Exchange EDB file showing an older date as the modified date
Solved Email & Outlook
RK
Rachel Kim
August 6, 2020
2 replies
5,240 views
Reviewed by moderators

Our Exchange EDB database file shows a modified date much older than expected, even though the database is active and receiving mail. This worried our backup review.

Is an old modified date on an active EDB a problem?

Accepted Answer
Verified by Edwin J. Hoffer, Email Systems Specialist ยท Reviewed August 2020

The worry is understandable but usually misplaced, because how Exchange writes to its database makes the file's modified date a poor indicator of database activity, so the explanation then the actual health checks:

Why the date misleads: Exchange does not rewrite the entire EDB file on every change, it writes transactions to log files first and updates pages within the already allocated EDB file and depending on how the filesystem records the EDB's modified timestamp against these in place page writes versus the file's allocation, the timestamp can lag well behind actual activity. An active database can genuinely show an older file modified date while committing mail every second through its logs and page updates, so the old date alone is not a sign of a stalled or dead database.

What actually indicates health, the real checks: the database mount state, Get-MailboxDatabase -Status showing it mounted, the log files, an active database generating and consuming transaction logs continuously with recent timestamps on the log files being the true activity indicator and mail flow itself, users sending and receiving proving the database lives. These matter, the EDB's own file date does not, and a backup review should key on the log activity and mount state rather than the EDB timestamp.

The backup angle specifically, since that raised it: a proper Exchange backup uses the VSS aware backup that understands Exchange, backing up the database and logs consistently and truncating logs on success and its success is verified through the backup completing and logs truncating, not through the EDB file's modified date. If the backup review flagged the old date, the reassurance is that backup validity is measured by the backup job's own success and Exchange's log truncation, which the old EDB date does not contradict.

The one case worth a genuine check: if alongside the old date the logs are not being generated or consumed and mail is not flowing, then the database really is inactive and the date is a symptom rather than the cause, investigated as a mount or health problem. But an active database serving mail with an old EDB file date is normal Exchange behavior, the timestamp reflecting file allocation mechanics rather than database liveness and the review can rest on the activity indicators that actually mean something.

The logs were being generated and consumed constantly with fresh timestamps and mail was flowing fine, so the old EDB date was exactly the harmless mechanics you described. Redirected the backup review to key on log activity and job success instead. Reassuring to understand why the date lags rather than just being told not to worry.