Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 478 Source: ESE

Source
Level
Description
Information Store (<PID>) The streaming page read from the file "<file>" at offset <offset> (<offset>) for <number> (<number>) bytes failed verification due to a page checksum mismatch. The expected checksum was <value> (<hex value>) and the actual checksum was <value> (<hex value>). The read operation will fail with error <error code> (<hex error code>). If this condition persists then please restore the database from a previous backup.
Comments
 
Solve this problem by using ESEUTIL:
1. Dismount the information store
2. Make an offline backup of priv1.edb and priv1.stm, but make sure you have 110% of the database size available on the same partition
3. Run c:\exchsrvr\bin\eseutil /r x:\exchsrvr\mdbdata\priv1.edb or
c:\exchsrvr\bin\eseutil /r /ispriv (depending on your exchange version)
4. Remount your information store

If this doesn't work, make sure you have Exchange 2003 SP1 installed (solves a WebDAV bug that can lead to private information store corruption). If this still doesn't solve the problem, restore the database from tape, or if you don't have a recent backup, perform a database repair (same syntax but /p instead of /r).

Keep in mind that this can lead to data loss (a couple of mails) in your database.
We received this error a couple of times. However, I noticed we were only getting this error when backing up Exchange at the same time the daily maintenance was running. We changed the schedule of the backups to miss the daily maintenance and we stopped getting this error.
As per Microsoft: "This problem may occur when you use a Web Distributed Authoring and Versioning (WebDAV) client to send messages to distribution lists and the distribution lists have one of the following options selected on the Exchange Advanced tab:
1. Send delivery reports to group owner
2. Do not send delivery reports". See ME814891 for more details on this issue.

See ME810333, ME840013 and the links to "Veritas Support Document ID: 253561" and "EventID 478 from source ESE98" for additional information on this event.
This represents corruption in one of the pages in an Exchange storage file. Every page in a storage file is contains a CRC value that is read by the database manager to verify the integrety of that page. This errors means that one or more sectors of data within the file are corrupte; this could be a logical corruption or actual physical inability to reliably read the sector(s). The ESEUTIL tool can be used to attempt to repair or recover such a file if you do not have a successful, recent backup. Once you have a good copy of the store, it''s best to delete the store, run a disk scan both logical and physical (bad cluster check) before recreating the store if you continue to use the same drive.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...