Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Information Store (<PID>) The streaming page read from the file "<file>" at offset <offset> (<offset>) for <number> (<number>) bytes failed verification due to a page checksum mismatch. The expected checksum was <value> (<hex value>) and the actual checksum was <value> (<hex value>). The read operation will fail with error <error code> (<hex error code>). If this condition persists then please restore the database from a previous backup.
|English: Request a translation of the event description in plain English.|
Peter Van Gils
Solve this problem by using ESEUTIL:
1. Dismount the information store
2. Make an offline backup of priv1.edb and priv1.stm, but make sure you have 110% of the database size available on the same partition
3. Run c:\exchsrvr\bin\eseutil /r x:\exchsrvr\mdbdata\priv1.edb or
c:\exchsrvr\bin\eseutil /r /ispriv (depending on your exchange version)
4. Remount your information store
If this doesn't work, make sure you have Exchange 2003 SP1 installed (solves a WebDAV bug that can lead to private information store corruption). If this still doesn't solve the problem, restore the database from tape, or if you don't have a recent backup, perform a database repair (same syntax but /p instead of /r).
Keep in mind that this can lead to data loss (a couple of mails) in your database.
We received this error a couple of times. However, I noticed we were only getting this error when backing up Exchange at the same time the daily maintenance was running. We changed the schedule of the backups to miss the daily maintenance and we stopped getting this error.
As per Microsoft: "This problem may occur when you use a Web Distributed Authoring and Versioning (WebDAV) client to send messages to distribution lists and the distribution lists have one of the following options selected on the Exchange Advanced tab:
1. Send delivery reports to group owner
2. Do not send delivery reports". See ME814891 for more details on this issue.
See ME810333, ME840013 and the links to "Veritas Support Document ID: 253561" and "EventID 478 from source ESE98" for additional information on this event.
This represents corruption in one of the pages in an Exchange storage file. Every page in a storage file is contains a CRC value that is read by the database manager to verify the integrety of that page. This errors means that one or more sectors of data within the file are corrupte; this could be a logical corruption or actual physical inability to reliably read the sector(s). The ESEUTIL tool can be used to attempt to repair or recover such a file if you do not have a successful, recent backup. Once you have a good copy of the store, it''s best to delete the store, run a disk scan both logical and physical (bad cluster check) before recreating the store if you continue to use the same drive.
|Private comment: Subscribers only. See example of private comment|
|Links: ME318429, ME810333, ME814891, ME840013, Veritas Support Document ID: 253561, EventID 478 from source ESE98|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated