Windows Event ID 5828 – ESENT: Database Recovery Completed Successfully

Start by examining the specific details of Event ID 5828 to understand which database recovered and the recovery duration.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 5828 by right-clicking the Application log and selecting Filter Current Log
4. Enter 5828 in the Event IDs field and click OK
5. Double-click on recent Event ID 5828 entries to view detailed information
6. Note the database path, recovery duration, and any additional context in the event description

Use PowerShell to query multiple 5828 events for pattern analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5828} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-Table -Wrap

Investigate the System log for events that occurred before the database recovery to identify the root cause of the unexpected shutdown.

1. In Event Viewer, navigate to Windows Logs → System
2. Look for events around the same timeframe as Event ID 5828, particularly:
• Event ID 1074 (system shutdown/restart)
• Event ID 6008 (unexpected shutdown)
• Event ID 41 (kernel power events)
• Event ID 1001 (Windows Error Reporting)
3. Use PowerShell to correlate events within a specific timeframe:

# Get events from 1 hour before the most recent 5828 event
$LastRecovery = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5828} -MaxEvents 1
$StartTime = $LastRecovery.TimeCreated.AddHours(-1)
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$StartTime; EndTime=$LastRecovery.TimeCreated} | Where-Object {$_.Id -in @(1074,6008,41,1001)} | Select-Object TimeCreated, Id, LevelDisplayName, Message

Use built-in tools to monitor ESENT database health and identify potential issues before they cause recovery events.

1. Enable ESENT diagnostic logging by modifying the registry:

# Enable detailed ESENT logging (requires restart)
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\ESENT\Parameters" -Name "Enable Logging" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\ESENT\Parameters" -Name "Log Level" -Value 3 -Type DWord

2. Monitor ESENT performance counters using Performance Monitor:
• Open Performance Monitor (perfmon.exe)
• Add counters from Database object for ESENT instances
• Monitor key metrics: Database Cache Hit Ratio, Log Record Stalls/sec, Database Page Faults/sec
3. Use PowerShell to check database file integrity:

# Check common ESENT database locations for file integrity
$ESENTDatabases = @(
    "$env:SystemRoot\SoftwareDistribution\DataStore\DataStore.edb",
    "$env:SystemRoot\System32\CatRoot2\dberr.txt"
)
foreach ($db in $ESENTDatabases) {
    if (Test-Path $db) {
        Get-ChildItem $db | Select-Object Name, Length, LastWriteTime
    }
}

Investigate underlying storage and hardware issues that may be causing unexpected shutdowns leading to database recovery events.

1. Check disk health using built-in Windows tools:

# Check disk health for all drives
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, Temperature, ReadErrorsTotal, WriteErrorsTotal

# Run CHKDSK on system drive (requires elevation)
chkdsk C: /f /r /x

2. Review Windows Hardware Error Architecture (WHEA) logs:

# Check for hardware errors that might cause system instability
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Monitor system temperature and power events:
• Check Event Viewer for Kernel-Power events (Event ID 41)
• Use powercfg /energy to analyze power efficiency issues
• Review manufacturer-specific hardware monitoring tools
4. Verify storage driver versions and update if necessary:

# List storage drivers and their versions
Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceClass -eq "SCSI" -or $_.DeviceClass -eq "HDC"} | Select-Object DeviceName, DriverVersion, DriverDate

Set up comprehensive monitoring to prevent future unexpected shutdowns and minimize database recovery events.

1. Create a scheduled task to monitor Event ID 5828 frequency:

# Create a PowerShell script to monitor 5828 events
$ScriptContent = @'
$Events = Get-WinEvent -FilterHashtable @{LogName="Application"; Id=5828; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
if ($Events.Count -gt 5) {
    Write-EventLog -LogName Application -Source "Custom Monitor" -EventId 9999 -EntryType Warning -Message "High frequency of ESENT recovery events detected: $($Events.Count) in last 24 hours"
}
'@
$ScriptContent | Out-File -FilePath "C:\Scripts\Monitor-ESENTRecovery.ps1" -Encoding UTF8

2. Configure Windows Error Reporting to capture crash dumps:

# Enable automatic crash dump collection
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 2
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "AutoReboot" -Value 0

3. Implement UPS monitoring if using uninterruptible power supplies:
• Install UPS management software
• Configure graceful shutdown procedures
• Set up alerts for power events
4. Create a custom Windows Event subscription for centralized monitoring:

# Save as ESENTRecovery.xml and import with wecutil cs ESENTRecovery.xml
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>ESENTRecoveryMonitor</SubscriptionId>
  <Query>
    <Select Path="Application">*[System[EventID=5828]]</Select>
  </Query>
  <Description>Monitor ESENT database recovery events</Description>
</Subscription>