Avamar: How to recover an Exchange database from the "Dirty Shutdown" state

In a Microsoft Exchange environment the Exchange database might be in the "Dirty Shutdown" state for many different reasons, some of which are listed here:

• Faulty Exchange server updates or relying on outdated versions.
• EDB files are not detached from log files properly.
• Log files are missing from the server.
• Log files are damaged.
• The server is unable to read the log files.

However, in a backup and recovery environment (like Avamar) the Exchange database can also be seen in a "Dirty Shutdown" state. Usually, it is for a different reason.

• The typical scenario is when the database file is restored as a flat file using the Avamar user interface or using the avtar.exe command.
• In this case, the expected behavior is that the database will be in "Dirty Shutdown" state.
  • This means that the transaction log files have not been replayed yet to the database, since that is not part of the "flat file" restore operation.
  • This is different from the Exchange plug-in restore type, which would replay the logs as part of the restore process. 

An Exchange administrator would be familiar with all the above reasons and would also know how to address this type of issue.
A backup administrator can also follow these steps to recover the Exchange database.

This article describes the use of the Microsoft tool "eseutil.exe" which is used to replay the transaction logs in the Exchange database.

Steps to recover the database:

Open the Windows command prompt as an elevated user (run as administrator).

To check the database state, run this command from the path where the database was restored:

Syntax:
eseutil /mh <database name> | findstr State

Example:
E:\Restore_Temp\H\mountpoint\database4>eseutil /mh database4.edb | findstr State
            State: Dirty Shutdown

To verify the transaction logs, and confirm they are available and in a good state, run this command in the path where they were restored:

Syntax:
eseutil /ml <log base name>

Example:
E:\Restore_Temp\H\mountpoint\database4>eseutil /ml E04

Extensible Storage Engine Utilities for Microsoft(R) Exchange Server
Version 15.01
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating FILE DUMP mode...

Verifying log files...
     Base name: E04

      Log file: E:\Restore_Temp\H\mountpoint\database4\E040000002D.log - OK
      Log file: E:\Restore_Temp\H\mountpoint\database4\E040000002E.log - OK
...
..
.
      Log file: E:\Restore_Temp\H\mountpoint\database4\E04000000A5.log - OK
      Log file: E:\Restore_Temp\H\mountpoint\database4\E04000000A6.log - OK

No damaged log files were found.

Operation completed successfully in 3.15 seconds.

 
To recover the database by replying to the transaction logs, run the following command:

Syntax:
eseutil /r <log base name> /l <database's path> /d <transaction log's path>

Example:
E:\Restore_Temp\H\mountpoint\database4>eseutil /r E04 /l "E:\Restore_Temp\H\mountpoint\database4" /d "E:\Restore_Temp\H\mountpoint\database4"

Extensible Storage Engine Utilities for Microsoft(R) Exchange Server
Version 15.01
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating RECOVERY mode...
    Logfile base name: E04
            Log files: E:\Restore_Temp\H\mountpoint\Database4
         System files: <current directory>
   Database Directory: E:\Restore_Temp\H\mountpoint\Database4

Performing soft recovery...
                      Restore Status (% complete)

          0    10   20   30   40   50   60   70   80   90  100
          |----|----|----|----|----|----|----|----|----|----|
          ...................................................

Operation completed successfully in 2.859 seconds.

To check the database state again, and confirm that it is now recovered, run this command again:

Syntax:
eseutil /mh <database name> | findstr State

Example:
E:\Restore_Temp\H\mountpoint\database4>eseutil /mh database4.edb | findstr State
            State: Clean Shutdown

Now that the Exchange database is in "Clean Shutdown" state, it can be:

• Mounted to the Exchange server
• Used via the Dell Itempoint tool for granular level recovery purposes (GLR)
• Used via the Exchange PowerShell command
• etc.