Exchange 2003 transaction log files filling up very quickly

July 7, 2008 by Kiltak |

I haven’t blogged about any IT-related issues in a while, and I thought that the solution to this little-known exchange 2003 problem would probably interest the SysAdmin crowd among you guys.

If one day, you log into your inbox and find an email waiting for you announcing that the disk containing your exchange 2003 transaction log files has almost no more disk space, you may be experiencing the following issue.

As I’m sure you’re aware, the E00*.log files located in your \exchsrvr\MDBDATA are transaction logs containing everything that happened to your Information Store since it was last backed up. As soon as you perform a backup of the store using an exchange-aware agent, the log files will be cleared. However, in this particular situation, the transaction files are filling up the drive too quickly and will consume all of the remaining disk space before you have the time to back up your store.

In this case, you may want to check out your Outlook 2007 clients that have the “exchange cache mode” option enabled. The station that causes the problem will probably have a large number of “sync issues” in the Outlook folder of the same name. I’m not sure of this though. The client who was causing the issue happened to have this problem. Can anyone confirm this? After locating the rogue workstation, the only thing you have to do to fix the problem is to disable the “exchange cache mode”. If you want to re-enable it after, be sure to delete the old OST file and have Outlook create a new one.

But after fixing the issue, your disk will likely still be out of space, so you’ll need to clear those log files before mounting the exchange store again.

WARNING: NEVER, EVER delete the E00 log files manually. The proper way to remove them in this situation is:

1- Make a full backup of your exchange store using an exchange-aware agent.
2- Enable Circular logging. (Don’t forget to disable the option and restart the information store service after you get your disk space back)

VoilĂ ! Now if your Exchange transaction log files folder start filling very quickly, this little tutorial will give you an extra thing to check for to solve your problem!

You Might Also Like:

Share and Enjoy: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • del.icio.us
  • bodytext
  • StumbleUpon
  • Fark
  • Reddit
  • Technorati
  • Mixx
  • Pownce
  • Slashdot
  • TwitThis

Did you enjoy this post? If so, subscribe to the geeksaresexy RSS feed.

RSS feed

13 Comments »

Comment by Joshua Subscribed to comments via email
2008-07-21 07:35:49

Have you ever had the logs fill up due to different issues? Also did you experience the logs filling up and eating the Hard Drive space on just one day out of the week? Please let me know. Thank you.

 
Comment by Kiltak
2008-07-21 09:36:18

Oh Yeah, there’s A LOT of different possibilities. One of the possibilities is that a message is caught in a never ending loop, and keeps bouncing around your infrastructure…

One of hte thing you can do to see if a client is the problem is to open your exchange system manager and go to the mailbox section (where you see all your users mailbox)… now on the RIGHT section of the manager, add the “total ops” or “ops” column… if you see a client generating A LOT more operations than the others, this will probably be your culprit..

Let me know if it works!

 
Comment by Joshua Subscribed to comments via email
2008-07-21 10:13:08

I’m looking in the System Management and do not see or can’t add a column called OPS or total ops. Is this something that has to be added to Exchange?

 
Comment by Kiltak
2008-07-21 10:20:29

Ok got it, sorry, it’s under the Logon section, -

administrative groups - first administrative groups - server - yourservername - first storage group - mailbox store - logons

From there, go on the “View” menu on top, and select “add /remove column”.. then add the column named “Total Ops

After, sort your “ops” column, and if one user is making *WAY* more operations than the others, you’ll probably have your culprit.

 
Comment by Joshua Subscribed to comments via email
2008-07-21 13:09:57

Do you remember which client version your issue system had? I was wondering if this had something to do with it.

Comment by Kiltak
2008-07-21 13:21:23

Yeah, outlook 2007…

 
 
Comment by Joshua Subscribed to comments via email
2008-07-21 13:24:54

No. The client version under logons. (System Manager.)
Examples include 12.0.6300.5000, 11.0.8200.0, ect.)

Comment by Kiltak
2008-07-21 16:39:43

Hmmm, no idea.. I’m in vacation right now and don’t have access to the console.. but this should be available under all versions of the EX2k3 manager.. I run the latest SP with all the most recent patches..

 
 
Comment by Joshua Subscribed to comments via email
2008-07-28 08:48:16

I have a few good questions to ask you. Did you issue happen a particular day of the week, or every day. The second question is did the rouge computer you found, was the Outlook client up and running when it was filling up the logs or was the user logged off? Please let me know. Thank you.

Comment by Kiltak
2008-07-28 09:10:49

The size of the logs were only growing when the client was up… if the computer was powered down, everything was going fine.. The only thing I had to do was to delete and reconfigure the outlook 2007 profile on the client that was causing the problem..

After, I had to do an offline defrag to shrink down the size of the store.

 
 
Comment by Joshua Subscribed to comments via email
2008-07-28 09:25:44

Say the user is not logged into their machine but the machine is still on. Would this still cause the logs to fill up? And our issue is that this, the issue, for us only happens on Sundays. Any reason why it would do that? Thank you.

 
Comment by Kiltak
2008-07-28 09:33:20

Hmmm, in my situation, as soon as outlook was close, the problem stopped occuring.

Is it possible that someone has an event that only runs on sunday? Something like a recurring task… I heard that rules can sometimes cause this kind of problem too..

 
Comment by Matthew Subscribed to comments via email
2008-09-01 03:27:51

We’ve had this problem several times in the last couple of months. It seems to be caused by a corrupted OST and the quickest way to fix is to find the offending user (ExMon is good for this), shut down Outlook, delete their ost file and open Outlook again. This will rebuild it and should sort the problem. All the users were using Outlook 2007, and at least half of them reported a mail being stuck in their outbox when the problem occurred.

It doesn’t seem to fall into any kind of pattern either, we’ve had this happen on different days of the week and at different times.

More worryingly than just transaction logs filling up, we’ve also found that it can quickly fill up a store with blank space. We’re running Exchange 2003 Enterprise edition so fortunately we’re not being hit with store size limits, but disk space is a problem when this kicks off and only recreating stores and juggling mailboxes can reclaim that space.

I’m hoping MS manage to fix this one and get a patch for Outlook 2007 soon, else this could cause major problems if it keeps on happening.

 
Name (required)
E-mail (required - never shown publicly)
URI
Subscribe to comments via email
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> in your comment.

| [GAS] Privacy Policy |