Our log files on our Microsoft Exchange Server 2003 have jumped from about 50,000 k to 500,000 k per day at some point in the past month. Looking at the log files, they seem to be communicating with a couple specific users' apple devices extremely frequently (having as many as 50 search's and get's per second). I had one of the users delete her account on her iPad and her connections disappeared as expected (along with about half of the log file size). The next day, another user began showing up despite having no changes made to their account or connections. This user's iPhone comes up as the device.
We have at least 40 different users that get mail on their iPhones and about 10 or so that do it on their iPads. The devices are a mix of models, with some being iPhone 4S or iPad 2 and others being previous generations. We can't seem to figure out what's causing this to happen for these three specific users. We need this fixed as it fills up the C drive partition of the server and prevents it from delivering mail.
I understand that we can turn off logging but my boss wants to keep the records for I/T security reasons.
2011-12-22 00:00:01 W3SVC1 192.168.0.15 SEARCH /exchange-oma/<email@example.com>/ - 80 - 192.168.0.15 Microsoft-Server-ActiveSync/6.5.7638.1 401 1 0
2011-12-22 00:00:01 W3SVC1 192.168.0.15 SEARCH /exchange-oma/<firstname.lastname@example.org>/ - 80 <DOMAIN>\<username> 192.168.0.15 Microsoft-Server-ActiveSync/6.5.7638.1 207 0 0
2011-12-22 00:00:01 W3SVC1 192.168.0.15 GET /exchange-oma/<email@example.com>/NON_IPM_SUBTREE/Microsoft-Server-ActiveSync/iPhone/Appl<serial number>/e8e6145de4f82f4ab9fc8972c1e29248-1b5bfc0 - 80 <DOMAIN>\<username> 192.168.0.15 Microsoft-Server-ActiveSync/6.5.7638.1 200 0 0