Expected Exchange white space does not match 1221 events for private store

We recently had an event where mailbox on our Exchange server and one outside were playing catch, forwarding an email back and forth to each other. In a three day period the mailbox size reached 13.5GB. We hit our defined private store limit (20GB - Exchange 2K3, sp2) and raised it to 40GB while researching the problem. After fixing the email volley, we deleted the affected box, recreated it and purged it. The size now shows as zero in the ESM. I would then expect the online defrag to show the 13.5GB as white space, but it is only showing 2550 MB instead. Am I missing something? In addition, our backup software (Arcserve) stalls when trying to calculate the session so we're not getting backups.

We plan on taking it down to do an offline defrag later this month, but I need to understand what is happening and what to expect before then.

Thanks in advance!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

remember that delete items are retained until after a backup, at least when 'Do not permanently delete mailboxes and items until the store has been backed up' on the limits tab of the store properties.

To fix this you might have to uncheck that box, then unmount and remount the store. Or maybe just run a backup to a file (if you can spare the disk space)
The offline backup isn't going to do anything until you have some whitespace.
As already indicated, the backup job should clear it. There are also some perfmon counters that will give you an idea on how much deleted data is in the store.

If your main backup software is coughing, then do a quick ntbackup to disk. That will flush the logs out. Then reset the job in your backup software.

ssoulagesAuthor Commented:
I already have NTBackups (and exmerge) running nightly as an added level of insurance. They ran last night and the night before. Yet the 1221 still shows only 2551 MB free. Again the priv.stm and priv.edb total equals 47GB, while a sum of the mailboxes is just 11GB. I would expect a much larger number of free MB than 2551 in the 1221 event.

Upon furthur investigation, I found a second mailbox for the account involved in the email storm. The size was zero, but there were 11,500 items. I deleted it and initiated the cleanup agent and now I have a box showing as 'SMTP (<servername>-{<guid>}). I have no control (delete, purge, etc) over this box. Size=0, items=0.

Curious no? Will another online defrag show more free space now? What can be done to kick Exchange in the butt to release that space?

If an online defrag would be beneficial, would it hamper performance during the day?

Ok, more info: the exmerge scheduled task is still running from last night...

The run line for the ntbackup of the online backup is:
C:\WINDOWS\system32\ntbackup.exe backup "@C:\Documents and Settings\exadmin\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\exch full daily.bks" /n "exchange backup full daily.bkf created 9/7/2005 at 8:24 AM" /d "Set created 9/7/2005 at 8:24 AM" /v:no /r:no /rs:no /hc:off /m normal /j "exch full daily" /l:s /f "D:\exchbackup\exchange backup full daily.bkf"

Are the switches correct?


Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Which version of Exchange is this? Enterprise or Standard/SBS?
If it is Enterprise then you could shuffle things around in to a new mailbox store and delete the old one.

With the way that Exchange works on retaining deleted mailboxes, the deletion will not happen until the next round of online maintenance after the backup. So if you backed up overnight last night, then I would expect the mailbox to be deleted tonight.

You can run online maintenance during the day, I have done so in the past. There is a slight performance hit - whether your users will notice or not is a different matter. If they are all on Outlook 2003 cached then I doubt if they will.

ssoulagesAuthor Commented:
Thanks Simon, we are using 2003 Standard, sp2. I will run the online defrag and see if that shows a better free space amount.

By the way, speaking of cached mode, are you aware of any good documentation regarding the differences between using Cached and non-cached? We've found reasons to use Outlook either way - depending on what we're wanting to do.

I am not aware of any specific. Microsoft's preferred configuration is to use cached mode, so you will probably just find the usual sales spiel. Cached mode is really just offline folders on steroids, so there isn't much to write home about.
I usually deploy Outlook with cached mode, as it provides a better user experience in my opinion.

ssoulagesAuthor Commented:
OK. Thanks.

So after two days of running backups followed by online defrag, the 1221 event for the private store is still showing less than 4GB free. Before the mail storm, the database size was around 14GB. It now sits at 31.5GB. I ensured that the backup completed prior to the online defrag starting. There is almost an hour between the two processes.

Is it possible that the mail is sitting in the deleted items? Shouldn't the purge have deleted it? Plus, we only have a 3 day retention time on deleted items.

Thanks for  your help!
ssoulagesAuthor Commented:
Well after 15 hours (most of which were on the phone with Microsoft) we finally got the problem licked. But MS was stumped for awhile...

An offline defrag followed by isinteg recovered the 'missing' space. Our database went from 31.4GB to back down to 13.9.  
Closed, 500 points refunded.
The Experts Exchange
Community Support Moderator of all Ages

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.