Share via


How do you troubleshoot ESENT entries in the event viewer?

Question

Sunday, September 16, 2018 1:48 AM

In the event viewer there are a very large number or ESENT problems.

Event ID# 447 Database Corruption

Event ID #467 Database Corruption

Event ID #474 Database Page Cache

Event ID #544 Database Page Cache

.

.

.

Event[386]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:25.875
  Event ID: 544
  Task: Database Page Cache
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
Catalog Database (3424) Catalog Database: The database page read from the file "C:\Windows\system32\CatRoot2\F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" at offset 24940544 (0x00000000017c9000) (database page 6088 (0x17C8)) for 4096 (0x00001000) bytes failed verification due to a persisted lost flush detection timestamp mismatch. The read operation will fail with error -1119 (0xfffffba1).
The flush state on database page 6088 (0x17C8) was 1 while the flush state on flush map page 0 (0x0) was 3.
If this condition persists, restore the database from a previous backup. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

.

.

.

Event[385]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:25.834
  Event ID: 544
  Task: Database Page Cache
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
Catalog Database (3424) Catalog Database: The database page read from the file "C:\Windows\system32\CatRoot2\F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" at offset 21790720 (0x00000000014c8000) (database page 5319 (0x14C7)) for 4096 (0x00001000) bytes failed verification due to a persisted lost flush detection timestamp mismatch. The read operation will fail with error -1119 (0xfffffba1).
The flush state on database page 5319 (0x14C7) was 3 while the flush state on flush map page 0 (0x0) was 2.
If this condition persists, restore the database from a previous backup. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

.

.

.

Event[384]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:00.872
  Event ID: 474
  Task: Database Page Cache
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
svchost (3160) SRUJet: The database page read from the file "C:\Windows\system32\SRU\SRUDB.dat" at offset 6578176 (0x0000000000646000) (database page 1605 (0x645)) for 4096 (0x00001000) bytes failed verification due to a page checksum mismatch.  The stored checksum was [44bf19b1bb40e64e] and the computed checksum was [00000645c440ae80].  The read operation will fail with error -1018 (0xfffffc06).  If this condition persists then please restore the database from a previous backup.  This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

.

.

.

Event[383]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:00.543
  Event ID: 467
  Task: Database Corruption
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
svchost (3160) SRUJet: Database C:\Windows\system32\SRU\SRUDB.dat: Index UserIdTimeStamp of table {973F5D5C-1D90-4944-BE8E-24B94231A174} is corrupted (0).

.

.

.

Event[382]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:00.395
  Event ID: 447
  Task: Database Corruption
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
svchost (3160) SRUJet: A bad page link (error -327) has been detected in a B-Tree (ObjectId: 24, PgnoRoot: 176) of database C:\Windows\system32\SRU\SRUDB.dat (5550 => 2900, 4070).

.

.

.

Event[381]:
  Log Name: Application
  Source: ESENT
  Date: 2018-09-14T18:57:00.165
  Event ID: 447
  Task: Database Corruption
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Description:
svchost (3160) SRUJet: A bad page link (error -327) has been detected in a B-Tree (ObjectId: 26, PgnoRoot: 160) of database C:\Windows\system32\SRU\SRUDB.dat (1522 => 288, 909).

.

.

.

The computer has a HD that is in RAID 0 with a flash cache.

The drive is 750 GB and the flash cache is 32 GB.

A chkdsk /r had been run on the drive.  After logon the computer crashed and was unbootable.

A reset with save files had failed.  There is a log file.

There were multiple automatic repairs and somehow the last automatic repair fixed failure to boot.

The plan is to make a backup image using third party software then clean install Windows 10 1803.

The third party software requires the VSS problems to be fixed before a backup image is made.

.

.

.

Event ID# 447 Database Corruption

Event ID #467 Database Corruption

Event ID #474 Database Page Cache

Event ID #544 Database Page Cache

.

.

.

For each of these ESENT event viewer ID # please indicate how they are troubleshooted.

Are they troubleshooted differently or the same?

All replies (1)

Monday, September 17, 2018 1:49 AM

ESENT is the Extensiible Storage Engine runtime - part of an single-file transactional database similar to SQLite. ESE is used in several Microsoft services and applications to store data - for example, Edge might use it to store the history of pages you've visited.

Check this case for some ideas.

EseDiskFlushConsistency - win10 1709

https://social.technet.microsoft.com/Forums/en-US/9054b832-d001-4543-b3b0-bcbb729d5f24/esediskflushconsistency-win10-1709?forum=win10itprogeneral

Regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].