Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 117 Source: ESE97

MSExchangeIS (1748) Pre-read page checksum error -1018 ((1:134723 1:134723) (0-57945985)(0-89568862)) occurred. Please restore the databases from a previous backup.
The JET error -1018 (JET_errReadVerifyFailure) appears in the Windows NT Event Viewer application log during normal operation of the information store or directory service. Also, the error -1018 is returned during the online backup procedure of the information store or directory service.

A -1018 error occurs when the Exchange Server database engine makes a request to the operating system or hardware to return page X from the database on disk but the operating system or hardware returns page Y. This can result from many things such as faulty hardware, SCSI timing problems, and so on.

From "Error -1018 indicates that a database page couldn't be verified during a backup or maintenance pass. This is a very bad error to see, since it always indicates underlying problems with your disk subsystem. This error is especially insidious since it won't stop a backup operation. When you see this error in your event logs, do the following:
- Do not run eseutil or isinteg (or any other utility) on your database files.
- Check your system event log for any disk-related errors. Chances are excellent that these errors are what are causing the Exchange database errors.
- Check your backup by restoring it to a recovery server. Check the recovery server's event log for errors.
- As soon as possible, set up an additional server in your site and move user mailboxes and public folders from the stricken server to the new one.
- At some point, you'll probably get an error when moving one or more mailboxes. That's where the errors are.
- Log on as the user who owns the problem mailbox. Move all its mail to a PST.
Delete and recreate the problem mailbox, move the mail back into it, and move the mailbox to the recovery server.
- Rebuild the afflicted server, making sure to fix the underlying hardware problem."
For a detailed explanation of -1018 errors see ME151789, ME192333, ME812531 and compaq customer advisory link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.