Exchange 2010 server - transaction logs growing

I would suggest add more space and divide users into Multiple Databases as even Log growth can be due to Mailbox Database corruption

- Rancy

I don't see anything in logs about corrupted database.

You went from Exchange 2003 to Exchange 2010.  I've done a few of these, and often the thing that isn't thought about during the transition is enough space for logging.  Please know that there may be nothing wrong with Exchange, there is a big difference in Exchange 2003 vx 2007, and then again 2010.  Please review the following article to calculate and ensure you have the correct amount of space allocated for logging.  This also covers problematic log growth.

http://blogs.technet.com/b/exchange/archive/2011/11/09/capacity-planning-yes-transaction-log-space-is-critical-to-keeping-your-databases-healthy-and-mounted.aspx

Logical or Pointer corruption isnt logged nor if some Mailbox is corrupt or Looping .... Ideally such things get resolved only with Move Mailboxes or Repair but Repair isnt a better Option as one cant assume the data loss

- Rancy

Do you have users with iPhones on your organization? If you have and they are running iOS 6.1 then that may be the cause: https://devcentral.f5.com/community/group/aft/2165837/asg/50

Yes, I have about 30 users using iPhone with iOS 6.1 .. and I read about it on microsoft website http://support.microsoft.com/kb/2814847 , but how can I determine that the issue with iPhone is ? where can I find logs pointing/represent to this issue?
Thanks.

You will find this data in IIS logs and many a people are having to shutoff those iOS devices and get them downgraded or waiting for a Patch

- Rancy

The problems occur when a user accepting an exception to recurring calendar event: https://support.apple.com/kb/TS4532

Microsoft recommends to block iOS 6.1 users : http://appleinsider.com/articles/13/02/12/microsoft-recommends-blocking-ios-61-users-due-to-exchange-server-issue

I've just  checked (Event ID 9826).  These stats represent 2 hours of activity:

Starting from 13.02.2013 13:36:55 service Exchange Transport has performed this activity on the server:
RPC Operations: 22025.
Database Pages Read: 1135 (of which 258 pages preread).
Database Pages Updated: 47487 (of which 41816 pages reupdated).
Database Log Records Generated: 56513.
Database Log Records Bytes Generated: 26595697.
Time in Server: 35408 ms.
Time in User Mode: 7125 ms.
Time in Kernel Mode: 297 ms.

that means I have 26GB Logs in 2 hours ? .. how can I find which user generate so many logs ?

I run this command and could determine mailbox, that move a lot of data:
[PS] C:\Windows\system32>$stats = Get-StoreUsageStatistics -Database "Mailbox Database"
[PS] C:\Windows\system32>$stats | ? {$_.DigestCategory -eq 'LogBytes'} | group MailboxGuid |sort count -Descending | Sel
ect -first 1 -ExpandProperty Group | sort SampleTime | ft -a MailboxGuid,Sample*,Log*

MailboxGuid                          SampleId SampleTime          LogRecordCount LogRecordBytes
-----------                          -------- ----------          -------------- --------------
6ff7e793-b185-4dac-8de7-66792fdb7308        5 13.02.2013 15:06:35            606         101314
6ff7e793-b185-4dac-8de7-66792fdb7308        4 13.02.2013 15:16:36           1456         658270
6ff7e793-b185-4dac-8de7-66792fdb7308        3 13.02.2013 15:26:35           1137         481880
6ff7e793-b185-4dac-8de7-66792fdb7308        2 13.02.2013 15:36:32            769          74246
6ff7e793-b185-4dac-8de7-66792fdb7308        1 13.02.2013 15:46:32           1901        3618299
6ff7e793-b185-4dac-8de7-66792fdb7308        0 13.02.2013 15:56:32           1056         455361

what can you say ?

schould I block only this one user?

On my environment I would do it, but that's up to you.

Just make sure that one is not the CEO or another BIG BOSS.

I would block the user and let him know about the issue ..... as i cant take issue on server due to such stuff and take Outages

- Rancy

and how can I empty transaction log now?

I would either have Circular logging for the time or else Move any log older than an Hour to another location (Please dont delete anything until you move and ensure everything is working fine for few hours) as its better to be safe guarded

- Rancy

ok, I  told user to remove his accoutnt on iPhone.. but after 30min I see that transaktion logs still growing up...

how can I determine which user's iphone I should block?

Thanks

Download the script from this page: http://exchangeserverpro.com/block-ios-61-exchange-2010
find who is running iOS 6.1 and then block those users.

I can't block all iso 6.1 users.. I would like to find the exactly user, which iphone is wrong

thanks, I found this post http://hermannmaurer.blogspot.ie/2012/05/exchange-2010-transaction-logfiles-grow.html?m=1 , so I could find users causing so many logs. it were all sync logs with calendar. and I found 3 users..
After backup, the logs were empty, and until now it has growed only about 2GB. (for 5 hours)

I'll close this post for now.

I've requested that this question be closed as follows:

Accepted answer: 0 points for iconscm's comment #a38888396

for the following reason:

I found by myself the post in internet describing, how determine my issue. but no solution is possible in my case

Sorry... maybe I was too fleet... sorry.. The problem isn't resolved for me.. and the normaly solutaion is to wait upgrade from apple or microsoft... but you're right, I was wrong... these both people helped me to understand, that no solution is possible with ios 6.1 and exchnage at the moment.