Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Exchange Logfiles

Posted on 2011-05-06
9
Medium Priority
?
651 Views
Last Modified: 2012-08-13
We are running Exchange 2010 Enterprise on a 2008 R2 Enterprise server.  This server is our mail server, web server, file server, ftp server, etc.

Every few days, for some reason, I see a very large number of logfiles for our primary Exchange database.  In one day, I had over 30,000 log files.  Normally there are far fewer logfiles at the end of the day, usually closer to 1,000.

We backup Exchange every night which clears out the log files from the previous day.

I noticed today when I saw around 10 logfiles being generated per minute that if I restarted the DNS server service, Exchange stopped creating logfiles at such a fast pace.  I have seen this happen several times bfore.

Anyone have an idea of what is happening?  I can't find any error messages that would give me a clue.

Thanks
0
Comment
Question by:ArchitectChuck
  • 4
  • 3
  • 2
9 Comments
 
LVL 8

Expert Comment

by:steinmto
ID: 35706034
Do you have any error messages in the event log?  Check your mail queue are there a lot of messages sitting in it?  It sounds like your volume of mail or you have increased actvity on your exchange server.  Have you made any changes on the exchange server?  I have seen this with open relay servers or viruses that are sending out on a server.
0
 

Author Comment

by:ArchitectChuck
ID: 35706131
I don't see any error messages that are occurring when the problem starts.

The mail queue is empty.  All email is being properly processed.

We are using GFI maill essentials as a spam filter.  Our server processes about 11,000 emails a day of which 97% is spam.

We have not seen a change in the email volume.
0
 
LVL 8

Expert Comment

by:steinmto
ID: 35706226
Have you tried updating GFI or are you on the latest version?  Do you have any other 3rd party apps the interface with Exchange?
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 

Author Comment

by:ArchitectChuck
ID: 35710680
GFi is the latest version.

I have to check on Panda our virus protection to see if that is creating a problem
0
 
LVL 17

Expert Comment

by:lucid8
ID: 35713123
Several things you can check when it comes to rogue log generation, it can happen for many reasons i.e.

1. Data importation (doesn't sounds likely based upon your explanation)

2. Mailbox Moves and in some cases stuck/looping pending moves

3. Automated mailings, i.e. if you have someone sending out large mail blast

4. Spam

5. 3rd party integration, i.e. if you are using a CRM system with an outlook plugin it can cause issues.  I know there was an issue with MS CRM Dynamics that caused this in the past

6. Devices gone wild like iPhones etc http://msexchangeteam.com/archive/2010/06/30/455342.aspx

If you want to see if the problem is coming from an internal Device/Machine you can use one of the following

MS USER MONITOR: http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en and here is a link on how to use it http://www.msexchange.org/tutorials/Microsoft-Exchange-Server-User-Monitor.html

And this is a great article as well http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx
0
 

Author Comment

by:ArchitectChuck
ID: 35734214
Thanks Lucid8

AS AN UPDATE:
Yesterday I had over 60,000 logfiles within 24 hours.

Today, I have less than1,000 over the same time period.  From around 7:00 pm last night to 7:00 am this morning, there were only 108 logfiles created

I also noticed that in one two minute period, I had 169 log files.  In another one minute period, I had 93 logfiles.

To me, this is significant, because it is telling me that some type of event is causing these logfiles to be created, but it is able to stop on its own.


Responses to Lucid8's list:
1.  There have been no data imports
2.  I haven't moved any mailboxes in 3 months.  (Thats when we completed the migration from Exch2003)
3.  We don't do automated mailings other than using a Distribution list within Outlook.
4.  GFI Mailessentials should be stopping most spam before Exchange sees it.  Still, it is a possibility.
5.  We are not using any 3rd party software.
6.  This is a possibility!  We have several mobile devices that now connect directly to Exchange, from iPhones to Androids.  I will check out your suggestions.


THANKS for your help everyone!!
0
 
LVL 17

Accepted Solution

by:
lucid8 earned 2000 total points
ID: 35734237
Yes definitely check out the smart phones since that has been problematic and usually ensuring the IOS is updated is the first step.  I would also deploy the tracking methods to see if you can hone in on the culprits, i.e.

If you want to see if the problem is coming from an internal Device/Machine you can use one of the following

MS USER MONITOR: http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en and here is a link on how to use it http://www.msexchange.org/tutorials/Microsoft-Exchange-Server-User-Monitor.html

And this is a great article as well http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx 
0
 

Author Closing Comment

by:ArchitectChuck
ID: 35754834
Thanks for everyone's responses.  As it turned out, the problem was not a mobile device, but my home laptop computer.  It has Windows 7 Ultimate - 64 bit OS with Outlook 2010 and all updates.  It connected over the net without VPN.

I left Outlook active over our cable connection so that it was up to date when I got home.  I never had a problem or an error message.  It worked great.

However, it was apparently creating all of the extra transaction logs in Exchange.  Since I closed Outlook on my home computer, I have not had a problem with Exchange Logfiles.

I assume this is something Microsoft needs to address.

Again, thanks for your help!!
0
 
LVL 17

Expert Comment

by:lucid8
ID: 35754865
Thanks for the updates and the points as well!
0

Featured Post

Get quick recovery of individual SharePoint items

Free tool – Veeam Explorer for Microsoft SharePoint, enables fast, easy restores of SharePoint sites, documents, libraries and lists — all with no agents to manage and no additional licenses to buy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to effectively resolve the number one email related issue received by helpdesks.
This article will help to fix the below errors for MS Exchange Server 2016 I. Certificate error "name on the security certificate is invalid or does not match the name of the site" II. Out of Office not working III. Make Internal URLs and Externa…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Suggested Courses

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question