ESENT Event ID 474 Database page cache error

[William]

I am getting the following error in the event viewer. I have ran microsoft
updates and rebooted the server. I can a chkdsk on both partitions C: and D:
as well as updating all Dell firmware/drivers.

I am having a problem with the server completely freezing. The last event in
the application log that happened before it froze was "Starting up database
"SUSDB". I removed the Windows Server Update Services.



Event Type: Error
Event Source: ESENT
Event Category: Database Page Cache
Event ID: 474
Date: 7/6/2009
Time: 9:06:16 AM
User: N/A
Computer: HRD-PE1900
Description:
ntfrs (5940) The database page read from the file
"c:\windows\ntfrs\jet\ntfrs.jdb" at offset 29401088 (0x0000000001c0a000) for
4096 (0x00001000) bytes failed verification due to a page checksum mismatch.
The expected checksum was 3809976736 (0xe317a1a0) and the actual checksum was
3395199392 (0xca5ea1a0). The read operation will fail with error -1018
(0xfffffc06). If this condition persists then please restore the database
from a previous backup. This problem is likely due to faulty hardware.
Please contact your hardware vendor for further assistance diagnosing the
problem.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[Al Williams]

First, make a full backup (you will need it -- especially if your disks are
going).

Second, verify your disks and I/O (RAID?) controllers. If you have more
than one database getting corrupted then something may be very wrong with
your hardware. Do a full check with bad block checking on.

As your server is freezing this usually means hardware so check all your
fans and power supplies.

Third, verify your server's anti-virus is not scanning and "attempting to
cure" any of the system databases, exchange stores, etc. (google "sbs2003
antivirus exclusions" for a specfic list)

I'm *fairly* sure you can recover from this latest corruption by simply
stopping the FRS service and renaming the files as per below but you need to
find out why they are getting corrupted.

Resetting the FRS database with the following steps:

1) Stop the netlogon and file replication services on the domain
controller.
2) Rename the ntfrs.jdb file in the <windir>\ntfrs\jet folder.
3) Rename the edb.chk file in the <windir>\ntfrs\jet\Sys folder.
4) Rename the edb.log file, the res1.log file, and the res2.log file in
the <windir>\ntfrs\jet\log folder.
5) Start netlogon and file replication service on the domain controller.
Then check how it works.
--
Allan Williams

Post by William
I am getting the following error in the event viewer. I have ran
microsoft updates and rebooted the server. I can a chkdsk on both
partitions C: and D: as well as updating all Dell firmware/drivers.
I am having a problem with the server completely freezing. The last
event in the application log that happened before it froze was
"Starting up database "SUSDB". I removed the Windows Server Update
Services.
Event Type: Error
Event Source: ESENT
Event Category: Database Page Cache
Event ID: 474
Date: 7/6/2009
Time: 9:06:16 AM
User: N/A
Computer: HRD-PE1900
ntfrs (5940) The database page read from the file
"c:\windows\ntfrs\jet\ntfrs.jdb" at offset 29401088
(0x0000000001c0a000) for 4096 (0x00001000) bytes failed verification
due to a page checksum mismatch. The expected checksum was 3809976736
(0xe317a1a0) and the actual checksum was 3395199392 (0xca5ea1a0).
The read operation will fail with error -1018 (0xfffffc06). If this
condition persists then please restore the database from a previous
backup. This problem is likely due to faulty hardware. Please
contact your hardware vendor for further assistance diagnosing the
problem.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[William]

Thanks Al

Before you replied I renamed the ntfrs.jdb file and started the service back
up. The errors have since gone away.

Any place you can recommend where I can learn more about the File
Replication service and what the files do that I renamed?

Post by Al Williams
First, make a full backup (you will need it -- especially if your disks are
going).
Second, verify your disks and I/O (RAID?) controllers. If you have more
than one database getting corrupted then something may be very wrong with
your hardware. Do a full check with bad block checking on.
As your server is freezing this usually means hardware so check all your
fans and power supplies.
Third, verify your server's anti-virus is not scanning and "attempting to
cure" any of the system databases, exchange stores, etc. (google "sbs2003
antivirus exclusions" for a specfic list)
I'm *fairly* sure you can recover from this latest corruption by simply
stopping the FRS service and renaming the files as per below but you need to
find out why they are getting corrupted.
1) Stop the netlogon and file replication services on the domain
controller.
2) Rename the ntfrs.jdb file in the <windir>\ntfrs\jet folder.
3) Rename the edb.chk file in the <windir>\ntfrs\jet\Sys folder.
4) Rename the edb.log file, the res1.log file, and the res2.log file in
the <windir>\ntfrs\jet\log folder.
5) Start netlogon and file replication service on the domain controller.
Then check how it works.
--
Allan Williams

Post by William
I am getting the following error in the event viewer. I have ran
microsoft updates and rebooted the server. I can a chkdsk on both
partitions C: and D: as well as updating all Dell firmware/drivers.
I am having a problem with the server completely freezing. The last
event in the application log that happened before it froze was
"Starting up database "SUSDB". I removed the Windows Server Update
Services.
Event Type: Error
Event Source: ESENT
Event Category: Database Page Cache
Event ID: 474
Date: 7/6/2009
Time: 9:06:16 AM
User: N/A
Computer: HRD-PE1900
ntfrs (5940) The database page read from the file
"c:\windows\ntfrs\jet\ntfrs.jdb" at offset 29401088
(0x0000000001c0a000) for 4096 (0x00001000) bytes failed verification
due to a page checksum mismatch. The expected checksum was 3809976736
(0xe317a1a0) and the actual checksum was 3395199392 (0xca5ea1a0).
The read operation will fail with error -1018 (0xfffffc06). If this
condition persists then please restore the database from a previous
backup. This problem is likely due to faulty hardware. Please
contact your hardware vendor for further assistance diagnosing the
problem.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[Al Williams]

FRS is not really used with SBS unless you have other domain controllers.
Just google "file replication service" and you'll get more information than
you need...

Make sure you look into my other points regarding HW and AV settings - your
server should never hang.
--
Allan Williams

Post by William
Thanks Al
Before you replied I renamed the ntfrs.jdb file and started the
service back up. The errors have since gone away.
Any place you can recommend where I can learn more about the File
Replication service and what the files do that I renamed?

Post by Al Williams
First, make a full backup (you will need it -- especially if your
disks are going).
Second, verify your disks and I/O (RAID?) controllers. If you have
more than one database getting corrupted then something may be very
wrong with your hardware. Do a full check with bad block checking
on.
As your server is freezing this usually means hardware so check all
your fans and power supplies.
Third, verify your server's anti-virus is not scanning and
"attempting to cure" any of the system databases, exchange stores,
etc. (google "sbs2003 antivirus exclusions" for a specfic list)
I'm *fairly* sure you can recover from this latest corruption by
simply stopping the FRS service and renaming the files as per below
but you need to find out why they are getting corrupted.
1) Stop the netlogon and file replication services on the domain
controller.
2) Rename the ntfrs.jdb file in the <windir>\ntfrs\jet folder.
3) Rename the edb.chk file in the <windir>\ntfrs\jet\Sys folder.
4) Rename the edb.log file, the res1.log file, and the res2.log file in
the <windir>\ntfrs\jet\log folder.
5) Start netlogon and file replication service on the domain
controller. Then check how it works.
--
Allan Williams

Post by William
I am getting the following error in the event viewer. I have ran
microsoft updates and rebooted the server. I can a chkdsk on both
partitions C: and D: as well as updating all Dell firmware/drivers.
I am having a problem with the server completely freezing. The last
event in the application log that happened before it froze was
"Starting up database "SUSDB". I removed the Windows Server Update
Services.
Event Type: Error
Event Source: ESENT
Event Category: Database Page Cache
Event ID: 474
Date: 7/6/2009
Time: 9:06:16 AM
User: N/A
Computer: HRD-PE1900
ntfrs (5940) The database page read from the file
"c:\windows\ntfrs\jet\ntfrs.jdb" at offset 29401088
(0x0000000001c0a000) for 4096 (0x00001000) bytes failed verification
due to a page checksum mismatch. The expected checksum was
3809976736 (0xe317a1a0) and the actual checksum was 3395199392
(0xca5ea1a0). The read operation will fail with error -1018
(0xfffffc06). If this condition persists then please restore the
database from a previous backup. This problem is likely due to
faulty hardware. Please contact your hardware vendor for further
assistance diagnosing the problem.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[Miles Li [MSFT]]

Hello,

More related tech article about FRS:


File Replication Service
http://technet.microsoft.com/en-us/library/cc978206.aspx

Description of FRS entries in the registry
http://support.microsoft.com/kb/221111

HOW TO: Relocate the NTFRS Jet Database and Log Files
http://support.microsoft.com/kb/221093


If you have any questions or concerns, please do not hesitate to let me
know.



Best regards,

Miles Li
Microsoft Online Newsgroup Support

==================================================================
Please post your EBS related questions to the EBS newsgroup on Connect
website:
https://connect.microsoft.com/ebs08/community/discussion/richui/default.aspx


If you want to use a newsreader other than a web forum to access these
newsgroups,
please refer to the following blog to apply NNTP password and configure a
newsreader:
http://msmvps.com/blogs/bradley/archive/2008/11/02/signing-up-for-the-sbs-20
08-newsgroups.aspx
==================================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
==================================================================