Using Troubleshooting Tools

[Previous] [Next]

When you troubleshoot a system as complex as Exchange 2000 Server, your most valuable tool is your understanding of the system itself. This understanding includes knowledge of how Exchange 2000 Server works in general and how your organization is set up in particular. Ideally, this book has given you a good understanding of Exchange 2000 Server and, if you took the advice in Chapter 5, you have completely documented your network. With this knowledge in hand, you are ready to find and repair whatever may go wrong in your organization. This section introduces some of the tools that you will use in the process.

Inbox Repair Tool

Not all problems in an Exchange organization occur on an Exchange server. Many users keep personal folders and offline folders on their client computers. A set of personal folders is stored as a single file with the extension .PST, as shown in Figure 25-1. Multiple sets of personal folders can be stored on a single client. A set of offline folders is stored as a single file with the extension .OST. Like any other type of file, personal and offline folder files can become corrupt. Fortunately, Microsoft Outlook provides the Inbox Repair Tool, which helps you repair corrupt personal and offline folder files.

Figure 25-1. Personal folders stored in a .PST file.

The Inbox Repair Tool (Scanpst.exe) is installed during a typical installation of Microsoft Outlook, but no shortcut is created on the Start menu. You can find the file Scanpst.exe in the \Program Files\Common Files directory for Outlook 98 and in the \Program Files\Common Files\System\Mapi\1033\NT directory for Outlook 2000. Note that these are default paths that may be changed during client installation.

When you launch the Inbox Repair Tool, a dialog box appears in which you can enter the path and filename of the corrupt file and then click Start (Figure 25-2). However, before you run the Inbox Repair Tool, you should back up the existing file that you are attempting to repair. The Inbox Repair Tool often discards messages that it cannot repair. Without a backup, these messages are permanently lost.

Figure 25-2. The Inbox Repair Tool.

The Inbox Repair Tool examines the entire contents of the specified file, as shown in Figure 25-3, discarding messages that cannot be repaired and moving the rest to a specially created Lost And Found folder. When the Inbox Repair Tool finishes running, launch Outlook to access this Lost And Found folder. You should create a new set of personal folders and move any recovered items to these new folders.

Figure 25-3. The Inbox Repair Tool scanning a .PST file.

RPC Ping Utility

Many of the connections among computers in an Exchange organization rely on remote procedure calls (RPCs). Simply put, an RPC calls a protocol that allows a program on one computer to execute a program on another computer. Exchange servers in a routing group rely on RPCs to communicate with one another. Exchange clients connect to Exchange servers by using RPCs. Likewise, the Exchange System snap-in connects to remote Exchange servers via RPCs. Often, connectivity problems in an Exchange organization are the result of bad RPC connectivity.

You can use the RPC Ping utility to confirm the RPC connectivity between two systems as well as to make sure that Exchange services are responding to requests from clients and other servers. RPC Ping has two components: a server component and a client component. You can find both of these components on the Exchange 2000 Server installation CD-ROM in the \Support\Rpcping directory.

RPC Ping Server

The server component of RPC Ping is a file named Rpings.exe, which you must start on the server before using the client component. To run the server component, type Rpings.exe at the command prompt. This command runs the server component using all available protocol sequences, as shown in Figure 25-4. A protocol sequence is a routine that allows the return of a ping for a given networking protocol, such as TCP/IP or IPX/SPX. You can also restrict the server component to any single protocol sequence by using the following switches:

• -p ipx/spx
• -p namedpipes
• -p netbios
• -p tcpip
• -p vines

To exit the RPC server, type the string @q at the RPC server command prompt.

Figure 25-4. RPC Ping running on an Exchange server.

NOTE

---

You can control which protocols RPC uses on each client to communicate with the Exchange server and in what order by making a modification in the registry. Navigate using Regedit.exe or Regedt32.exe to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Exchange Provider, and modify Rpc_Binding_Order. The protocols used—in their default order—and the corresponding entries in the registry are as follows:

ncalrpc Local RPC	ncacn_np Named pipes
ncacn_ip_tcp TCP/IP	netbios NetBIOS
ncacn_spx IPX/SPX	ncacn_vns_spp VINES IP

For more information on changing your RPC binding order, see Microsoft Knowledge Base article Q163576.

RPC Ping Client

After you launch the RPC Ping server on the Exchange server, you use the RPC Ping client, shown in Figure 25-5, on another computer to test RPC connectivity to that server. There are four versions of the RPC Ping client; the version you use depends on the operating system or the processor on the client. Each of the versions has the same name, Rpingc.exe, and they are found in different subdirectories within the \Support\Rpcping directory.

Figure 25-5. Checking RCP connectivity with Rpingc.exe.

The options you provide are rather simple:

• Exchange Server Specifies the NetBIOS name or IP address (if TCP/IP is used on the network) of the server running the RPC Ping server.
• Protocol Sequence Specifies the RPC mechanism that will be used in the test. Options include Any (all protocol sequences are tested), Named Pipes, IPX/SPX, TCP/IP, NetBIOS, and VINES. Set the protocol sequence to correspond to the protocol sequence setting on the RPC server.
• Endpoint Specifies protocol-specific ports that the RPC client uses to communicate with the server. Choose Rping to collect information about RPC Ping client-to-server communication itself. Choose Store to simulate communications with the Information Store service on the Exchange server. Choose Admin to simulate communications with the Exchange server.
• Number Of Pings Specifies whether to ping the server continuously or a certain number of times. This option is available only if you choose Ping Only mode.
• Mode Specifies the mode. Ping Only means that the ping is returned directly by the RPC Ping server. Endpoint Search returns Pings from detected endpoints.
• Run With Security Verifies authenticated RPCs.

If the RPC Ping from the client is successful with a particular protocol, you'll want to move that protocol to first in the binding order so that the client system will not have any problems connecting to the Exchange server. If the RPC Ping is not successful over any protocols, check for a corrupted RPC.DLL file on the client. There are nine RPC.DLL files used to support RPC for Windows 2000 and Windows NT clients. All of these files are included in the Windows 2000 operating system, just as they are for Windows 95 and 98. For MS-DOS and 16-bit Windows clients, the RPC.DLL files used for RPC are included with Exchange Client. If replacing these .DLL files does not fix the problem, trace the packets between the client system and the Exchange server. A packet analyzer such as Network Monitor, a Windows 2000 utility, can be handy in this situation. For information on using Network Monitor to analyze remote procedure calls on a TCP/IP network, see Microsoft Knowledge Base article Q159298, "Analyzing Exchange RPC Traffic Over TCP/IP."

MTA Check Utility

The Message Transfer Agent (MTA) was responsible for the transfer of all messages outside Exchange Server 5.5. Now, the MTA's use is limited to handling message transfer for the X.400 Connector. The MTA maintains a separate message queue for each X.400 Connector to which it routes messages.

All of the MTA's message queues are stored in files that have a .DAT extension. These files are located in the \Exchsrvr\Mtadata directory on the Exchange server. These files can become corrupted, just like any other files. Corruption of .DAT files typically happens during an improper shutdown of the MTA, such as during a power failure. It can result in message delivery problems and MTA startup problems.

The MTA Check utility (Mtacheck.exe) is a command-line tool that attempts to fix all MTA message queues and the messages that those queues contain. It automatically discards all corrupt messages from the queues, backing up those messages in the \Exchsrvr\Mtadata\Mtacheck.out directory.

When the MTA service starts, it automatically runs the MTA Check utility if it determines that the MTA was not shut down properly. During an automatic check, events are logged to the Windows 2000 application log, and an Mtacheck.log file is created in the \Exchsrvr\Mtadata\Mtacheck.out directory. You can also run the MTA Check utility manually by using the command mtacheck.exe. The utility is found in the \Exchsrvr\Bin directory. The MTA service must be stopped when you run this utility manually. Mtacheck.exe supports the following command-line options:

• /f <filename> Logs status information to a file with the specified name.
• /v Enables verbose logging and must be used with the /f switch
• /rd Removes all queued directory replication messages
• /rp Removes all queued public folder replication messages
• /rl Removes all queued link monitor test messages

If the MTA Check utility encounters a problem with a queue, you will see an error in the log like the following:

 Queue '241062' required reconstruction - corrupted queue file 69 messages recovered to the queue Other items in the log may consist of the following entry, which reflects a missing file: Object 300596 invalid - missing object file Object removed from queue '060193' MTS-ID: c=US;a= ;p=Lar;l=Seattle0196012020010800000CDE 

After the MTA Check utility completes processing, it will return one of the following messages to show the outcome:

 Database clean, no errors detected. Database repaired, some data may have been lost. <number> queue(s) required repair out of <percent> detected. <number> object(s) damaged out of <percent> detected. Database has serious errors and cannot be reconstructed. Some objects missing from the Boot Environment. Please reload the files from the BOOTENV directory on the install CD. 

Figure 25-6 shows the results of running the MTA Check utility on an Exchange server.

Figure 25-6. Results of running the MTA Check utility on an Exchange server.

eseutil.exe Offline Tool

The public folder store and the mailbox store on an Exchange server begin as empty database files. As messages accumulate, these databases grow. Unfortunately, they do not shrink when messages are deleted. Instead, the emptied space is simply marked as available for use during routine garbage collection performed by the Information Store service. When new messages are stored in the databases, they are written in any available free space before the database enlarges to hold them. This method of using free space can result in single items actually being broken up and stored in several physical places within the database—a process known as fragmentation.

During their scheduled maintenance cycles, the Information Store service defragments the databases. It also checks for database inconsistencies every time the server is shut down or started. Because of this routine maintenance, fragmentation itself is not much of a problem on an Exchange server. However, online defragmentation routines do nothing about the size of the databases themselves. To compact the databases, you must turn to an offline utility. Exchange 2000 Server provides an offline defragmentation tool named Eseutil.exe, which you can use to perform database defragmentation while the Information Store service is stopped.

CAUTION

---

Eseutil.exe is not meant to be used as a regular tool for maintenance of your Exchange servers. You should use it only when you are in contact with Microsoft Technical Support.

You can launch this tool by typing eseutil.exe at the command prompt from the program files\exchsrvr\bin directory. The eseutil.exe command allows you to perform three distinct functions:

• Defragmentation (/d) Defragments the database by moving the used pages in the database into contiguous blocks in a new database. Unused pages are discarded, which is the only way to recover empty space inside the database for other uses. By default, eseutil.exe writes the contents of the database file to a temporary file, tempdfrg.edb. When this process is complete, the temporary database becomes the new database and replaces the original database. While it is possible to place this temporary file on another server across the network, this activity is not recommended since doing so will saturate your bandwidth and could take hours to complete. Once this new database is created, a new signature will be written to the database. As a result, previous transaction logs can no longer be played into the database nor can transactions created after the defragmentation be played into the old database. Therefore, after completing the defragmentation, you should perform a full online backup.
• Repair (/r) Examines the structure of the database and attempts to restore broken links. This process is slow and uncertain and should only be used as a last resort. If the repair finds a physical corruption, which will be seen as a -1018, -1019 or -1022 error, the injured page will be removed, resulting in a loss of data for that page. After the repair has completed, you will be instructed to delete all your current transaction logs. This step is necessary because the page numbers in the database will not correspond to the page numbers referenced in the transaction log files. Running a repair also rewrites the database signature.
• Integrity (/g) Checks the integrity of a database. The main purpose of this switch is to provide feedback to the development team for debugging purposes. This is a read-only command and does not make any changes to the database. It will check the database index, build a second index in a temporary database (integ.edb), and compare the two.