none
Exchange 2003 server system process locks .log files

    Question

  • Exchange 2003 server which is not freeing up .log files even after sucessful backup using net backup.  Event log states:

    Event Type: Error
    Event Source: ESE
    Event Category: General
    Event ID: 485
    Date:  3/11/2010
    Time:  11:04:54 PM
    User:  N/A
    Computer: XXXXYYYYY
    Description:
    Information Store (3708) Remote Users: An attempt to delete the file "D:\Program Files\Exchsrvr\Remote Users\E023ACB9.log" failed with system error 5 (0x00000005): "Access is denied. ".  The delete file operation will fail with error -1032 (0xfffffbf8).

    Then get.....

    Event Type: Information
    Event Source: ESE
    Event Category: Logging/Recovery
    Event ID: 213
    Date:  3/11/2010
    Time:  11:04:54 PM
    User:  N/A
    Computer: XXXXYYYYY
    Description:
    Information Store (3708) Remote Users: The backup procedure has been successfully completed.

    I came across the following from technet about this: 

    http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=8.0&EvtID=485&EvtSrc=ESE&LCID=1033 

    Forefrount is our virus scann and I made sure that it is excluding the datastores for exchange. 

    Using process explorer it shows that the above log file (which was created 2/15/2010) handle is held open by the System process.

    Sometimes you can terminate the handle and the next nights backup will process and clean up the log files.  Other times the handle shows up again or it processes some of the log files and then stops on another log file.

    We have 5 other exchange servers and they are all suffering from various degrees of this problem.

    Running Exchange ver: 6.5.7638.1 on Windows 2003 SP 2 fully service patched.

    Is this the Exchange service which is keeping the log file locked; is there a way to know more specifically than system process to know what owns the handle? 

    Also is there a way to manually tell the exchange server to clean up log files without having to run a backup agains the server?

    Thanks for your help and time.

    Larry

    Monday, March 15, 2010 10:27 PM

Answers

All replies