Exchange Log File information

Yes. Everything which is need to be written to Database is 1st written to log and then later on to Database. This helps to speed up the transaction was log is sequential and can be written faster. Also in case of failure the whole database can be recreated if we have all the log files.

so you mean to say if the mail is coming into organisation with an attachment of 10 mb and message body. These all information will be their in the log files right ? in case iof database failure we can rebuild the same with the help of log files right ?

Yogesh - Go through this link to understand more on Transaction logs.

http://www.msexchange.org/articles/Transaction-Logs-Lifeblood-Exchange.html

For rebuilding a DB, you need to restore the DB which is on good state from backup and you need to have all the transaction logs after that to keep the DB back to the actual state. If a single log file is missing in between, this wont work.

Cheers
Shaba

So all the information like the message body,attachments etc will be their in the mail transaction logs but will not be available in its native format. right ??

Yes that is my understanding

So finally what i have understood is if log files are their you can rebuild the database. And i believe if you have to rebuild the database you have to replay the log files, Can some tel me how can i replay the log files which are already committed to database but not yet flused.

1. You don't need to replay the log once they are committed as they are already in the database. You may need to do that only if your are recovering the Database from crash or failure.
2. If you are looking at deleting logs which are committed then the best way to do is take a full backup of the store with Exchange Aware Backup software.
3. If you want manaully delete the logs (NOT RECOMMEDED though) then you need to look at the .chk file which store the information about which log has been commited. To do this use eseutil from the Exchsrvr/bin directory.

As you can see in the output the "Checkpoint: (0x6A,1119,3D)" indicates to what point the logs are commited. Looking at this currently it is at Checkpoint (0x6A,1119,3D) = E000006A.log.

So you can then sucessfully delete all the logs prior to E000006A.log (Don't delete the current log E000006A.log.). Please note the log file numbers are in Hexadecimal.


If you are looking at recovery let us know the version of Exchange you are using and we can provide more information.

Example
eseutil /mk "C:\Program Files\Exchsrvr\MDBDATA\E00.chk"

This will provide output as 
  Microsoft(R) Exchange Server(TM) Database Utilities
   Version 6.0
   Copyright (C) Microsoft Corporation 1991-2000.  All Rights Reserved.

   Initiating FILE DUMP mode...
         Checkpoint file: C:\Program Files\Exchsrvr\MDBDATA\E00.chk

         LastFullBackupCheckpoint: (0x0,0,0)
         Checkpoint: (0x6A,1119,3D)
         FullBackup: (0x0,0,0)
         FullBackup time: 00/00/1900 00:00:00
         IncBackup: (0x0,0,0)
         IncBackup time: 00/00/1900 00:00:00
         Signature: Create time:09/24/2001 17:10:26 Rand:522553071 Computer:
         Env (CircLog,Session,Opentbl,VerPage,Cursors,LogBufs,LogFile,Buffers)
             (    off,    202,  30300,   1365,  10100,    128,  10240,  97940)

   Operation completed successfully in 1.192 seconds.

Select allOpen in new window