Exchange log files filling up to quick & SBS 2003 server running our of room

timbo007
timbo007 used Ask the Experts™
on
Hello,

I am having some issues which I can not seem to resolve regarding those transaction logs exchange likes to keep before & after writing them to the database. formatted like E0004F08.log

A while ago they ran outta room on the mail drive (in this case f:\ ) I am the technician asked to look at it (then I was not their first contact but now I am so I am making sure it doesn't happen again as it should never have ran outta space in the first place had a competent IT tech been onto it) I found that there were all these log files, I backed them up and removed them (not all as that would be bad, just the ones more than a week old. The reason they weren't being removed in the first place was their back up had stopped working a month earlier! ARGH!! anyways, thats also being resolved now and a temporary backup has been put in place which I thought would mean the log files would be sorted.

It seems that there is 2 issues, one being that there are too many log files being created each day (approx 500-1000 MB for 7 users) I had read that there could be an issue with someones outlook not synchronizing properly and that would cause log files to fill up quickly. the other is that when a backup is performed, it keeps the log files till the 8th Jul (currently its the 21st July NZ Time) and I'm sure it can delete a whole lot more as the exchange database must be being written to for more than 13 days!


One other option I read about was circular logging, but I am hesitant to turn this on as it makes things slightly less safe if theres a media failure and this particular company contains very sensitive and important data which means they needs the highest level of reliability.

If someone can please help out with telling me where to change the setting that makes the log files get deleted more frequently, ie, I am happy for them to only contain the last couple days of data as it will be backed up the previous night.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
Hi,

Let me start by saying SBS is not my thing have not used it much due to working in big companies. But Exchange transaction logs will be purged automatically when the storage group is backed up either with a Full or Incremental backup using an Exchange aware backup program. If your using differential backups each night then change to incremental or better yet full. I always do full backups of Exchange each night.

I would NEVER enable circular logging in this type of scenario as the only time I have ever seen a problem with log files filling the drive is when the backup is not working and therefore without the logs and a known good backup then your data is really at risk of a total loss. If you have logs dated back to the 8th then the backup has not worked since the 8th.

If you need to move log files to gain space to keep things running there is a proper method for this. NEVER delete the logs. I always move them for a quick fix. Back them up and then fix the Exchange backup.

If you open Exchange System Manager > Expand Admin Groups > Servers > Server Name > Storage Group > Right click the Database > Properties > Select Database tab you will see a section time of last FULL backup and time of last INCREMENTAL backup what do they say?

Exchange log disk is full, Prevention and Remedies
http://www.msexchange.org/articles/Exchange-log-disk-full.html

How to remove Exchange Server transaction log files
http://support.microsoft.com/kb/240145

Author

Commented:
Another thing I did was reduced the size of the shadow copies on this drive to 300 MB, I don't think it really needs shadow copies to be kept anyways as its just storing mail & WSUS files on that drive.

The server is setup with 3 partitions: c:, e:, f:, which contains system, files/shared documents, email & WSUS respectfully.

The server has 3.5 GIGs RAM, 2x 3 GHZ Xeon CPU's & 4 SCSI 36 GB hard drives running a mirrored stripe set. so is pretty much over kill for managing 7 users but they did want the best :)
Commented:
Sorry I did mean to include this re: troubleshooting log file growth. Its aimed @ 2007 but the concepts and ideas are the same.

Check for dodgy Outlook Rules, etc.

Troubleshooting Exchange 2007 Store Log/Database growth issues
http://blogs.technet.com/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Full backup: 21/07/2009  8:13 a.m.
Incremental backup: none as it hasn't been preformed...

(which was myself doing a manual backup this morning, I should wait for tonight as it happens automatically and see what it says then although I still have logs dating back to the 8th after doing a full backup this morning, I did note that it removed a few files from the log - may be about 4 hours worth although this I can not confirm)

My concern is that I think some log files (which should never have been deleted) have actually been deleted, though I can not confirm this but I'm wondering if they did get deleted would that affect to how long ago it keeps them? I'd need to look through what backups I do have and look if there is any inconsistency with the filenames which I'd rather not do as it would drive me insane)

The store can be taken down and up with no issues, so I guess that means that there is no log files missing for what it needs to be mounted and therefore no email is missing?

Also I remember reading that there should be a file Edb.chk which has something to do with it but I can not find it, is this bad??

Author

Commented:
Thanks, that last document is a pearler! I have actually read the ones from microsoft but this one regarding it for 2007 is just what I need to narrow down where the excess log is coming from, so will go through that.

I guess the other issue which is the big one ... how to get these log files removed automatically is still what I need to sort out though...

I did also install NOD32 for exchange (after removing symantec anti virus with exchange) a couple weeks ago, I don't know if this might be causing the log files to increase, its just I think its coming from one user as there is big gaps where the log files don't increase then all of a sudden they increase every couple minutes for a while...
Alan HardistyCo-Owner
Top Expert 2011

Commented:
If you are running Exchange aware backup software, the log files will get deleted automatically after they get backed up.  If you are using non-Exchange aware software, then you will get this type of problem as the log files will not get deleted.
What backup software are you using to backup your server?

Author

Commented:
microsoft backup :) though its being run through the server management options which I think uses a customized script to run, though when I run a backup manually using backup.exe it still doesn't delete them...
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Do you mean NTBackup?
Alan HardistyCo-Owner
Top Expert 2011
Commented:
Here is a link to some useful info about NTBackup and what does / does not happen to the logfiles, depending on which type of backup you choose to perform.  It may explain why your logfiles are hanging around.
http://www.msexchange.org/tutorials/Exchange-2003-Backup-Restore-NTBACKUP.html 
Alan HardistyCo-Owner
Top Expert 2011

Commented:
This explains about circular logging:
http://support.microsoft.com/kb/314605 

Author

Commented:
yes ntbackup.exe I meant...

thanks, will go through these and get back to you.

I noticed that I am missing a chk file: Edb.chk   is this needed? it is referenced in some of these documents but I can't find it and it has to do with the transaction logging process or procedure...
Alan HardistyCo-Owner
Top Expert 2011

Commented:
The E??.chk file maintains the checkpoint for the Storage Group.  ?? will change according to the Storage Group.  E00.CHK will be the first storage group and 01 the second etc.
This checkpoint file keeps track of the last committed transaction.  If you ever need to perform a recovery of the database, this file contains the point at which the replaying of transaction logs starts.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
I think you are keeping your log files separately from the database, so they will be located in the same location as the database, not the log files.

Commented:
Make sure your AV has exclusions set for the Exchange edb, stm, log, chk files you don't want it scanning those files.

Author

Commented:
Alan,  hmm, I did a full PC serach for *.chk and found e00.chk in the folder C:\Program Files\Exchsrvr\MDBDATA (in which there is only one other file: tmp.edb, modified today but only 4MB big) where as the exchange datafile which I thought was the one thats in use (and reflects the correct file size of 9.5 GB) is in the folder F:\Exchsrvr\MDBDATA and thats where I can't see any .chk files...  though I looked at the e00.chk file with notepad and can see that it references something at F:\Exchsrvr\MDBDATA . but the rest of the file is all gobblygook...

I have ran Exchange Best practices tools and fixed some things and did the full scan which took 2 hours but it never mentioned any missing files... perhaps it doesn't check?? either way I think that the e00.chk file must be the right one...

Author

Commented:
thanks mass I have added the DB folder to the exclusions list of the nod32 file scanner settings.  (there were none to exclude which I find a little odd, perhaps I need to find out what other files should be excluded...
Alan HardistyCo-Owner
Top Expert 2011

Commented:
This should help you work out which folders to stop scanning with Nod32:
http://support.microsoft.com/kb/823166 

Author

Commented:
Wow, its fixed... but I can not say exactly what did it! haha, the automatic backup has ended and it finally deleted the log files, the folder looks sort of naked all of a sudden!

(i have a small hunch it may be nod32 related but I really don't know)

A lot of great posts and links here by the way I hope others can find this useful :)

Author

Commented:
it seems like this is quite a big issue and I'm glad to see it properly do what its supposed to for the first time I've been looking after it! thanks heaps, SBS 2003 isn't new to me but is definitely not my strong point so couldn't have easily done this without you guys!   (I like Linux :) )

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial