Chapter 28: TroubleshootingExchange Server 2003

Nothing is perfect—not your car, your house, or even Exchange Server 2003. It’s no wonder, then, that stores selling car parts and building supplies are successful. Even a stable system like Microsoft Exchange Server 2003 can break down once in a while. Troubleshooting Exchange Server 2003 is a skill that you will develop as you solve real problems on your network. One chapter cannot prepare you for all the possibilities you could face as an Exchange administrator. However, this chapter introduces some of the troubleshooting tools that are available in Exchange Server 2003 and discusses some places to find more information and help with specific types of Exchange problems.

Using Troubleshooting Tools

When you troubleshoot a system as complex as Exchange Server 2003, your most valuable tool is your understanding of the system itself. This understanding includes knowledge of how Exchange Server 2003 works in general and how your organization is set up in particular. Ideally, this book has given you a good understanding of Exchange Server 2003 and, if you took the advice in Chapter 5, “Assessing Needs,” you have completely documented your network. With this knowledge in hand, you are ready to find and repair whatever might go wrong in your organization. This section introduces some of the tools you will use in the process.

Inbox Repair Tool

Not all problems in an Exchange organization occur on an Exchange server. Many users keep personal folders and offline folders on their client computers. A set of personal folders is stored as a single file with the extension .PST, as shown in Figure 28-1. Multiple sets of personal folders can be stored on a single client. A set of offline folders is stored as a single file with the extension .OST. Like any other type of file, personal and offline folder files can become corrupt. Fortunately, Microsoft Outlook provides the Inbox Repair Tool, which helps you repair corrupt personal and offline folder files.

Figure 28-1: Personal folders stored in a .PST file.

The Inbox Repair Tool (Scanpst.exe) is installed during a typical installation of Microsoft Outlook, but no shortcut is created on the Start menu. You can find the file Scanpst.exe in the \Program Files\Common Files\System\MSMapi\1033 directory for Outlook 2003. Note that these are default paths that can be changed during client installation. When you launch the Inbox Repair Tool, a dialog box appears in which you can enter the path and filename of the corrupt file and then click Start (Figure 28-2).

Figure 28-2: The Inbox Repair Tool.

Once you start the scanning process, the Inbox Repair Tool examines the entire contents of the specified file and then shows you what it has found, as shown in Figure 28-3. The Inbox Repair Tool does give you a chance to back up the file before you perform repairs on it, and you should always use this option. The Inbox Repair Tool usually moves messages that it cannot repair to a special Lost and Found folder, but it often discards messages that it cannot repair. Without a backup, these messages are permanently lost. When the Inbox Repair Tool finishes running, launch Outlook to access this Lost And Found folder. You should create a new set of personal folders and move any recovered items to these new folders. Often, however, the Inbox Repair Tool will simply fix problems you are having in Outlook and should always be given a chance.

Figure 28-3: The Inbox Repair Tool scanning a .PST file.

RPing Utility

Many of the connections among computers in an Exchange organization rely on remote procedure calls (RPCs). As you know, an RPC calls a protocol that allows a program on one computer to execute a program on another computer. Exchange servers in a routing group rely on RPCs to communicate with one another. Exchange clients connect to Exchange servers by using RPCs. Likewise, the Exchange System snap-in connects to remote Exchange servers via RPCs. Often, connectivity problems in an Exchange organization are the result of bad RPC connectivity.

You can use the RPing utility to confirm the RPC connectivity between two systems as well as to make sure that Exchange services are responding to requests from clients and other servers. RPing has two components: a server component (rpings.exe) and a client component (rpingc.exe). You can find both of these components in the Windows Server 2003 Resource Kit tools directory following installation of the Resource Kit tools, which are available at http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff- 4ae7-96ee-b18c4790cffd&displaylang=en.

RPing Server

The server component of RPing is a file named rpings.exe, which you must start on the server before using the client component. To run the server component, type rpings.exe at the command prompt. This command runs the server component using all available protocol sequences, as shown in Figure 28-4. A protocol sequence is a routine that allows the return of a ping for a given networking protocol, such as TCP/IP or IPX/SPX. You can also restrict the server component to any single protocol sequence by using the following switches:

Figure 28-4: RPing running on an Exchange server.

• -p ipx/spx

• -p namedpipes

• -p netbios

• -p tcpip

• -p vines

To exit the RPing server, type the string @q at the RPC server command prompt.

RPing Client

After you launch the RPing server on the Exchange server, you use the RPing client, shown in Figure 28-5, on another computer to test RPC connectivity to that server.

Figure 28-5: Checking RCP connectivity with Rpingc.exe.

The options are straightforward, and the information you provide is rather simple:

• Exchange Server Specifies the NetBIOS name or IP address (if TCP/IP is used on the network) of the server running the RPing server.

• Protocol Sequence Specifies the RPC mechanism that will be used in the test. Options include Any (all protocol sequences are tested), Named Pipes, IPX/SPX, TCP/IP, NetBIOS, and VINES. Set the protocol sequence to correspond to the protocol sequence setting on the RPC server.

• Endpoint Specifies protocol-specific ports that the RPC client uses to communicate with the server. Choose Rping to collect information about RPing client-to-server communication itself. Choose Store to simulate communications with the Information Store service on the Exchange server, and choose Admin to simulate communications with the Exchange server.

• Number Of Pings Specifies whether to ping the server continuously or a certain number of times. This option is available only if you choose Ping Only mode.11.

• Mode Specifies the mode. Ping Only means that the ping is returned directly by the RPC Ping server. Endpoint Search returns Pings from detected endpoints.

• Run With Security Verifies authenticated RPCs.

If the RPing from the client is successful with a particular protocol, you’ll want to move that protocol to first in the binding order so that the client system doesn’t have any problems connecting to the Exchange server. If the RPC Ping is not successful over any protocols, check for a corrupted RPC.DLL file on the client. There are nine RPC.DLL files used to support RPC for Windows clients. All these files are included in the Windows Server 2003 operating system, just as they are for Microsoft Windows 95 and Microsoft Windows 98. For MS-DOS and 16-bit Windows clients, the RPC.DLL files used for RPC are included with Exchange Client. If replacing these .DLL files does not fix the problem, trace the packets between the client system and the Exchange server. A packet analyzer such as Network Monitor, a Windows utility, can be handy in this situation.

More Info

For information about using Network Monitor to analyze remote procedure calls on a TCP/IP network, see Microsoft Knowledge Base article Q159298, “Analyzing Exchange RPC Traffic Over TCP/IP.”

Note

The Microsoft Windows Server 2003 Resource Kit Tools, available for download at http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en, also supplies a utility named RPCPing, which is a simpler command-line tool that tests RPC connectivity for a computer. Open the command prompt, navigate to the Resource Kit tools directory, and type rpcping /? for a list of options to use with this command.

Eseutil.exe Offline Tool

The public folder store and the mailbox store on an Exchange server begin as empty database files. As messages accumulate, these databases grow. Unfortunately, they do not shrink when messages are deleted. Instead, the emptied space is simply marked as available for use during routine garbage collection performed by the Information Store service. When new messages are stored in the databases, they are written in any available free space before the database enlarges to hold them. This method of using free space can result in single items actually being broken up and stored in several physical places within the database—a process known as fragmentation.

During their scheduled maintenance cycles, the Information Store service defragments the databases. It also checks for database inconsistencies every time the server is shut down or started. Because of this routine maintenance, fragmentation itself is not much of a problem on an Exchange server. However, online defragmentation routines do nothing about the size of the databases themselves. To compact the databases, you must turn to an offline utility. Exchange Server 2003 provides an offline defragmentation tool named Eseutil.exe, which you can use to perform database defragmentation while the Information Store service is stopped.

Caution

Eseutil.exe is not meant to be used as a regular tool for maintenance of your Exchange servers. You should use it only when you are in contact with Microsoft Technical Support.

You can launch this tool by typing eseutil.exe at the command prompt from the program files\exchsrvr\bin directory. The eseutil.exe command allows you to perform eight distinct functions:

• Defragmentation (/d) Defragments the database by moving the used pages in the database into contiguous blocks in a new database. Unused pages are discarded, which is the only way to recover empty space inside the database for other uses. By default, eseutil.exe writes the contents of the database file to a temporary file, tempdfrg.edb. When this process is complete, the temporary database becomes the new database and replaces the original database.

  Although you can place this temporary file on another server across the network, this activity is not recommended because it will saturate your bandwidth and could take hours to complete. Once this new database is created, a new signature is written to the database. As a result, previous transaction logs can no longer be played into the database nor can transactions created after the defragmentation be played into the old database. Therefore, after completing the defragmentation, you should perform a full online backup.

• Recovery (/r) Performs a soft recovery, bringing all databases into a consistent state. This function is carried out automatically before a defragmentation begins.

• Integrity (/g) Checks the integrity of a database. The main purpose of this switch is to provide feedback to the development team for debugging purposes. This is a read-only command and does not make any changes to the database. It will check the database index, build a second index in a temporary database (integ.edb), and compare the two.

• File Dump (/m) Displays information about the database files, log files, and checkpoint files of a particular log file.

• Repair (/p) Examines the structure of the database and attempts to restore broken links. This process is slow and uncertain and should be used only as a last resort. If the repair finds a physical corruption, which will be seen as a -1018, -1019, or -1022 error in Event Viewer, the injured page is removed, resulting in a loss of data for that page. After the repair is completed, you are instructed to delete all your current transaction logs. This step is necessary because the page numbers in the database will not correspond to the page numbers referenced in the transaction log files. Running a repair also rewrites the database signature.

• Restore (/c) Used to bring a store into a consistent state. This function is performed automatically before a defragmentation.

• Checksum (/k) Calculates a checksum value and compares it to the data page’s checksum value. This function is performed automatically during the repair process.

• Copy File (/y) Makes a copy of the checkpoint file.