, or the M: drive.  This error can also occur if the permissions on

    the folder that contain the files for the information stores or the SRS are

    not sufficient for the databases to function properly.  The hardware

    device drivers may be out of date.

  • Error -1811 = 0xfffff8ed = JET_errFileNotFound = File not found. The

    log file may actually be missing or there may be other causes for this error. 

    For example, the current logfile (e.g., E00.log) may have a mismatching

    signature between the log and the database. Another reason for Error -1811

    is that the Exchange database and log files may have been put on Network
    Storage, which is not supported. Also, the checkpoint file may be corrupt, or

    the log drive itself may have failed.  The current log file may have been

    seized and deleted by anti-virus software running on the server. There have

    also been problems seen creating the temp log file for the storage group

    (e.g., e00tmp.log ).  The temp log file itself may become corrupt.

  • Error -1022 = 0xfffffc02 =

    4294966274 = JET_errDiskIO = Disk IO error.  The -1022 error is a generic

    error that appears whenever a disk input/output (I/O) problem prevents

    Exchange from gaining access to a requested page in the database or to a check

    file. A disk or controller failure may have occurred, and access to the

    entire drive has been lost, sometimes temporarily. The controller software or

    firmware may be out of date. Check the System Log for I/O or drive errors near

    the time of the 413 Event. This issue may occur because the path for the check

    file (such as E00.chk) is not correct, which may be caused by a drive failure.

   
User Action

Check the integrity of the file system. Check the system portion of the event

log for related entries. Review and change the access permissions properties,

and then note the disk space available. Review the disk and log file you are

trying to write to.

  • For Error -1811, make sure the anti-virus software is not running against

    the Information Store, the SRS database directories, or the Exchange M: drive. 

    Ensure the log file drive has not run out of space.

  • For Error

    -1032, change the permissions on the folders that contain the information

    store files to the default

    permissions.  Configure the flat file backup and anti-virus software to not scan the Exchange server Information Store subdirectories, or the M: drive. 

    Use Exchange-aware online backup and anti-virus software.

  • For Error -1022,  Ensure the drive for the information store

    files is accessible and that the path for the information store files is

    specified correctly.  If it is, run  “chkdsk /f /r” (without the quotation

    marks). If chkdsk does not resolve the issue, examine the permissions on the

    Exchsrvr folder structure. Ensure that SYSTEM has full control of Exchsrvr

    and all subfolders on each partition that contains Exchange data. If you still

    cannot mount the databases, troubleshoot any Windows NT file-level antivirus

    software running on the Exchange server.  Check the System Log for I/O or

    drive errors near the time of the 413 Event. Check and correct the path for

    the check file (such as E00.chk).

  • After correcting the root cause, if the database is inconsistent, restore

    from online backup. If there is no valid backup, you can restore the database

    to consistency using the “hard repair” (/p) functionality of the Eseutil

    utility, run isinteg -fix until all fixes are removed, and then mount the

    database and then ExMerge to a new, blank database. NOTE: Before doing this,
    you should always back up all information store files in a Storage Group

    (*.log files, *.edb files and *.stm files).

Related:

() Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error .

Details
Product: Exchange
Event ID: 413
Source: ESE
Version: 6.5.6940.0
Component: Microsoft Exchange Extensible Storage Engine
Message: <process name> (<process id>) <storage group name>Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error <error code>.
   
Explanation

A new log file could not be created because the database cannot write to the log file drive.

The drive may be read-only, out of disk space, misconfigured, or corrupted. The cause depends on the error number in the Description section of the event. The most common error codes for Event 413 are listed below.

  • Error -1032 = 0xfffffbf8 = 4294966264 = JET_errFileAccessDenied = Cannot access file – the file is locked or in use. Another process has “stolen” the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or antivirus software may be running against the information store, the SRS database file directories, or drive M. This error can also occur if the permissions on the folder that contain the files for the information stores or the SRS are not sufficient for the databases to function properly. The hardware device drivers may be out of date.
  • Error -1811 = 0xfffff8ed = JET_errFileNotFound = File not found. The log file may actually be missing or there may be other causes for this error. For example, the current logfile (e.g., E00.log) may have a mismatching signature between the log and the database. Another reason for Error -1811 is that the Exchange database and log files may have been put on Network Storage, which is not supported. Also, the checkpoint file may be corrupt, or the log drive itself may have failed. The current log file may have been seized and deleted by antivirus software running on the server. There have also been problems encountered in creating the temp log file for the storage group (e.g., e00tmp.log ). The temp log file itself may become corrupt.
  • Error -1022 = 0xfffffc02 = 4294966274 = JET_errDiskIO = Disk IO error. The -1022 error is a generic error that appears whenever a disk input/output (I/O) problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. The controller software or firmware may be out of date. Check the System Log for I/O or drive errors near the time of the 413 Event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure.
   
User Action

Check the integrity of the file system. Check the system portion of the event log for related entries. Review and change the access permissions properties, and then note the disk space available. Review the disk and log file you are trying to write to.

  • For Error -1811, ensure that the antivirus software is not running against the Exchange Information Store, the SRS database directories, nor drive M. Ensure the log file drive has not run out of space.
  • For Error -1032, change the permissions on the folders that contain the information store files to the default permissions. Configure the flat file backup and antivirus software to not scan the Exchange server Information Store subdirectories, nor drive M. Use Exchange-aware online backup and antivirus software.
  • For Error -1022, ensure that the drive for the information store files is accessible and that the path for the information store files is specified correctly. If it is, run “chkdsk /f /r” (without the quotation marks). If chkdsk does not resolve the issue, examine the permissions on the Exchsrvr folder structure. Ensure that SYSTEM has full control of Exchsrvr and all subfolders on each partition that contains Exchange data. If you still cannot mount the databases, troubleshoot any Windows NT file-level antivirus software running on the Exchange server. Check the System Log for I/O or drive errors near the time of the 413 Event. Check and correct the path for the check file (such as E00.chk).
  • After correcting the root cause, if the database is inconsistent, restore from online backup. If there is no valid backup, you can restore the database to consistency using the “hard repair” (/p) functionality of the Eseutil utility, run isinteg -fix until all fixes are removed, and then mount the database and then ExMerge to a new, blank database. NOTE: Before doing this, you should always back up all information store files in a storage group (*.log files, *.edb files and *.stm files).

Related:

%1 (%2) %3The logfile sequence in “%4” has been halted due to a fatal error. No further updates are possible for the databases that use this logfile sequence. Please correct the problem and restart or restore from backup.

Details
Product: Exchange
Event ID: 492
Source: ESE
Version: 8.0
Symbolic Name: LOG_DOWN_ID
Message: %1 (%2) %3The logfile sequence in “%4” has been halted due to a fatal error. No further updates are possible for the databases that use this logfile sequence. Please correct the problem and restart or restore from backup.
   
Explanation

This Error event indicates that the database engine is unable to replay the log file sequence. Because this is a generic error, there are no specific errors associated with this event in the Description section of the event. Look for errors mentioned in the Description section of related events that refer to problems related to opening, creating, deleting, and writing log files. The cause of the error depends on the specific error. The most common errors in the Description section of events related to event 492 are as follows:

  • Error 1811 = 0xfffff8ed = Jet_errFileNotFound = File not found. The log file may be missing or there may be other causes for this error. For example, the current log file (such as E00.log) may have a mismatching signature between the log and the database. Error 1811 might also be generated when the Exchange databases and log files are stored on network storage. This is unsupported. In addition, the checkpoint file may be corrupted, or the log drive may have failed. The current log file may have been seized and deleted or quarantined by antivirus software running on the server. There have also been problems creating the temp log file for the storage group (such as e00tmp.log ). The temp log file may be corrupted.

  • Error 510 = 0xfffffe02 = 4294966786 = Jet_errLogWriteFail = Failure when writing to log file. Error 510 can be caused by permissions issues, space issues, SAN issues, and other issues affecting reads and writes to the disks.

  • Error 1032 = 0xfffffbf8 = 4294966264 = Jet_errFileAccessDenied = Cannot access file – the file is locked or in use. Another process has locked the file. Antivirus software may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or antivirus software may be running against the database or checking file directories. This error can also occur if the permissions on the folder that contain the files for the Exchange stores are not sufficient for the stores to function properly.

   
User Action

To resolve this error, you must correct the problem and restart the Microsoft Exchange Information Store service. Alternatively, you may need to restore from backup. Do the following to resolve this error:

  • Review the Application log for related events. For error 1811, ensure that the antivirus software is not running against the Exchange store and the SRS database directories. Ensure that the database drive has not run out of space. Ensure that the database file is present where it is supposed to be. For more information about properly configuring your antivirus software, see the Microsoft Knowledge Base article 328841, Exchange and Antivirus Software.

  • For error 510, investigate the root cause of permissions issues, space issues, and other issues affecting reads and writes to the disks.

  • For error 1032, change the permissions on the folders that contain the Exchange store files to the default permissions. Configure the flat file backup and antivirus software to not scan the Exchange Server Information Store subdirectories. Use Exchange-aware online backup and antivirus software.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

() An attempt to open the file “” for read only access failed with system error : “”. The open file operation will fail with error .

Details
Product: Exchange
Event ID: 489
Source: ESE
Version: 6.5.6940.0
Component: Microsoft Exchange Extensible Storage Engine
Message: <process name> (<process id>) <storage group name>An attempt to open the file “<file name>” for read only access failed with system error <error code>: “<error message>“. The open file operation will fail with error <error code>.
   
Explanation

An unexpected error was encountered while trying to open a file.

You will receive the following phrase in the event Description:

An attempt to open the file [path\file name] for read-only access failed with [Error Code and Explanation]. The open file operation will fail with error [Error Code].

The cause depends on the Error listed at the end of the Description section of the event. The most frequent causes are as follows:

  • Error -1032 = 0xfffffbf8 = 4294966264 = JET_errFileAccessDenied = Cannot access file – the file is locked or in use. Another process has “stolen” the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or antivirus software may be running against the database, the check file directories, or drive M. This error can also occur if the permissions on the folder (such as MDBDATA) that contain the files for the information stores are not sufficient for the stores to function properly.
  • Error -1022 = 0xfffffc02 = 4294966274 = JET_errDiskIO = Disk IO error. The -1022 error is a generic error that appears whenever a disk input/output (I/O) problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. Check the system log for I/O or drive errors near the time of the 490 Event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure.
  • Error -1023 = 0xfffffc01= 4294966273 = JET_errInvalidPath = Invalid file path. This error can be caused by changing the path for the log files or the check file prior to a restore. This error can also indicate a corrupt check file (such as E00.chk) or a temporary file built during a defragmentation or a repair. In the case of the corrupt files, this error may occur even if the path to the file is correct.
   
User Action
  • For Error -1032, change the permissions on the folders that contain the Exchange database files to the default permissions. Configure the flat file backup and antivirus software to not scan the Exchange database subdirectories, or drive M. Use Exchange-aware online backup and antivirus software.
  • For Error -1022, run “chkdsk /f /r” (without the quotation marks). If chkdsk does not resolve the issue, examine the permissions on the Exchsrvr folder structure. Make sure that SYSTEM has full control of Exchsrvr and all subfolders on each partition that contains Exchange data. If you still cannot mount the databases, troubleshoot any Windows NT file-level antivirus software running on the Exchange server. Check the System Log for I/O or drive errors near the time of the 490 Event. Check and correct the path for the check file (such as E00.chk). Correct the root cause and then restore from online backup if there is a recent backup or as a last resort, perform a repair, Isinteg -fix, and ExMerge to a new Information Store.
  • For Error -1023, place the Exchange database files back in their original locations before performing the restore. Alternatively, if the .chk is corrupt, you may be able to remove it and read all the transactions into the database. If the database remains inconsistent, then restore from online backup if there is a recent backup or as a last resort, perform a repair, Isinteg -fix, and ExMerge to a new Exchange database.

Related:

The disk is in use or locked by another process.

Details
Product: Windows Operating System
Event ID: 108
Source: Kernel
Version: 5.0
Component: System Resources
Symbolic Name: ERROR_DRIVE_LOCKED
Message: The disk is in use or locked by another process.
   
Explanation

A process has exclusive use of this disk, prohibiting another process from accessing it at this time.

   
User Action

Retry the operation later, or try it on another disk.

Related:

%1 (%2) %3An attempt to open the file “%4” for read only access failed with system error %6: “%7”. The open file operation will fail with error %5.

Details
Product: Windows Operating System
Event ID: 489
Source: ESENT
Version: 5.2
Symbolic Name: OSFS_OPEN_FILE_RO_ERROR_ID
Message: %1 (%2) %3An attempt to open the file “%4” for read only access failed with system error %6: “%7”. The open file operation will fail with error %5.
   
Explanation

An error occurred while a file was being opened.

Probable causes include:

  • The file is locked or in use.
  • A virus checker might have mistakenly quarantined a file, or a backup process might have temporarily denied access.
  • A flat file backup system or anti-virus software might be running against the database, the check file directories, or the M drive.
  • The permissions on the folder (such as MDBDATA) that contains the files for the information stores are not sufficient for the stores to function correctly.
  • A disk input/output (I/O) problem prevented access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive was lost, perhaps temporarily. This issue can occur when the path for the check file (such as E00.chk) is not correct.
  • The path for the log files or the check file was changed before the system was restored.
  • The check file (such as E00.chk) is corrupted.
   
User Action

To solve this problem, do one or all of the following:

If the file is locked or in use:

  • Change the permissions on the folders that contain the information store files to the default permissions.
  • Configure the flat file backup and anti-virus software to not scan the Windows Information Store subdirectories or the M drive.
  • Use an online backup and anti-virus software.

If there is an Input/Output problem, do one or all of the following:

  • Run chkdsk /f /r at the command prompt.
  • Examine the permissions on the folder structure.
  • Troubleshoot any file-level antivirus software running.
  • Check the System Log in Event Viewer for any related I/O or drive events.
  • Check and correct the path for the check file (such as E00.chk).
  • Correct the root cause, and then restore from online backup, if there is a recent backup.

If the path was changed:

  • Move the Information Store files back to their original locations and then try to restore again.
  • If the .chk file is corrupt, you may be able to remove it and read all the transactions into the database. If the database remains inconsistent, then restore from online backup if there is a recent version.

For more information about this event, see article Q823022 in the Microsoft Knowledge Base.

Related: