Windows Event ID 5888 – ESENT: Database Recovery Completed Successfully

Start by examining the complete event details to understand which database recovered and the recovery duration.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Set Event ID to 5888 and Event sources to ESENT
5. Double-click the event to view detailed information including:
   • Database file path
   • Recovery duration
   • Number of log files processed
   • Any additional recovery metrics

Use PowerShell to extract detailed information:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5888; ProviderName='ESENT'} -MaxEvents 10 | Format-List TimeCreated, Id, LevelDisplayName, Message

Determine if frequent database recoveries indicate underlying system stability issues.

1. Query recent Event 5888 occurrences using PowerShell:

$StartDate = (Get-Date).AddDays(-30)
$Events = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5888; ProviderName='ESENT'; StartTime=$StartDate}
$Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name | Format-Table Name, Count -AutoSize

2. Check for corresponding system shutdown events (Event ID 1074) that might correlate with recoveries:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074; StartTime=$StartDate} | Select-Object TimeCreated, @{Name='ShutdownReason';Expression={($_.Message -split '\n')[4]}}

3. Review System log for unexpected shutdowns (Event ID 6008):

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008; StartTime=$StartDate} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Determine which specific databases and services are involved in recovery operations.

1. Extract database paths from Event 5888 messages:

$Events = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5888; ProviderName='ESENT'} -MaxEvents 50
$Events | ForEach-Object {
    if ($_.Message -match 'Database: (.+?)\s') {
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            DatabasePath = $matches[1]
        }
    }
} | Group-Object DatabasePath | Sort-Object Count -Descending

2. Check which Windows services use ESENT databases by examining service dependencies:

Get-Service | Where-Object {$_.ServicesDependedOn -like '*ESENT*'} | Select-Object Name, Status, DisplayName

3. Verify database file integrity using ESENTUTL:

# Replace with actual database path from event details
$DatabasePath = "C:\Path\To\Database.edb"
esentutl /g "$DatabasePath" /v

4. Check database file sizes and last modification times:

Get-ChildItem -Path "C:\Windows\System32\config" -Filter "*.edb" -Recurse -ErrorAction SilentlyContinue | Select-Object Name, Length, LastWriteTime, FullName

Assess system performance impact during database recovery operations.

1. Enable detailed ESENT logging to capture more recovery information:

# Enable ESENT diagnostic logging
New-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ESENT" -Name "CategoryMessageFile" -Value "%SystemRoot%\System32\esent.dll" -PropertyType String -Force
New-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ESENT" -Name "CategoryCount" -Value 14 -PropertyType DWord -Force

2. Monitor disk I/O during recovery using Performance Monitor:

# Create a performance counter data collector set
$DataCollectorSet = "ESENT_Recovery_Monitor"
logman create counter $DataCollectorSet -c "\PhysicalDisk(*)\Disk Reads/sec" "\PhysicalDisk(*)\Disk Writes/sec" "\PhysicalDisk(*)\Avg. Disk Queue Length" -si 5 -f csv -o "C:\Temp\esent_recovery.csv"

3. Check for memory pressure during recovery operations:

Get-Counter "\Memory\Available MBytes", "\Memory\Committed Bytes", "\Paging File(_Total)\% Usage" | Format-Table -AutoSize

4. Review Windows Performance Toolkit traces if available:

# Check for existing ETL traces
Get-ChildItem -Path "C:\Windows\System32\LogFiles\WMI" -Filter "*.etl" | Where-Object {$_.LastWriteTime -gt (Get-Date).AddHours(-24)}

Perform comprehensive database health checks and implement optimization strategies.

1. Run comprehensive database integrity checks on all ESENT databases:

# Script to check all ESENT databases
$ESENTDatabases = @(
    "C:\Windows\System32\config\SOFTWARE",
    "C:\Windows\System32\config\SYSTEM",
    "C:\Windows\System32\config\SECURITY",
    "C:\Windows\System32\config\SAM"
)

foreach ($db in $ESENTDatabases) {
    if (Test-Path $db) {
        Write-Host "Checking database: $db"
        esentutl /g "$db" /v
    }
}

2. Configure advanced ESENT parameters for better recovery performance:

# Optimize ESENT cache settings
$ESENTKey = "HKLM\SYSTEM\CurrentControlSet\Services\ESENT\Parameters"
Set-ItemProperty -Path $ESENTKey -Name "Cache Size Max" -Value 1024 -Type DWord
Set-ItemProperty -Path $ESENTKey -Name "Log Buffer Size" -Value 2048 -Type DWord

3. Implement automated database maintenance using Task Scheduler:

# Create scheduled task for database maintenance
$Action = New-ScheduledTaskAction -Execute "esentutl.exe" -Argument "/d C:\Path\To\Database.edb"
$Trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2:00AM
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "ESENT_Database_Maintenance" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

4. Monitor long-term recovery trends using custom PowerShell reporting:

# Generate recovery trend report
$Report = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=5888; ProviderName='ESENT'; StartTime=(Get-Date).AddDays(-90)} | 
    ForEach-Object {
        $RecoveryTime = if ($_.Message -match 'Recovery completed in (\d+) milliseconds') { [int]$matches[1] } else { 0 }
        [PSCustomObject]@{
            Date = $_.TimeCreated.Date
            RecoveryTimeMs = $RecoveryTime
            Database = if ($_.Message -match 'Database: (.+?)\s') { $matches[1] } else { 'Unknown' }
        }
    } | Group-Object Date | ForEach-Object {
        [PSCustomObject]@{
            Date = $_.Name
            RecoveryCount = $_.Count
            AvgRecoveryTime = ($_.Group | Measure-Object RecoveryTimeMs -Average).Average
            MaxRecoveryTime = ($_.Group | Measure-Object RecoveryTimeMs -Maximum).Maximum
        }
    }

$Report | Export-Csv -Path "C:\Temp\ESENT_Recovery_Report.csv" -NoTypeInformation