How to deal with Exchange logs filling up drive

Posted on 2011-04-26
Last Modified: 2012-05-11

Hi all,

     We are using an Exchange server with SP3 and rollup 2. It is on a Windows 2008 server, with SP2.

     We were not using a backup application for a while. We were relying on Mailbox Export and LCR to keep us safe. Tried to use Backup Exec and had issues, so abandoned it.

      I have spent the last couple weeks troubleshooting Windows Server Backup, which is supposedly Exchange-aware, but they really shouldn't say it is. I have just found out that Windows Server Backup will not run, if LCR is enabled. Furthermore, it just quits and doesn't give you any helpful message.

So, I usually try to plan so that I don't have to be in a panic, but after dealing with this so long, we're in a place, where the logs are going to fill up the drive, right away. It doesn't seem like a good idea to try to stop LCR or something, but now I'm trying to figure out how to get the logs properly dealt with so I can get the space back on the drive.

Please let me know if you have any suggestions as to how to deal with this. Of course, this is a production server, and I don't want to take risks, but I'm open to suggestion.


Question by:gs-rho
    LVL 14

    Expert Comment

    by:Juan Ocasio
    The best thing to do it to get Backup Exec working.  Once it back ups your exchange server it will properly delete them.

    Author Comment

    Well, the important point there is "get it working"...
    As I mentioned, I've been at this for a while and I was planning to try to avoid a panic, but I might have as little as a day left... but even if I have more, I have to try to squeeze this between end of work-day and possible end of Symatec's workday.  I don't think trying to get Backup Exec working, which would probably involve more "fun" calls to Symantec is going to get me through this, at this point. Anyway, the complexities here may cause this to take longer than the time given.

    Is it possible to disable LCR, run a backup and then re-deploy(?) LCR, after things are backed up and the logs are ok?   I'm just not sure if I disable LCR, whether it will stop and then resync after re-enabling it, or if I have to set it up again. It's something that I have "set and forget", in the past.
    LVL 18

    Accepted Solution

    Hi Gs-rho

    Connect a USB drive as a temporary measure to alleviate and buy you time. Transfer the Exchange logs files to the USB drive.

    Get Backup Exec configured and working correctly, ensure you have installed and configured the product according to the best practices, i.e not installed as Administrator...

    For further reading please see the following links:

    Best of luck!
    LVL 14

    Expert Comment

    by:Juan Ocasio
    One other thing you could do to 'buy time' is delete the uninstall files (or move them) for the windows updates.  These are the ones that begin with $.  You could instal cleaner which can assist in deleting the appropriate ones.  There is one, $hf_mig$ which you cannot touch.  I've done this a long time ago and freed up about 2GB.

    Author Comment

    That's a great idea, Netflo. I've run into some trouble though.

    (Actually, I did get WSB working but now I find out it doesn't support mount points... so this is so fun.)

    I've set up the USB drive and it seems to be working well. I did some file transfer on and off to test it out. Works fine.

    Then I tried doing the MOVE LOGS wizard, and it ran for about 15 minutes displaying "Status: Validating the destination file paths". Then I got the error "WMI exception occured on
    server "-----------": Call cancelled".

    I'm trying to think of why there would be a problem...

    - The folder it is going to is R:\Mailbox\LCR 1SG
    - The log files are about 45GB and several thousand files. Not sure if that shoudl be a problem. There must be bigger servers.

    It would be nice if I could just get the logs to truncate with a backup now. But now I haven't been able to do that and I haven't been able to move them to a bigger drive. If I can't do that, I may have to shut down LCR altogether.

    Author Comment

    I went and moved the database instead. That went over very nicely. And then I moved the primary database as well. Also went over without a problem. So, there's my buying a lot more time, right there. (I was down to hours left. Gosh.)

    I moved the primary database too, as I need to figure out how to move all of it. It is obviously no longer a good design method to use the mount points. I'll have to move everything so that I can fix that.

    I could use some advice about that WMI error though, for the logs.

    Featured Post

    What Is Threat Intelligence?

    Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

    Join & Write a Comment

    Create high volume marketing opportunities using email signatures with these top 10 DOs and DON'Ts of email signature marketing.
    Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
    how to add IIS SMTP to handle application/Scanner relays into office 365.

    733 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now