Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 744
  • Last Modified:

Sudden explosive growth in Exchange 2007 .EDB file.

Hi,

It's recently come to my attention that our single mailbox store database is growing at an alarming rate (e.g. in the last 5 days it's has grown by nearly 8Gb). The database is currently 71GB in size, however when I run a mailbox size report through powershell our mailboxes only total up to around 31GB?

On retention we have keep deleted items set to 10 days and deleted mailboxes to 30. There are no mailboxes currently queued for deletion, and the event viewer indicates that there is only around 430mb free in the database after online defragmentation.

Where could this growth coming from, or is there something I can run/use that will show me exactly what our mailbox database contains?

Thanks.
Get-MailboxStatistics -server "mailserver" | Sort-Object TotalItemSize -Descending | ft DisplayName,@{label="TotalItemSize(MB)";expression={$_.TotalItemSize.Value.ToMB()}},ItemCount

Open in new window

0
Aspinall
Asked:
Aspinall
1 Solution
 
coolsport00Commented:
Check your event logs (Event ID 1221) for whitespace. This event will tell you how much there is, though a 40GB difference is quite a disparity. Regardless, you can do an offline defrag using ESEUTIL to recover the space stated in the Event.
http://technet.microsoft.com/en-us/library/aa998863.aspx
http://technet.microsoft.com/en-us/library/aa997972.aspx

Regards.
~coolsport00
0
 
MesthaCommented:
On Exchange 2007 an offline defrag is completely unnecessary, just move everything to another database and then drop the original.

However if the users are deleting a lot of content then that can account for the difference. Remember that you also have to think about deleted item retention and single instance storage, which can also have an effect.

Try running Glen's mailbox report script.
http://gsexdev.blogspot.com/2008/05/version-5-of-mailbox-size-gui-script.html

That can include deleted items retention I believe which may well show that you have a lot of deleted content in the store.

Simon.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
AspinallAuthor Commented:
Rajith - Thanks for the link, some of it seems to apply to earlier versions of Exchange (though Microsoft seem to be very gulity of this also) - I'm trying to work my way through everything in the article.

coolsport00 - Thanks for the suggestion, I have checked for event id 1221 and it's only reporting < 200 mb free, so I don't know how much an offline defrag will help. Also with the database the size it is now I don't have enough disk space in the server for the temporary files but if push comes to shove then more disks shouldn't be an issue to add.

Mestha - Thanks for the link that's an excellent tool. It looks like I've got 15GB sat in deleted item retention! This helps but I've still got another 25GB of unexplained usage of this file, any idea's what the rest of this could be?

Thanks for the comments so far!
0
 
AspinallAuthor Commented:
Just to put into perspective how fast the storage is dropping.

04-08-2009 00:00:00 04-09-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 85.33 Gb (80%) - free 20.87 Gb (20%)
04-09-2009 00:00:00 04-10-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 86.69 Gb (82%) - free 19.52 Gb (18%)
04-10-2009 00:00:00 04-11-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 87.85 Gb (83%) - free 18.35 Gb (17%)
04-11-2009 00:00:00 04-12-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 88.16 Gb (83%) - free 18.05 Gb (17%)
04-12-2009 00:00:00 04-13-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 88.23 Gb (83%) - free 17.97 Gb (17%)
04-13-2009 00:00:00 04-14-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 88.26 Gb (83%) - free 17.94 Gb (17%)
04-14-2009 00:00:00 04-15-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 88.30 Gb (83%) - free 17.91 Gb (17%)
04-15-2009 00:00:00 04-16-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 88.40 Gb (83%) - free 17.80 Gb (17%)
04-16-2009 00:00:00 04-17-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 89.12 Gb (84%) - free 17.08 Gb (16%)
04-17-2009 00:00:00 04-18-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 90.37 Gb (85%) - free 15.84 Gb (15%)
04-18-2009 00:00:00 04-19-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 90.87 Gb (86%) - free 15.34 Gb (14%)
04-19-2009 00:00:00 04-20-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 91.34 Gb (86%) - free 14.86 Gb (14%)
04-20-2009 00:00:00 04-21-2009 00:00:00 1d 0h 0m 0s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 91.60 Gb (86%) - free 14.60 Gb (14%)
04-21-2009 00:00:00 04-21-2009 19:19:28 0d 19h 19m 28s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 92.30 Gb (87%) - free 13.90 Gb (13%)
04-21-2009 19:19:28 04-21-2009 19:29:28 0d 0h 10m 0s SERVICE CRITICAL (HARD) e:\ - total: 106.20 Gb - used: 96.64 Gb (91%) - free 9.56 Gb (9%)
04-21-2009 19:29:28 04-22-2009 00:00:00 0d 4h 30m 32s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 92.80 Gb (87%) - free 13.41 Gb (13%)
04-22-2009 00:00:00 04-22-2009 19:49:28 0d 19h 49m 28s SERVICE WARNING (HARD) e:\ - total: 106.20 Gb - used: 93.26 Gb (88%) - free 12.95 Gb (12%)
04-22-2009 19:49:28 04-23-2009 00:00:00 0d 4h 10m 32s SERVICE CRITICAL (HARD) e:\ - total: 106.20 Gb - used: 95.59 Gb (90%) - free 10.61 Gb (10%)
04-23-2009 00:00:00 04-24-2009 00:00:00 1d 0h 0m 0s SERVICE CRITICAL (HARD) e:\ - total: 106.20 Gb - used: 95.89 Gb (90%) - free 10.32 Gb (10%)
04-24-2009 00:00:00 04-25-2009 00:00:00 1d 0h 0m 0s SERVICE CRITICAL (HARD) e:\ - total: 106.20 Gb - used: 98.12 Gb (92%) - free 8.08 Gb (8%)
04-25-2009 00:00:00 04-25-2009 17:17:43 0d 17h 17m 43s+ SERVICE CRITICAL (HARD) e:\ - total: 106.20 Gb - used: 100.32 Gb (94%) - free 5.89 Gb (6%
0
 
MesthaCommented:
That looks like a loop somewhere. Someone has sent an oversized message and it is bouncing around. Do you allow automatic forwarding to the internet using rules in Outlook.

Simon.
0
 
AspinallAuthor Commented:
That was my feeling as well, but I have no idea how to track it. I don't think that anything is explicitly set to allow or deny forwarding from outlook to the net, so I'm guessing that it's using default behaviour. Where would I check this?

I've done some serious house cleaning on the server (135 mailboxes deleted). Another issue I have found is that we're constantly getting spammed by exception messages from the web servers (a few  developers had around 1M items in their mailboxes), so I've killed item retention on anyone who gets these messages, which has freed a lot of space in the database.
Thanks Simon.
0
 
MesthaCommented:
The default behaviour doesn't allow automatic forwarding. It is under Global Settings on the Hub transport settings.
Do you have contacts that forward email out to an external address? That can do the same thing.

Simon.

0
 
AspinallAuthor Commented:
Is the attached image the correct configuration page? if so looks like it is set to allow.

Yes we have contacts that forward out. I guess the next step is search the message tracking logs to see if any of the contacts is getting a large amout of mail bounced around?
Capture.JPG
0
 
MesthaCommented:
The settings that you have there allow for both automatic forwards and automatic replies via Outlook clients and I would advise that those are turned off.
Both can cause email loops to occur. If you have contacts being used for forwarding then those are NOT affected by that change.
Therefore my instinct would be that you may have a user who has looped a rule (perhaps forward all email to their Hotmail account and the account is full). Turn the two options off and restart MS Exchange Transport.

Simon.

0
 
AspinallAuthor Commented:
Thanks for your help on this Simon - the problem has stopped happening and the database growth has returned to normal. The problem mailboxes appear to be a set of no reply auto responder accounts which were bouncing a lot of delivery failures around.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now