Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


2095 Log Files in the Exchange Directory - running out of space.

Posted on 2004-09-24
Medium Priority
Last Modified: 2008-03-17

OK- it's obvious I need to do some housekeeping.  The server began to choke Thursday and I had to delete a lot of files (that were expendable) to avert a meltdown.  

The Exchsrvr/MDBData directory (on D Drive) is piling up with .log files and there's only 4GB of drive space left on this 30 GB partition servicing some 60 users in an agency type environment.  There are like 40 log files @ 5mb each all modified today - 2095 log files total.

The mailbox storage list currently lists no excessive hoarders.  There are limits set on all boxes.

My M Drive suddenly has less than 4GB free also.  

More Strangeness:
All the log files appear to have been modified on just a few different days

Question:  Is it safe to remove or delete some of these files and if so - how?
Question by:mmurray46
  • 2
LVL 20

Accepted Solution

ikm7176 earned 500 total points
ID: 12149803
The log files in the MDBData are the transaction log files. Never Delete these files manually. Exchange users the Write Ahead transaction log files i.e The transactions are stored in the transaction log files before commiting the transactions to the exchange database.

Your backup of exchange is failing. check your backup report to verify this.

Taking the online NORMAL backup of exchange information store using the exchange-aware backup softwares (NTbackup, Veritas backup Exex...etc) will delete these files.


Exchange 2000 uses fault-tolerant, transaction-based databases to store messages. Exchange 2000 also uses write-ahead transaction log files to ensure the efficient processing of Exchange 2000 data. Write-ahead is the process of writing transactions sequentially in transaction logs before writing them in bulk to the database files. Because log files store copies of the transactions, this process ensures that transactions are never lost before they are written to the databases in bulk.

The Exchange 2000 transaction logging process sequentially creates log files with file names beginning with "E", followed by a 7-digit hexadecimal number, and ending with a .log file extension. Log files are exactly 5 megabytes in size; therefore these files should appear in Windows Explorer as 5,242,880 bytes. If a log file is not this exact size, it is typically corrupt.

 Log files form in the following way:
1. Databases transactions in a single storage group are sequentially recorded to the temporary log file for the transaction logs of that storage group.
 2. When this temporary log file (E00tmp.log) reaches 5 megabytes, the file is saved as the next transaction log file for that storage group. For example, if the last log file recorded was E000001A.log, the temporary log file is saved as E000001B.log.
3. The temporary log file is filled again with new transactions until the log file reaches its full capacity and is copied to the next sequential log file.

Each storage group also maintains two log files (Res1.log and Res2.log) that function as placeholders for extra disk space on the hard disk containing the log files. If the drive containing the log files runs out of disk space, Res1.log and Res2.log allow the database files in the storage group to shut down in a consistent state.

If you have a backup of the database files and the corresponding log files for that database, you can recover your Exchange 2000 database information at any time. After a normal shutdown of the Exchange Information Store service, the Exchange database information exists in the .edb and .stm files. After an abnormal shutdown of the Exchange Information Store service, the database consists of the .edb and .stm files and any transactions in the log files that have not yet been written to those files

A checkpoint file indicates which transactions in the log files have been successfully written to the database files. When the Exchange Information Store service restarts, those transactions beyond the checkpoint are automatically written to the database files during soft recovery to bring the databases current to the time of the abnormal shutdown.

The reasons for huge amount of transaction log files can be found on the link below


Hope this solves your problem


Author Comment

ID: 12160867
Thanks.  The link was VERY helpful.  We did, in fact, discover that we had not set an exclusion in our anti-virus software on the M drive as mentioned as a prime suspect in this article.  I am a bit puzzled regarding your reference to our backup not running and that being a potential suspect.  We do use an Exchange aware backup program (Retrospect by Dantz).  Are you suggesting that we run another backup program?
LVL 20

Expert Comment

ID: 12168056
I did suggested to check your backup software, one of the prime suspect for growing transaction log files.  If you are running backup using exchange aware software then the transaction log files are automatically deleted. As you are already having exchange aware backup program, you shouldn't worry about it.

Infact you discovered that anti-virus software was the culprit. setting exclusions in your antivirus software will solve your problem.


Expert Comment

ID: 15024234

I checked out the post  http://blogs.msdn.com/exchange/archive/2004/05/10/129149.aspx which was especially helpful.

This was not the problem though as I knew to look out for most of those.  After checking into a problem I had with a MAC I found that one of the MAC clients had a problem with Entourage (outlook for MAC's).  They had a rather large email in their outbox 20+MB's.  by default there is no size column and even they didn't think the file should have been anywhere near that big, therefore they did not understand why they kept getting an error.  
Entourage like outlook, keeps trying to do a continous send/receive which keeps getting logged in Exchange.

I had to setup a trigger in Exchange System Manager, Adminstrative groups / first administrative group / servers / server properties/ monitoring tab, and added a free space threshold, so I could at least be notified before it shut down the Information Store which did happen to me once.

We deleted the email out of Entourage and I have been keepign an eye on the email sever logs for an hour now and it hasn't been creating log file after log file like before.

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Stellar Exchange Toolkit: this 5 in 1 toolkit comes loaded with mega-software tool. Here’s an introduction to tools’ usage and advantages:
This article will help to fix the below errors for MS Exchange Server 2016 I. Certificate error "name on the security certificate is invalid or does not match the name of the site" II. Out of Office not working III. Make Internal URLs and Externa…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…
Suggested Courses

572 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question