Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Information Store (<process id>) An attempt to read from the file "<path to edb file>" at offset <offset> for <number> bytes failed with system error <error code>: "<error description>". The read operation will fail with error <read error code>. If this error persists then the file may be damaged and may need to be restored from a previous backup.
|English: Request a translation of the event description in plain English.|
- Error code: 21 (0x00000015) - See ME812452.
See ME828535 for a hotfix applicable to Microsoft SharePoint Portal Server 2001.
See the link to "EventID 481 from source ESE98" for more information on this event.
File: priv1.edb, error 21 = "The device is not ready" - This may indicate that the drive that holds the priv1.edb file is not mounted or otherwise unavailable. This may be the case with clusters with failed disk resources.
File: priv1.edb, error 23 = "Data error (cyclic redundancy check)" - From a newsgroup post: "The problem is that your Information Store is lying on a bad block on HDD. Run chkdsk utiity with automatically fix error checked." Depending on the condition of the hard drive it might be necessary to replace it and restore Exchange from a good backup.
File: pub1.edb, error 1117 = "The request could not be performed because of an I/O device error" - Right after logging this error, Public Folder content could not be accessed, even though the Store showed to be mounted. No TSE client session could be established, nor could an operator log on at the console. The server had to be reset. Exchange recovered without event. While I cannot assert causality between this single event and the above symptoms, it is roughly coincident with an Adaptec Storage Manager notification:
Event: Device ST173404LC (1:00:0) is offline.
Subject Name: ST173404LC (1:00:0)
Host Name: server
Time stamp: Sun Jul 06 05:15:47 CDT 2003
|Private comment: Subscribers only. See example of private comment|
|Links: ME812452, ME828535, EventID 481 from source ESE98|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated