Magothytech1
asked on
Exchange 2010 Logs FILLING up daily right after backup completes
We have a new Exchange 2010 server running on Server 2008 R2 on a Dell T610 which running VMware with 3 other Server 2008 R2 systems. Nearly 45 email accounts were exported out of the old SBS 2003 system into PST files them imported into the new Exchange 2010.
It’s been almost a week and both the desktops and laptops have all been updated and each client system says that files are updated and current.
We are using Symantec Backup Exec 2010-R2 with a Dell Power Vault 110T LTO-3 tape drive.
We also have a backup server with 2TB of disk space for other Data backups.
Problem:
The Exchange logs are growing in excess of 90GBs per every 3-4 hours just one file after another in the
V14\Mailbox\”Folder”
Each file is 1024 KB in size and we have a 100 GB partition setup just for the logs which for which we are having to run backups every 2 hours to clear the folder and avoid the Exchange Store from dismounting.
Log files are named all like: E02000F9B8E.LOG and all are 1024KB
I have checked all the client computers that are local to the domain and nothing alarming was found.
What could be causing 90+ GB’s of log file to accumulate every 2-3 hours with only 45 users?
Thank you!
It’s been almost a week and both the desktops and laptops have all been updated and each client system says that files are updated and current.
We are using Symantec Backup Exec 2010-R2 with a Dell Power Vault 110T LTO-3 tape drive.
We also have a backup server with 2TB of disk space for other Data backups.
Problem:
The Exchange logs are growing in excess of 90GBs per every 3-4 hours just one file after another in the
V14\Mailbox\”Folder”
Each file is 1024 KB in size and we have a 100 GB partition setup just for the logs which for which we are having to run backups every 2 hours to clear the folder and avoid the Exchange Store from dismounting.
Log files are named all like: E02000F9B8E.LOG and all are 1024KB
I have checked all the client computers that are local to the domain and nothing alarming was found.
What could be causing 90+ GB’s of log file to accumulate every 2-3 hours with only 45 users?
Thank you!
ASKER
Thanks Sunnyc7:
I am trying to run the BP Analyzer but the options seem to be either not functioning of they are greyed out....I may not have the rights to run it?
I'm logged in as Admin??
I am trying to run the BP Analyzer but the options seem to be either not functioning of they are greyed out....I may not have the rights to run it?
I'm logged in as Admin??
ASKER
Are mail filtering is being done by a new source and it is:
MX Logic
MX Logic
ASKER
I was able to retrieve this: Not sure if it's any help though.
Summary: 3 item(s). 3 succeeded, 0 failed.
Elapsed time: 00:00:05
Read file
Completed
Exchange Management Shell command completed:
Read binary stream from the file 'C:\Program Files\Microsoft\Exchange Server\V14\bin\ExBPA.Stayi ngInformed .Config.xm l'.
Elapsed Time: 00:00:00
Collect Organizational Health Data
Completed
Exchange Management Shell command completed:
Test-SystemHealth -ConfigurationData '<Binary Data>' -OutData
Elapsed Time: 00:00:05
Save Organizational Health Data
Completed
Exchange Management Shell command completed:
Set-OrganizationConfig -OrganizationSummary 'TotalExchangeServers,1,Fa lse','Tota lMailboxSe rvers,1,Fa lse','Tota lUMServers ,0,False', 'TotalClie ntAccessSe rvers,1,Fa lse','Tota lTransport Servers,1, False','To talCALMail boxes,54,F alse','Ent erpriseCAL s,0,False' ,'Standard CALs,54,Fa lse','Tota lJounaling User,0,Fal se','Total Databases, 3,False',' TotalDatab asesCopy,2 ,False','T otalDataba sesCopyUnh ealthy,0,F alse','Tot al2009Exch angeServer s,1,False' ,'Total200 7ExchangeS ervers,0,F alse','Tot al2003Exch angeServer s,0,False' ,'TotalUnl icensedExc hangeServe rs,0,False ','TotalRe cipients,6 3,False',' TotalMailb oxes,54,Fa lse','Tota lDistribut ionGroups, 8,False',' TotalDynam icDistribu tionGroups ,0,False', 'TotalMail Contacts,0 ,False','T otalMailUs ers,0,Fals e','TotalL egacyMailb ox,0,False ','TotalMe ssagingRec ordManagem entUser,0, False','To talUnified MessagingU ser,0,Fals e','TotalO WAUser,55, False','To talActiveS yncUser,55 ,False','T otalMAPIUs er,55,Fals e','TotalP OP3User,55 ,False','T otalIMAP4U ser,55,Fal se'
Elapsed Time: 00:00:00
Summary: 3 item(s). 3 succeeded, 0 failed.
Elapsed time: 00:00:05
Read file
Completed
Exchange Management Shell command completed:
Read binary stream from the file 'C:\Program Files\Microsoft\Exchange Server\V14\bin\ExBPA.Stayi
Elapsed Time: 00:00:00
Collect Organizational Health Data
Completed
Exchange Management Shell command completed:
Test-SystemHealth -ConfigurationData '<Binary Data>' -OutData
Elapsed Time: 00:00:05
Save Organizational Health Data
Completed
Exchange Management Shell command completed:
Set-OrganizationConfig -OrganizationSummary 'TotalExchangeServers,1,Fa
Elapsed Time: 00:00:00
is this behavior also happening at night when your users are not connected ?
can you dismount the store for maybe 1/2 an hour and monitor your email queue ? if you have nothing then it is probably not incoming spam
can you dismount the store for maybe 1/2 an hour and monitor your email queue ? if you have nothing then it is probably not incoming spam
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you guys for each of the suggestions, they were all helpful and especially useful for future diagnostic testing.
As it turned out it we had a single PC that was remotely connected via a VPN link and it was still on the old domain with a valid email address and Outlook was open during the 3 day period that this was happening.
Not sure I understand why but when that single PC was added to the new domain and the Outlook profile was rebuild accordingly the logs files restored to a normal and expected rate. IO had never seen this type of log-file behavior before and will have to continue to monitor the system to ensure that this single PC was indeed the source.
Thanks again for the pointing us in the right direction.
FYI:
This behavior was happening during the day time and seemed not to be happening over night.
We are using Symantec Endpoint AV protection and the entire system was scanned just before the migration to the new server.
As it turned out it we had a single PC that was remotely connected via a VPN link and it was still on the old domain with a valid email address and Outlook was open during the 3 day period that this was happening.
Not sure I understand why but when that single PC was added to the new domain and the Outlook profile was rebuild accordingly the logs files restored to a normal and expected rate. IO had never seen this type of log-file behavior before and will have to continue to monitor the system to ensure that this single PC was indeed the source.
Thanks again for the pointing us in the right direction.
FYI:
This behavior was happening during the day time and seemed not to be happening over night.
We are using Symantec Endpoint AV protection and the entire system was scanned just before the migration to the new server.
ASKER
Thank you
Thanks for coming back and explaining the scenario.
It would have been really hard to guess this..
Will keep this in mind in future.
Thanks :)
It would have been really hard to guess this..
Will keep this in mind in future.
Thanks :)
ASKER
Yes you're right...doesn't make sense, but yet it has seemed to be the resolution thus far.
looping emails
corrupt email in sent item
mass spam
a) did you exclude exchange directories from anti-spam scan
b) what anti-spam software are you using.
c) can you run the bpa report and upload it here
Open exchange > toolbox > best practices analyzer
run a health scan
export report as html
upload it here
thanks