Solved

Exchange Database dramatic size Increase- URGENT

Posted on 2009-04-02
32
1,061 Views
Last Modified: 2012-05-06
I increased the database size limit on my Exchange server from 55 GB to 65 GB yesterday evening. The database size was at 46GB ( priv1.edb -35 GB and priv1.stm-10 GB) prior to increasing the database size limit.

Overnight  the priv1.edb  size has gone up by 10GB to 56GB and along with the log files the database size comes up to 62 GB.  What would cause the DB size to increase dramatically?Would the database dismount  if the edb+stm + log file gets to 65GB.
0
Comment
Question by:vran
  • 17
  • 8
  • 7
32 Comments
 
LVL 15

Expert Comment

by:zelron22
ID: 24050252
A large volume of mail with small attachments or a small volume of mail with large attachments, or a large volume of mail with large attachments.  Attachments make up about 90% (maybe more) of most mail databases.

If you have message tracking turned on, you can search your  server for all messages handled in the last day, then right click on one of the column headers, and choose SIZE, then sort by size and see what's been coming in.
0
 

Author Comment

by:vran
ID: 24050319
I don't think this has been turned on in the server.How do I turn message tracking on
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24050381
Based on the size of the logfiles it doesn't appear this was due to sent/recieved email. It's possible someone is storing large files in their email thus increasing the store size. Saving a Draft with an attachment is one way to do this. Check the mailbox statistics and see how big user mailboxes are. Without historical data you really don't know who grew but huge mailboxes might be a clue where to start.
0
 

Author Comment

by:vran
ID: 24050465
Message tracking is enabled and I am able to see the logs from the past 10 days to today.  I am lloking through yesterday's log
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24050483
6GB in log files sure points to a fair amount of mail transfers.
0
 

Author Comment

by:vran
ID: 24050568
Would the store dismount if the log file sizes increase. I am running a ntbackup to keep the size down.
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24050637
it just relates to store size.
GGB in log files doesnt' explain a 40GB in store growth unless I did my math wrong :)
0
 

Author Comment

by:vran
ID: 24050739
Sorry. Does that mean the store size limit does not include the log file size. Right now the folder size mdbdata including logs comes up to 63GB.The priv.stm is 10.5 and priv1.edb is 45.5
0
 

Author Comment

by:vran
ID: 24050966
The log seems to be growing pretty fast. How do I make sure the store does not get dismounted.


0
 

Author Comment

by:vran
ID: 24051024
Could you explain some entries in the log. The recipient address shows up as yahoo.com. I am attaching the log with some f the entries
Email.xls
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24051173
perhaps I'm misreading but it just appears we're sending email to a recipient at yahoo.com
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24052174
The store size limit includes the pub.edb, priv.edb, pub.stm, and priv.stm files (which may be pub1.edb, pub1.stm, priv1.edb, priv1.stm, etc.).

The log files do not count toward the size of the store.

Your log files should be truncated with each full Exchange backup.  This means using a backup utility that is Exchange aware, such as NT Backup, or Backup Exec with the Exchange Agent installed, etc.
0
 

Author Comment

by:vran
ID: 24052403
The ntbackup failed with an error message:

The 'Microsoft Information Store ' returned  ' Error returned from an ESE function call (d).
' from a call to 'HrESEBackupRead()' additional data '-'
The operation was ended
0
 
LVL 15

Accepted Solution

by:
zelron22 earned 250 total points
ID: 24052846
0
 

Author Comment

by:vran
ID: 24052890
I have removed the USB hard drive and I am trying to back it up on a network drive. I'll check and see how this goes. Still can't seem to find out why the .edb file increased by 10 GB overnight.
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24052989
Well, if you don't see anything in the message tracking tool with respect to large emails, have you followed AJermo's advice and looked at the user mailboxes for any of unusual size?
0
Shouldn't all users have the same email signature?

You wouldn't let your users design their own business cards, would you? So, why do you let them design their own email signatures? Think of the damage they could be doing to your brand reputation! Choose the easy way to manage set up and add email signatures for all users.

 

Author Comment

by:vran
ID: 24053235
Several users have always had large mailboxes. I am not able to tell how much their size might have increased last night.



0
 
LVL 6

Assisted Solution

by:AJermo
AJermo earned 250 total points
ID: 24053294
1. The backup job failing - check the event application and system log files for exchange errors, especially those from MSExchangeIS or ESE.
2. Can you isolate it from the internet to see if the growth continues? after hours when nobody should be using the system do you still have clients connected sending emails? Really need more data to support any conclusions, however, your mail system appears to be sending larger than expected volumes of email.

Turn up the SMTP logging and start checking the log files to see if the outgoing emails appear to be business related or potentially spam..
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24053298
What are you using for your nightly backups?  Are you using Backup Exec with GRT, or doing brick level backups?  If so, you may be able to look at the logs or the restore options to see how big the mailboxes are, and if any have grown recently.
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24053315
Please check your event logs immediately, I suspect something but don't want to say unless it's true. The event logs will tell all with one issue, The SMTP logs will tell the other.
0
 

Author Comment

by:vran
ID: 24053691
We have several employees travelling abroad at this time. So we have users connecting at different times. I have seen the STM files grow the past week because of OWA use, but not by GBs.

What should I do to turn up the SMTP logging.

Typically use Backup EXEC. The last one was done on Sunday. I backup the Information Store.

I see several MSExchangeIS  Event ID 9548 messages for people who are not with us anymore. But we have had these messages for a couple of weeks. We just disable and don't delete accounts for a month.Once the account gets deleted the message disappears.

EventID 9665: MS ExchangeIS. The memory settings on this server are not optimal for Exchange.

I tried running the Virus scanner TrendMicro received
 Event ID: 9580 Source: MSExchangeIS
"Virus scanning is enabled but diagnostic logging is turned off. To see diagnostic event releated to virus scanning, increase logging level for ' Virus scanning ' category using ESM.

And the scanner finds no virus/malware.

0
 
LVL 6

Expert Comment

by:AJermo
ID: 24053747
open System Manager and navigate to:

Servers > "SERVERNAME" > Protocols > SMTP Right-click the default SMTP virtual server and look on the General Tab. At the bottom is the checkbox for Enable Logging. Once you check the box, select Properties button and you can change the default location for the logging file and other parameters.

If this is enabled navigate to the location indicated and view the logs, what you are attempting to do is determine if these are valid business related emails.
0
 

Author Comment

by:vran
ID: 24053984
I enabled this and checked the log created for today. I chose the daily log schedule.

It just shows only a few remote users who are connected to Outlook through VPN. Is this normal?. I don't see any users who are connected here in the office.
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24054107
it just shows activity of the SMTP service not actual connections. If we don't see non-business emails being logged then it's likely a large mailbox. If I recall correctly if you navigate down to the information store it will show the mailboxes, the alias for the mailbox and the sizes.
0
 

Author Comment

by:vran
ID: 24054222
I checked the backup taken on Sunday. I can navigate down to the IS and see the mailboxes , and Top of IS on the mailboxes. But there is no information about the size of the mailbox. Is there any setting that  have to turn on to get this in the backup
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24054316
Can you right click on the column header on the right side of the dialog box?  Does it show fields, such as Size, that you can check?
0
 

Author Comment

by:vran
ID: 24054473
It show the field size for individual mails in an Inbox, but doesn't provide the information for Inbox

0
 

Author Comment

by:vran
ID: 24054973
We use Trend Micro for scanning emails. I checked the realtime Monitor.It typically filters Spam and quarantines it to users spam folder. The users can delete these messages.

I see several messages from unknown senders (Spam) that say

Massage from  "xxx  " found at "SMTP {total 1 recipients)
Mesage from "XX"  Total 1 recipient(S)


I am not sure where these messages are being delivered
0
 

Author Comment

by:vran
ID: 24059614
Checked the database size this morning. Priv1.edb had increased by 1GB. Would an offline defrag help reduce the size of the database
0
 
LVL 6

Expert Comment

by:AJermo
ID: 24062622
an offline defrag would only help if freespace exists in the database. It certainly won't hurt if you can schedule maintenance and run defrag.
0
 

Author Comment

by:vran
ID: 24098575
http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_23270822.html

When I viewed the mailboxes I included the Deleted in KB column and saw that one user had 17GB of deleted items that weren't purged. I changed the deleted item retention from 7 to 0 on the mailbox and ran an online defrag. The defrag reported 19550 megabytes free space. The EDB has stopped growing for now. I am continuing to monitor the database growth.

Using NetMon on the Exchange server also showed a lot of activity from this users Network card. Virus scan came with clean results.
The user had an alias POP/SMTP account created for emailing scanned files. Removed this from Outlook. This stopped the user's Outlook from reciving the same mail multiple times. Since the mails were being deleted and emptied right away I did not see any growth in the mailbox size.

The transaction log file creation rate has come down. I am continuing to monitor this.

I'll leave the question open until the beginning of next week to make sure the problem doesn't crop up again.
0
 

Author Comment

by:vran
ID: 24129536
The database size has not grown any further. I would like to split the points between the experts who helped me with this problem and close the question. Please let me know how I can do this.

0

Featured Post

Integrate social media with email signatures

Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

Join & Write a Comment

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now