Microsoft(r) Exchange Server Utilities – ESEutil & ISinteg by: Troy Werelius

Microsoft includes two command line utilities with Exchange Server that are designed to accomplish various maintenance functions within the Exchange database. They are limited, complex, tedious, and time consuming when compared to the functionality contained within GOexchange. The best time to learn how to use these tools is in a lab environment before you need them. Like firearms and prescription medications, these tools can be dangerous if you don't understand how they work and when to use them. Imagine shooting a shotgun at a container full of water—a graphic demonstration of what can happen when you mishandle a powerful tool. These two utilities are named ESEutil and ISinteg.

ESEutil checks and fixes individual database tables and ISinteg checks and fixes the links between tables.

To better understand the difference between ESEutil and ISinteg, let’s use a building construction analogy.

Running ESEutil is like having a structural engineer check your house's foundation. The engineer doesn't care what's inside the house. The engineer cares only whether the underlying structure is sound.

Running ISinteg is like having an interior decorator come inside your house to check the way you've laid out your furnishings. The decorator doesn't care about the house's foundation. The decorator cares only whether the rooms' layout and decor meet with their approval.

As you can see from the analogy above, both ESEutil and ISinteg are vastly different utilities, but they are complimentary and in some ways dependent upon each other to provide proper Exchange maintenance. In the next section, we will provide a more in-depth description of these two Microsoft Exchange utilities.

About ESEutil

ESEutil checks and fixes individual database tables but does not check the mail data contained in the Extensible Storage Engine (ESE) database. Object-oriented databases like Microsoft Exchange consist of big, structured sequential files connected by a set of indexes. The underlying database technology that controls these files is called Indexed Sequential Access Method, or ISAM. The ESE database engine exposes the flat ISAM structure as a hierarchy of objects.

The function of ESEutil is to examine these individually indexed object pages, check them for correctness by comparing a computed checksum against a checksum stored in the page header, and verify that each page's data is consistent.

ESEutil isn't for casual use. So, don't use ESEutil unless you absolutely need to run it and you understand what it does. To understand ESEutil, you need to know about the format of the ESE database in which ESEutil works and you need to be familiar with ESEutil's many modes of operation.

ESEutil is a useful tool because it can operate in many modes. Each mode, however performs different functions with limitations or caveats.

Defragmentation: ESEutil /d [options]

Recovery: ESEutil /r [options]

Integrity: ESEutil /g

Repair: ESEutil /p [options]

Checksum: ESEutil /k [options]

The way that each of these functions is executed within the utility is to use a cryptic MS-DOS-like command structure as the parameter qualifier. For example, in order to run the defragmenter portion of the utility, an administrator would run “ESEutil /d [options]” and so on. For additional information on ESEutil, please refer to the GOexchange FAQ on our website – Microsoft ESEutil: www. goexchange. com/faq_GEvsMStools4. html

We are not going to attempt to cover all the potential pitfalls with ESEutil, however, here are a few major issues regarding ESEutil to keep in mind:

There are times when it is appropriate to use ESEutil on its own, however, a complete maintenance process includes the combined use of specific ESEutil and ISinteg commands, as well as other steps that must be undertaken.

ESEutil is very powerful tool and, if the commands are entered improperly or in an incorrect order, the results can be catastrophic.

The ESEutil command structure can be very confusing and, at times, misleading. Changing one letter in the command structure executes a completely different utility function, and the results to an Exchange database can be disastrous.

Below are a few of the many different available modes and options for ESEutil, each of which can have very different results on a database. NOTE: For brevity we have not included entire command statements.

- “ESEutil /d” will defragment the designated database and is a fairly straight forward mode of operation that is commonly used.

Running a manual offline defragmentation is only part of the process that should be completed in order to keep the databases healthy. Many administrators run ESEutil on a database to remove deleted items and regain white space then, mistakenly assume that by doing so, the process is complete. Performing this task, however, doesn't check or address issues that may exist within the mail data itself, and it won't fix the links between the tables of an ESE database. The database now contains a higher percentage of errors, warnings, and minor inconsistencies than it did prior to defragmentation. NOTE: Running ESEutil repeatedly without implementing a complete offline maintenance process is certain recipe for disaster.

- “ESEutil /d /p” will have a slightly different result.

The “/d” tells ESEutil to defragment the designated database. The “/p” option used with the “/d” instructs ESEutil to leave the newly created defragmented database in the temporary work area and not to overwrite the original database.

- Now slightly modify the command to “ESEutil /p” and the actions taken on the designated database are extremely different. The “/p” evokes the Exchange “Repair” mode. At first glance this sounds like a great thing to do, and it couldn’t hurt to try because repairing the database should be beneficial right? Wrong!

This command actually invokes a “Hard Repair” mode of ESEutil. This means that ESEutil will attempt to repair corrupt pages, but it makes no attempt to put the database in a consistent state.

If it finds problems that cannot be corrected, then those pages will be discarded. Each page contains data therefore each discarded page represents data loss. Discarding certain pages of the database can actually render it useless. In other words, wave goodbye to your data.

Sometimes, using the repair mode is the only way to fix a database. In the vast majority of situations, however, it should be avoided except as a last resort and there are specific steps that should be taken pre and post use of “Repair /p” mode.

About ISinteg

The purpose of the Microsoft ISinteg utility is to inspect and fix weaknesses within the information store (IS). ISinteg looks at the mailboxes, public folders, and other parts of the IS, checking for anything that appears to be out of place. ISinteg scans the tables and B-trees that organize the ESE pages into their logical structures. In addition, the tool looks for orphaned objects, or objects that have incorrect values or references.

Because ISinteg focuses on the logical level rather than physical database structure, it can repair and recover data that ESEutil can't. When looking at the physical database level, ESEutil might find the data to be valid because it looks for things such as page integrity and B-Tree structure. Data that appears valid to ESEutil from a physical view of the database might not be valid from a logical view. For example, data for various IS tables like the message, folder, or attachments table may be intact, but the relationships among tables or records within tables may be broken or incorrect because of corruption in the logical structure. This corruption can render the database unusable.

Logical corruption of your Exchange Server databases is problematic and much more difficult to diagnose and repair than physical corruption. The user and administrator are, typically, unaware of a logical corruption occurrence. No specific symptoms identify logical corruption. Often, when an administrator discovers the logical corruption, it's too late for any repairs to take place.

You can run ISinteg one of two ways:

Default mode, in which the tool runs the tests you specify and reports its findings.

Fix mode, where you specify optional switches instructing ISinteg to run the specified tests and attempt to fix whatever it can.

The most important thing about running ISinteg is to run the command until it no longer reports any problems. Just running the command once does not guarantee that the information store is functioning properly. Depending on the size of the information store, the process can take a long time, however, it ensures that the databases are properly functional. For additional information on ISinteg, please refer to the GOexchange FAQ on our website – Microsoft ISinteg: www. goexchange. com/faq_GEvsMStools5. html

Author:
Troy Werelius

About the Author:
Troy Werelius is CEO of Lucid8 LLC, the creators of “GOexchange, the Automated Maintenance Solution for Microsoft Exchange 5.5, 2000 and 2003 Servers”. GOexchange prevents disasters, repairs problems, and accelerates performance. Visit www.goexchange.com for a free DEMO copy of GOexchange.