Exchange 2013 database logs going large

Exchange 2013 server running on 2012r2 server. Previouslly we had a Veeam replication job that would remove the database logs during the backup but we are in the process of re-doing our DR and the replication job hasnt been running for a while. Our logs have grown very large. What is the best way to manually remove these logs without causing issues? location of logs is c:\program files\microsoft\exchange server\mailbox\mailbox database 1640xxxxx
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jonathan BriteSystem AdminCommented:
This is actually very easy as I had to do it alot when migrating tons of mailboxes between servers.

Locate the initial chk file for each database.  Mine is E00.chk(It should be in the log folder for each applicable database)

Run following command from Exchange Management Shell as elevated:

esentutl.exe /mk "c:\program files\microsoft\exchange server\mailbox\mailbox database 1640xxxxx\E00.chk"(Make sure you have the correct E0?.chk file in this command)

The line to check is “Checkpoint”. This line tells us the filename of the last committed transaction

You then need to go to the logs directory of the database, sort the logs file by date (very important), and find the matching file name.

you can safely delete any older log files then the one shown by the command.

On my live server, my command was this: esentutl.exe /mk "E:\Mountpoints\Log005\E00.chk"
The ouput of my Checkpoint was " Checkpoint: (0x44C21F,200,0)"
So after sorting, I was able to delete the files E000044C21E and lower, saving about 15GB of space.  Yours will probably be much much more savings.
bankadminAuthor Commented:
I ran the command and it appears to be a hexidecimal number in the checkpoint line.
I attached a screen shot
Jonathan BriteSystem AdminCommented:
can you please take a screen shot of the offending logs folder after you sort by date?  You should see the file E0000CBD7E.  If you do, feel free to delete E0000CBD7D and lower.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

bankadminAuthor Commented:
I looked for that file and its not in there, I also did a search of the directory and I got no matching names found.
Jonathan BriteSystem AdminCommented:
can you please post a screenshot of your logs directory?
bankadminAuthor Commented:
Its attached
Jonathan BriteSystem AdminCommented:
Thanks for the screenshot, it looks like you are in the right folder, I thought the 8 was actually a B.  please run the esentutl.exe /mk command again(like requested above).  It should have a new checkpoint file listed.  Search for that checkpoint file in the directory you just posted a screenshot of.  Do not delete that file, just delete all the E00 log files below it.(I.E. the ones takes before it.).

The file listed under the "Checkpoint" simply shows the latest logs to be committed, so everything prior to that can safely be delted.  Its the same thing any backup program does after it finishes a backup.
bankadminAuthor Commented:
Its attached. How can I format the output of checkpoint so it matches a file name?
Jonathan BriteSystem AdminCommented:
That is odd.  Are you in a DAG environment?  Is there more than 1 exchange server?  The quickest way for you to get space immediately is just to turn on circular logging for now.  If you are in imminent danger of running out of space, I would consider this option before anything else.  Once you get everything you need to get done, you can turn it off and go back to your normal backup routine.

When circular logging is enabled, Exchange writes transaction logs as usual, but when a checkpoint file is advanced, the inactive portion of the transaction log is truncated.  This is why you need to turn it off once you go back to your normal backup schedule.
Adam FarageSr. Enterprise ArchitectCommented:
So as Jonathan said, if you run below 1GB of free space on the volume that holds the database the database will dismount cleanly until 1.5GB of free space are available. You have a few options at this point:

1) You can truncate the transaction logs manually, but this can be risky because if you *delete* them and require them later due to a dirty shutdown then you are out of luck.

2) You can enable circular logging, but this will require the Information Store service to be restarted (e.g: databases dismounted)

3) You can run a full backup using a VSS aware backup software, such as Windows backup or Symantec / Netbackup / Veeam

I say go with #3 if you have enough flexibility and space to hold a backup on disk. If not then going with the circular logging route is most likely the best bet until you can get this sorted out.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bankadminAuthor Commented:
I ended up just running a replication job with Veeam and that took care of the logs.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.