Fast dwindling Exchange Server system drive space!

How on earth can I find out what is eating up my exchange server system drive fast?  It seems to be dropping around 10% a day and the drive is 134Gb.  Short of trawling through large files using a file size application, or seeing what has been created recently, where is a good place to start?  I have noticed the log files are massive and already moved some of those, perhaps something has been turned on or it is monitoring something I do not know about.  The only changes I know of are Windows Updates and a problem starting the IMAP4 component which has been resolved.

Any good ideas troubleshooting this?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

What are your maintenance settings for the mail databases on this server? It sounds as if your backups are not running or at least you are not using maintenance. After a backup is done log files should be purged based on your maintenance settings.

You can check to see when your last successful backup was done by running the following in EMS:

get-mailboxdatabase -status | select name, last*

This will give you the last backup time of the database.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Uptime Legal SystemsCommented:
Yes, it's likely the logs, it'll spin up a 1MB file every few seconds.  You could optionally enable circular logging to keep the drive space under control.
When i had the issue it was just like they described above. Basically the backups were not successful (full) ones. So the logs would grow and grow since they did not purge since they were not backup up successfully.

So i called Microsoft and as he said above they had me change them to circular logging which purges all the old logs. If you do not have a successful backup by purging these logs my understanding is any diff/inc restores would not be successful.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

As mentioned above, you must make full backups for the logs to get cleaned, and that full backup must be successful and the backup utility used must be exchange aware. Windows Server Builtin backup is exchange aware, but you still need to monitor the backups to make sure they are 100% OK.

If you mainly run incremental backups, or if you are using an Exchange unaware backup tool, enable circular logging as has been mentioned already. You'll still have to check that your backups haven't failed though, as with circular logging enabled, should a backup fail, your chances of restoring parts of the exchange store via the logs would diminish.
fuzzyfreakAuthor Commented:
Thanks guys, you were right, my backups had been failing.  I am running one now and will come back to you to see if this resolves.
fuzzyfreakAuthor Commented:
Unfortunately I am having problems getting my backup to run and presumably because of this the logs are not getting purged.
Could somebody please tell me either -
How do I run maintenance manually, or
How do I change logs to circular

Your main course of action should be to get the backups running first. What backup tool are you running, at what point and with what error message does it fail?
If it 2010 you can change to circular logging in the EMC organization configuration by right clicking on the mailbox and selecting properties. Then Choose the maintenance tab and select 'Enable Circular Logging'. This will clear your logs out though so if you want to keep them make sure you move them somewhere else except for ones that have not yet committed.

Fixing your backup issues should be your first priority though unless you are out of space to the point where Exchange back presure has become an issue.
fuzzyfreakAuthor Commented:
Hi, with the backups I am reliant upon Nova Backup getting back to me by e-mail.
The problem appeared to relate to permissions on our backup device, so not related to my Exchange server.
It is Exchange 2013, so if this can be resolved through the Exchange admin centre, that would be useful.
Its pretty much the same routine, just different interface. Go to Servers then Databases and select the database you want logging changed on. Then select 'Edit' and click on 'Maintenance'. There you can select 'Enable circular logging'. Then just click save and you are good.
fuzzyfreakAuthor Commented:
OK, so I know how to do this but just read that I should not do this if I wish to use VSS (which I do).
So, I am stuck!
Of course not, all backups softwares use VSS to backup Exchange. The following is what restrictions you have by circular logging:

•If enabled during the backup operation or the recovery operation, you cannot restore individual databases.

•Only point-in-time recovery operations are possible.

•You cannot perform incremental or differential backup operations.

But you backup solution is not working so this is not a current issue for you. When you get your backup running correctly or are in the process of doing so you will then need to disable circular logging. Also remember that when enabling/disabling circular logging you will need to dismount and remount your database so it is best to do this at a time where you can afford the momentary outage.
fuzzyfreakAuthor Commented:
OK, for note, these are the locations of the log files taking up about 50Gb of space (combined) -

fuzzyfreakAuthor Commented:
good point, thanks.
Any idea how to dismount/remount the database?
Easiest way is the shell:

Dismount-Database -Identity Your_database_name

And then...

Mount-Database -Identity Your_database_name

This is assuming you are doing it from the server where the database resides.
BTW, you can probably remove most of the logs in C:\inetpub\logs\LogFiles\W3SVC2. Those are IIS logs. I would move them somewhere else where you have space (like another server) and delete them after a given time period you are comfortable with.
fuzzyfreakAuthor Commented:
OK, all done, problem temporarily resolved. - 30gb back in a few seconds work, thank you all very much for your help on this.
fuzzyfreakAuthor Commented:
Before I close this off, and I realise this is off topic, but referring to tshearon's comment about moving/removing the IIS logs. Could you please tell me where these logs are configured i.e. where I can change its location.  I am rather confused why IIS logs are generating on my Exchange server - we don't use IIS - or at least, if we would, that would be on another server.
I just launched IIS but it wanted to connect to a server and the local server did not work.
If this is off topic, I'll happily open a new case.
All mailbox roles in 2013 utilize IIS. For example, on your client access role, the virtual directories used for client access are IIS. Anyway, you configure logging in IIS by opening it and drilling to the default web site then selecting Logging in the Features view. Here is an article about configuring IIS7 from Microsoft.

Why you aren't connecting? I'm not sure. That is another issue. But you should be able to.
fuzzyfreakAuthor Commented:
Excellent feedback, thanks guys.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.