File System Structure Corrupt?

[NRC Help]

Hello all,

We have an Windows 2003 SP2, Exchange 2003 SP2 server which had a drive fail
(Dell PowerEdge 2650, 5 drives all in a single RAID 5 container). The drive
was replaced, virtual disk auto-regenerated, and Dell OpenManage says
everything is OK.

However, we are seeing the error messages below in the event logs about once
per day (they began before the drive was actually swapped out) I assume my
only option here is to run chkdsk? If so, which options do you recommend? I
know the system will need to be rebooted for any corrections to be made by
chkdsk, so this will need to occur after hours, and I would like to minimize
down time while at the same time do what is right to prevent future outages.

Source: Ntfs
Category: (2)
Event ID: 55
"The file system structure on the disk is corrupt and unusable. Please run
the chkdsk utility on the volume \Device\VSPSnapshot0."

And..

"The file system structure on the disk is corrupt and unusable. Please run
the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy8."

Thank you for the help.

Jim Willson

[Sean Cai [MSFT]]

Hello Jim,

I'm Sean from Microsoft CIBS OS & APP team and I'll helping you on this
issue. Regarding your description of the problem: you have ntfs event 55.
If I have misunderstood, please let me know.

I suggest you to run chkdsk without any switch first. When chkdsk run
without /F parameter, it's working in a "read-only" mode which will check
disk only and doesn't try to fix them. I believe you will have a general
idea about the problem. If you want to fix the problem, just reboot server.
Since the dirty bit was set when the event 55 was posted.

The volume name "\Device\HarddiskVolumeShadowCopy8" means it's a shadow
copy. You can assign a driver letter with a mps report tool dosv.exe. Here
are the articles you can refer to:
A bit of black magic: How to assign drive letters to VSS shadow copies...
on Windows XP !
http://blogs.msdn.com/adioltean/arch...18/761515.aspx
DOSDEV.EXE - a misterious tool
http://blogs.msdn.com/adioltean/arch...04/477164.aspx

And here is the MPS Report tools download link. Dosdev is a tool of cluster
mps report tool:
Microsoft Product Support's Reporting Tools
http://www.microsoft.com/downloads/d...c7c-7ca5-408f-
88b7-f9c79b7306c0&DisplayLang=en

I don't know what's \Device\VSPSnapshot0, but I think it's safe to check it
with dosdev.

I hope the information above can address your concerns. If anything is
unclear, please feel free to let us know.

Sean Cai, MCSE2000
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[NRC Help]

Hello Sean,

Thanks for the links to the tools, I will check them out.

Is there any way to tell which drive letter, C or D, the volume shadow copys
are on?. Basically I need to know if I'm looking at running chkdsk on the C,
D, or both drives.

Oddly enough, I just checked and I do not have Shadow Copies enabled on the
C or D drive on this server, which are the only hard drives. So why am I
seeing regarding shadow copies if I have it disabled? Is this an Exchange
2003 function?

I am also getting the following BackupExec errors when trying to back up
this server:

"Backup- \\MERCURY\C: Directory WINDOWS\system32\inetsrv\ was not found, or
could not be accessed.
None of the files or subdirectories contained within will be backed up."

"Backup- \\MERCURY\System?State \\MERCURY\System?StateV-79-57344-65245 - A
failure occurred accessing the object list."

The inetsrv is obviously the C drive and I am assuming the System State is
also on the C drive, at least by default?

Again, since this is our one and only mail server I do not wan to take it
down unless I have to. I will run chkdsk without switches first, but it would
be good to know if just one or both of the drives need to be repaired. The
Exchange information store etc. is stored on the Drive by the way.
Thanks,

Jim Willson

"Sean Cai [MSFT]" wrote:

> Hello Jim,
>
> I'm Sean from Microsoft CIBS OS & APP team and I'll helping you on this
> issue. Regarding your description of the problem: you have ntfs event 55.
> If I have misunderstood, please let me know.
>
> I suggest you to run chkdsk without any switch first. When chkdsk run
> without /F parameter, it's working in a "read-only" mode which will check
> disk only and doesn't try to fix them. I believe you will have a general
> idea about the problem. If you want to fix the problem, just reboot server.
> Since the dirty bit was set when the event 55 was posted.
>
> The volume name "\Device\HarddiskVolumeShadowCopy8" means it's a shadow
> copy. You can assign a driver letter with a mps report tool dosv.exe. Here
> are the articles you can refer to:
> A bit of black magic: How to assign drive letters to VSS shadow copies...
> on Windows XP !
> http://blogs.msdn.com/adioltean/arch...18/761515.aspx
> DOSDEV.EXE - a misterious tool
> http://blogs.msdn.com/adioltean/arch...04/477164.aspx
>
> And here is the MPS Report tools download link. Dosdev is a tool of cluster
> mps report tool:
> Microsoft Product Support's Reporting Tools
> http://www.microsoft.com/downloads/d...c7c-7ca5-408f-
> 88b7-f9c79b7306c0&DisplayLang=en
>
> I don't know what's \Device\VSPSnapshot0, but I think it's safe to check it
> with dosdev.
>
> I hope the information above can address your concerns. If anything is
> unclear, please feel free to let us know.
>
> Sean Cai, MCSE2000
> Microsoft Online Partner Support
>
> Get Secure! - www.microsoft.com/security
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

[Sean Cai [MSFT]]

Hello Jim,

Shadow copy is widely used by backup software, not only in system. Please
refer to the following article for the information about how to query VSS
information:
Vssadmin
http://technet2.microsoft.com/window...1-6977-4808-9a
d5-476c9eaecaa51033.mspx?mfr=true

I suggest you try use NTbackup to backup a few folders. This should trigger
more VSS error and would help us diagnose the problem.

I hope the information above can address your concerns. If anything is
unclear, please feel free to let us know.

Sean Cai, MCSE2000
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[Sean Cai [MSFT]]

Hello ,

How is everything going? Please keep us posted on your progress and let us
know if you have any additional questions or concerns.

Best Regards,

Sean Cai, MCSE2000
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[NRC Help]

Hello Sean,

Well I ran chkdsk on the volume and it found 9 orphaned files and corrected
the issue. The backups are now running without error, and there are no errors
in the event log. It looks like the problem has been resolved.

Thanks for the help.

Jim Willson

"Sean Cai [MSFT]" wrote:

> Hello ,
>
> How is everything going? Please keep us posted on your progress and let us
> know if you have any additional questions or concerns.
>
> Best Regards,
>
> Sean Cai, MCSE2000
> Microsoft Online Partner Support
>
> Get Secure! - www.microsoft.com/security
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

[Sean Cai [MSFT]]

Hello ,

Great! It's glad to know the problem is fixed. If you need anything else,
please let me know. I'll be glad to be of help.

Best Regards,

Sean Cai, MCSE2000
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.