In Exchange 2007 RTM, there are several scenarios in which data integrity is not automatically verified through checksumming and in which page zeroing does not occur.

These scenarios include:

• Creating backups only from the passive copy of a storage group in a cluster continuous replication (CCR) or local continuous replication (LCR) organization. If you create backups only from the passive copy, the active copy of the database is never checksummed.
  
  
• Using Microsoft Data Protection Manager (DPM) to create differential block-level backups of Exchange data. In this scenario, only the changed data that is being backed up is checksummed. The unchanged data is not checksummed. As a result, the integrity of the data is not known with certainty, because it may have been corrupted over time (a condition that is commonly known as bit rot).
  
  
• When using Volume Shadow Copy Service (VSS)-based backups in a CCR or LCR organization. In this scenario, page zeroing does not occur because it is enabled only for streaming backups.
  
  
• When using streaming backups in a CCR or LCR organization. In this scenario, page zeroing activity on the active copy of the database does not generate transaction log files. Without transaction log files, these changes cannot be replicated to the passive copy of the database.
  
  

As mentioned earlier, checksumming is the process of checking the integrity of a database by computing a value (checksum) that depends on the contents of the database. The checksum is stored with data, and Exchange uses this value to make sure that the data is not corrupted. Prior to Exchange 2007 SP1, an entire database was checksummed during an online full streaming backup. A full VSS snapshot of a database could also be checksummed. (Although, it was the copy that was checksummed, and not the actual production database). However, the development of CCR and LCR and the introduction of DPM made this approach inadequate.

Checksumming with CCR and LCR

Checksumming with DPM

Page zeroing (also called zeroing out or page scrubbing) is a process that is performed at the end of a streaming backup in which the data within the database is overwritten with characters that you have selected for that purpose. This makes the data unrecoverable by conventional means. When an item is deleted from an Exchange server (for example, when users delete messages from their mailboxes) and deleted item retention is disabled, the pages that item was occupying are marked as unused. When page zeroing is enabled, the data that is contained in unused pages is overwritten with the selected overwrite during an online backup. As each database page is backed up, the page is overwritten with the selected characters one time in the database on the hard disk. After the backup is complete, the deleted data exists on the backup copy, but it no longer exists in the database and cannot be recovered by conventional means.

In Exchange 2007 RTM, you could zero out deleted database pages when streaming online backups were performed by setting the Zero Database During Backup registry key. This method worked well. However, with VSS backups and CCR, it is no longer sufficient because VSS backups do not provide a way to zero out deleted pages.

Note:

As a best practice, if you want to enable page zeroing on a database, you should do so when you create the database. If you do not configure page zeroing when you create the database, the first time page zeroing is run against the database, it will significantly impact server performance. The performance impact is considerably less after page zeroing has completed the first pass of the database. You can use throttling to limit the performance impact of the first page zeroing pass

Page Zeroing with Continuous Replication

In Exchange Server 2003 and Exchange 2007, you have been able to use streaming backups to augment VSS backups when they required page zeroing. With the introduction of CCR and LCR in Exchange 2007, another issue is raised: page zeroing modifies the database without generating corresponding transaction logs. This means that in CCR and LCR organizations, page zeroing activity is not replicated between databases. In Exchange 2007 RTM, to make sure that page zeroing is effective with CCR, you must perform one of the following tasks:

• Run a streaming backup against each copy. This involves moving the CCR clustered CCR Mailbox server between nodes.
  
  
• Take the target database offline and use Eseutil to run the eseutil /z command.
  
  

However, with increased concerns about security and compliance, these options are no longer satisfactory. In Exchange 2007 SP1 and SP2, page zeroing is moved to a background process and it now generates logs that can be shipped to replicate page zeroing to database copies in CCR and LCR environments, as well as environments that use standby continuous replication (SCR). 

Note:
Enabling page zeroing during online maintenance temporarily results in an increase in log generation. After the feature has been enabled for a while, log generation activity should return to the level it was at prior to enabling page zeroing.

When you enable online maintenance database scanning in Exchange 2007 SP1 and SP2, Exchange reads in database pages, checksums them, and if so configured, performs page zeroing on them. All of these steps are performed in the background.

Online maintenance database scanning in Exchange 2007 SP1 and SP2 has the following features:

• Online maintenance database scanning is not enabled by default. Because database scanning can affect server performance, you must manually opt in by adding subkeys to the registry. For more information, see "Using Registry Keys to Enable and Configure Online Maintenance Database Scanning" later in this topic.
  
  
• You can enable database checksumming with page zeroing or by itself.
  
  
• Database page zeroing and checksumming take place outside of the streaming backup process. Both operations are performed against a page when it is retrieved from disk. There is one database scan task in which both page zeroing and online checksumming are invoked when either one is enabled.
  
  
• Database scanning tracks its progress in a manner similar to online defragmentation. It updates its progress at regular intervals so that it can continue where it left off when it resumes after an interruption.
  
  
• You can enable database scanning only at the server level. Enabling database scanning at the storage group level or database level is not supported.
  
  
• Database scanning provides a database page zeroing mechanism that replicates changes between database copies with both CCR and LCR.
  
  
• Database scanning requires that page zeroing transactions go through the normal transaction logging process so that changes can replicate to CCR and LCR copies.
  
  
• Throttling interrupts online maintenance database scanning for a specified number of milliseconds between every 320 kilobytes (KB) of I/O. This process allows the server to perform other tasks. You can use throttling to reduce the performance impact of the online checksum process on the server, such as when you are running online maintenance database scanning during the business day.
  
  
• When you enable online maintenance database scanning, the online maintenance window that is scheduled for a specific database is split between the database scan process and the database online defragmentation process. For example, if you schedule an eight-hour online maintenance window, approximately four hours are used for the database scan task and four hours are used for the online defragmentation task.
  
  

The following table lists the registry subkeys that you can use to enable and configure online maintenance database scanning. These subkeys must be added to the registry by the administrator. They are not added to the registry by default when Exchange is installed. The path to each subkey is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem.

Caution:
Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved. Before editing the registry, back up any valuable data.

For more information about using these registry keys to enable and configure online maintenance database scanning, see How to Configure Online Maintenance Database Scanning in Exchange 2007 SP1 and SP2.

The following tables list the performance counters you can use to monitor and analyze system performance with database scanning.

Note:
To use the performance counters listed in the table, you must enable extended Extensible Storage Engine (ESE) performance counters. For information about how to enable extended ESE performance counters, see How to Enable Extended ESE Performance Counters.

Counters for monitoring checksumming performance

Counters for monitoring page zeroing performance

The following table lists the events you can use to monitor online maintenance database scanning in Event Viewer.

For more information, see How to Monitor Online Maintenance Database Scanning in Exchange 2007 SP1 and SP2.

For more information about System Center DPM 2007, see System Center Data Protection Manager 2007.

For information related specifically to DPM, see the Exchange Server Team blog article System Center Data Protection Manager 2007 Beta 2 goes live!

Note:
The content of each blog and its URL are subject to change without notice. The content within each blog is provided "AS IS" with no warranties, and confers no rights. Use of included script samples or code is subject to the terms specified in the Microsoft Terms of Use.

For more information about online maintenance database scanning and CCR, see Planning for Cluster Continuous Replication.