Using Eseutil /MH - How to check which Transaction log files are not committed

You have been busy and have not had the time to check your backups recently, all of a sudden your all of the Exchange Databases go offline, after some investigation you realise your full backup has not ran for several weeks and the drive that houses these transaction logs is now full. This is an extremely common issue, and I see it in the real world on a regular basis, a lot often than I should.

We are lucky as the quickest and easiest way to get your Storage Group and its Information Stores back online is to move the committed Exchange Transaction Logs files to another location.

How do I know which Transaction log files aren’t committed?

One of the features of Eseutil is its ability to read the header information of an Exchange Database or a Checkpoint file to give you various information including the transaction log files that have not yet been committed.

How to read the Log Required value of an MDB or STM file

 In order to read the header information for each edb and stm file in the storage group that has stopped, but as your Database file/s have become dismounted because of a full volume, this is not an issue. The command to show the Log Required value is:

Eseutil /MH <database_name>

Performing this command will display the header information similar to shown in figure 1 below:

Figure 1: The Exchange Database header information

From the Example in Figure 1 the Log Required Value is 0-0 which basically means my database is in a clean shutdown state and all log files are committed. This value specifies the log files required for the Exchange Database to mount and means if the value of Log Required was anything other than 0-0, you can move log files that are lower than the lowest value of this field.

In any version of Exchange Pre Exchange 2003 SP1 you will need to convert this decimal value to a Hexadecimal value but with Eseutil from Exchange 2003 SP1 and above this value will already be in Hexadecimal.

You should never move the latest log file as this will prevent log files from being played back in a recovery scenario. This rule should always be followed even if the databases are in a clean shutdown state.

TIP: You can find the location of your Exchange mdb and stm files by Opening the Exchange Administrator in Exchange 2003 server and navigating to:  Servers |  | First Storage Group

> | Right click on the dismounted Information Store selecting Properties and click on the Database Tab

You can now simply copy and paste the Exchange Database location into the command line saving you typing

It is highly recommended that you perform a full backup after this procedure; if this backup is successful you can safely delete the transaction log files that were moved.