| Event Id | 490 |
| Source | ESE |
| Description | Process name (process id) file nameAn attempt to open the file "error code" for read / write access failed with system error error message: "%7". The open file operation will fail with error error code. |
| Event Information | According to Microsoft : Cause : An attempt to open the file [path\filename] for read/write access failed with system error [error# ]. The open file operation will fail with error [error #]. The file is either a .chk file such as E00.chk or a database file such as priv1.edb or priv1.stm. The cause depends on the Error listed at the end of the Description section of the event. The most frequent causes are listed below. 1)Error -1032 = 0xfffffbf8 = 4294966264 = JET_errFileAccessDenied = Cannot access file - the file is locked or in use. Another process has "stolen" the file. A virus checker may mistakenly quarantine a file, or a backup process may temporarily deny access. A flat file backup system or anti-virus software may be running against the database, check file directories, or the M: drive. This error can also occur if the permissions on the folder (such as MDBDATA) that contain the files for the information stores are not sufficient for the stores to function properly. 2)Error -1022 = 0xfffffc02 = 4294966274 = JET_errDiskIO = Disk IO error. The -1022 error is a generic error that appears whenever a disk input/output (I/O) problem prevents Exchange from gaining access to a requested page in the database or to a check file. A disk or controller failure may have occurred, and access to the entire drive has been lost, sometimes temporarily. Check the System Log for I/O or drive errors near the time of the 490 Event. This issue may occur because the path for the check file (such as E00.chk) is not correct, which may be caused by a drive failure. 3)Error -1023 = 0xfffffc01= 4294966273 = JET_errInvalidPath = Invalid file path. This error can be caused by changing the path for the log files or the check file prior to a restore. This error can also indicate a corrupt check file (such as E00.chk) or a temporary file built during a defragmentation or a repair. In the case of the corrupt files, this error may occur even if the path to the file is correct. Resolution : 1)For Error -1032, change the permissions on the folders that contain the information store files to the default permissions. Configure the flat file backup and anti-virus software to not to scan the Exchange server information store subdirectories or the M: drive. Use Exchange-aware online backup and anti-virus software. 2)For Error -1022, run "chkdsk /f /r" (without the quotation marks). If chkdsk does not resolve the issue, examine the permissions on the Exchsrvr folder structure. Make sure that SYSTEM has full control of Exchsrvr and all subfolders on each partition that contains Exchange data. If you still cannot mount the databases, troubleshoot any Windows NT file-level antivirus software running on the Exchange server. Check the System Log for I/O or drive errors near the time of the 490 Event. Check and correct the path for the check file (such as E00.chk). Correct the root cause and then restore from online backup if there is a recent backup or as a last resort, perform a repair, Isinteg -fix, and ExMerge to a new Information Store. 3)For Error -1023, place the information store files back in their original locations before performing the restore. Alternatively, if the .chk is corrupt, you may be able to remove it and read all the transactions into the database. If the database remains inconsistent, then restore from online backup if there is a recent backup or as a last resort, perform a repair, Isinteg -fix, and ExMerge to a new Information Store. |
| Reference Links | Event ID 490 from Source ESE |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.