2095 Log Files in the Exchange Directory - running out of space.

Posted on 2004-09-24
Last Modified: 2008-03-17

OK- it's obvious I need to do some housekeeping.  The server began to choke Thursday and I had to delete a lot of files (that were expendable) to avert a meltdown.  

The Exchsrvr/MDBData directory (on D Drive) is piling up with .log files and there's only 4GB of drive space left on this 30 GB partition servicing some 60 users in an agency type environment.  There are like 40 log files @ 5mb each all modified today - 2095 log files total.

The mailbox storage list currently lists no excessive hoarders.  There are limits set on all boxes.

My M Drive suddenly has less than 4GB free also.  

More Strangeness:
All the log files appear to have been modified on just a few different days

Question:  Is it safe to remove or delete some of these files and if so - how?
Question by:mmurray46
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
LVL 20

Accepted Solution

ikm7176 earned 125 total points
ID: 12149803
The log files in the MDBData are the transaction log files. Never Delete these files manually. Exchange users the Write Ahead transaction log files i.e The transactions are stored in the transaction log files before commiting the transactions to the exchange database.

Your backup of exchange is failing. check your backup report to verify this.

Taking the online NORMAL backup of exchange information store using the exchange-aware backup softwares (NTbackup, Veritas backup Exex...etc) will delete these files.


Exchange 2000 uses fault-tolerant, transaction-based databases to store messages. Exchange 2000 also uses write-ahead transaction log files to ensure the efficient processing of Exchange 2000 data. Write-ahead is the process of writing transactions sequentially in transaction logs before writing them in bulk to the database files. Because log files store copies of the transactions, this process ensures that transactions are never lost before they are written to the databases in bulk.

The Exchange 2000 transaction logging process sequentially creates log files with file names beginning with "E", followed by a 7-digit hexadecimal number, and ending with a .log file extension. Log files are exactly 5 megabytes in size; therefore these files should appear in Windows Explorer as 5,242,880 bytes. If a log file is not this exact size, it is typically corrupt.

 Log files form in the following way:
1. Databases transactions in a single storage group are sequentially recorded to the temporary log file for the transaction logs of that storage group.
 2. When this temporary log file (E00tmp.log) reaches 5 megabytes, the file is saved as the next transaction log file for that storage group. For example, if the last log file recorded was E000001A.log, the temporary log file is saved as E000001B.log.
3. The temporary log file is filled again with new transactions until the log file reaches its full capacity and is copied to the next sequential log file.

Each storage group also maintains two log files (Res1.log and Res2.log) that function as placeholders for extra disk space on the hard disk containing the log files. If the drive containing the log files runs out of disk space, Res1.log and Res2.log allow the database files in the storage group to shut down in a consistent state.

If you have a backup of the database files and the corresponding log files for that database, you can recover your Exchange 2000 database information at any time. After a normal shutdown of the Exchange Information Store service, the Exchange database information exists in the .edb and .stm files. After an abnormal shutdown of the Exchange Information Store service, the database consists of the .edb and .stm files and any transactions in the log files that have not yet been written to those files

A checkpoint file indicates which transactions in the log files have been successfully written to the database files. When the Exchange Information Store service restarts, those transactions beyond the checkpoint are automatically written to the database files during soft recovery to bring the databases current to the time of the abnormal shutdown.

The reasons for huge amount of transaction log files can be found on the link below

Hope this solves your problem


Author Comment

ID: 12160867
Thanks.  The link was VERY helpful.  We did, in fact, discover that we had not set an exclusion in our anti-virus software on the M drive as mentioned as a prime suspect in this article.  I am a bit puzzled regarding your reference to our backup not running and that being a potential suspect.  We do use an Exchange aware backup program (Retrospect by Dantz).  Are you suggesting that we run another backup program?
LVL 20

Expert Comment

ID: 12168056
I did suggested to check your backup software, one of the prime suspect for growing transaction log files.  If you are running backup using exchange aware software then the transaction log files are automatically deleted. As you are already having exchange aware backup program, you shouldn't worry about it.

Infact you discovered that anti-virus software was the culprit. setting exclusions in your antivirus software will solve your problem.


Expert Comment

ID: 15024234

I checked out the post which was especially helpful.

This was not the problem though as I knew to look out for most of those.  After checking into a problem I had with a MAC I found that one of the MAC clients had a problem with Entourage (outlook for MAC's).  They had a rather large email in their outbox 20+MB's.  by default there is no size column and even they didn't think the file should have been anywhere near that big, therefore they did not understand why they kept getting an error.  
Entourage like outlook, keeps trying to do a continous send/receive which keeps getting logged in Exchange.

I had to setup a trigger in Exchange System Manager, Adminstrative groups / first administrative group / servers / server properties/ monitoring tab, and added a free space threshold, so I could at least be notified before it shut down the Information Store which did happen to me once.

We deleted the email out of Entourage and I have been keepign an eye on the email sever logs for an hour now and it hasn't been creating log file after log file like before.

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Find out what you should include to make the best professional email signature for your organization.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question