2095 Log Files in the Exchange Directory - running out of space.


OK- it's obvious I need to do some housekeeping.  The server began to choke Thursday and I had to delete a lot of files (that were expendable) to avert a meltdown.  

The Exchsrvr/MDBData directory (on D Drive) is piling up with .log files and there's only 4GB of drive space left on this 30 GB partition servicing some 60 users in an agency type environment.  There are like 40 log files @ 5mb each all modified today - 2095 log files total.

The mailbox storage list currently lists no excessive hoarders.  There are limits set on all boxes.

My M Drive suddenly has less than 4GB free also.  

More Strangeness:
All the log files appear to have been modified on just a few different days

Question:  Is it safe to remove or delete some of these files and if so - how?
Who is Participating?
ikm7176Sr. IT ManagerCommented:
The log files in the MDBData are the transaction log files. Never Delete these files manually. Exchange users the Write Ahead transaction log files i.e The transactions are stored in the transaction log files before commiting the transactions to the exchange database.

Your backup of exchange is failing. check your backup report to verify this.

Taking the online NORMAL backup of exchange information store using the exchange-aware backup softwares (NTbackup, Veritas backup Exex...etc) will delete these files.


Exchange 2000 uses fault-tolerant, transaction-based databases to store messages. Exchange 2000 also uses write-ahead transaction log files to ensure the efficient processing of Exchange 2000 data. Write-ahead is the process of writing transactions sequentially in transaction logs before writing them in bulk to the database files. Because log files store copies of the transactions, this process ensures that transactions are never lost before they are written to the databases in bulk.

The Exchange 2000 transaction logging process sequentially creates log files with file names beginning with "E", followed by a 7-digit hexadecimal number, and ending with a .log file extension. Log files are exactly 5 megabytes in size; therefore these files should appear in Windows Explorer as 5,242,880 bytes. If a log file is not this exact size, it is typically corrupt.

 Log files form in the following way:
1. Databases transactions in a single storage group are sequentially recorded to the temporary log file for the transaction logs of that storage group.
 2. When this temporary log file (E00tmp.log) reaches 5 megabytes, the file is saved as the next transaction log file for that storage group. For example, if the last log file recorded was E000001A.log, the temporary log file is saved as E000001B.log.
3. The temporary log file is filled again with new transactions until the log file reaches its full capacity and is copied to the next sequential log file.

Each storage group also maintains two log files (Res1.log and Res2.log) that function as placeholders for extra disk space on the hard disk containing the log files. If the drive containing the log files runs out of disk space, Res1.log and Res2.log allow the database files in the storage group to shut down in a consistent state.

If you have a backup of the database files and the corresponding log files for that database, you can recover your Exchange 2000 database information at any time. After a normal shutdown of the Exchange Information Store service, the Exchange database information exists in the .edb and .stm files. After an abnormal shutdown of the Exchange Information Store service, the database consists of the .edb and .stm files and any transactions in the log files that have not yet been written to those files

A checkpoint file indicates which transactions in the log files have been successfully written to the database files. When the Exchange Information Store service restarts, those transactions beyond the checkpoint are automatically written to the database files during soft recovery to bring the databases current to the time of the abnormal shutdown.

The reasons for huge amount of transaction log files can be found on the link below


Hope this solves your problem

mmurray46Author Commented:
Thanks.  The link was VERY helpful.  We did, in fact, discover that we had not set an exclusion in our anti-virus software on the M drive as mentioned as a prime suspect in this article.  I am a bit puzzled regarding your reference to our backup not running and that being a potential suspect.  We do use an Exchange aware backup program (Retrospect by Dantz).  Are you suggesting that we run another backup program?
ikm7176Sr. IT ManagerCommented:
I did suggested to check your backup software, one of the prime suspect for growing transaction log files.  If you are running backup using exchange aware software then the transaction log files are automatically deleted. As you are already having exchange aware backup program, you shouldn't worry about it.

Infact you discovered that anti-virus software was the culprit. setting exclusions in your antivirus software will solve your problem.


I checked out the post  http://blogs.msdn.com/exchange/archive/2004/05/10/129149.aspx which was especially helpful.

This was not the problem though as I knew to look out for most of those.  After checking into a problem I had with a MAC I found that one of the MAC clients had a problem with Entourage (outlook for MAC's).  They had a rather large email in their outbox 20+MB's.  by default there is no size column and even they didn't think the file should have been anywhere near that big, therefore they did not understand why they kept getting an error.  
Entourage like outlook, keeps trying to do a continous send/receive which keeps getting logged in Exchange.

I had to setup a trigger in Exchange System Manager, Adminstrative groups / first administrative group / servers / server properties/ monitoring tab, and added a free space threshold, so I could at least be notified before it shut down the Information Store which did happen to me once.

We deleted the email out of Entourage and I have been keepign an eye on the email sever logs for an hour now and it hasn't been creating log file after log file like before.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.