locked
Exchange creates a new logs even no mailbox uses the storage group RRS feed

  • Question

  • We are running Exchange 2007 with 4 storage groups. We have migrated most of our mailboxes to Office 365 (there two web emails need to configure SMTP relay on Office 365) and stopped Exchange backup. However, the Exchange data still increases everyday because of the log files.  In checking the those storages, no one uses storage group 2 and 3, but these two storages have a new log files every day. Why? How can we find out which mailbox uses them?

    Bob Lin, MCSE & CNE Networking, Internet, Routing, VPN Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net How to Install and Configure Windows, VMware, Virtualization and Cisco on http://www.HowToNetworking.com

    Tuesday, December 2, 2014 10:38 PM

Answers

  • An easy way to see what mailboxes are being used on your system is to check your message tracking logs - run the following:

    Get-TransportServer | Sort Name | % { get-messagetrackinglog -Start "11/3/2014" -ResultSize Unlimited } | Select TimeStamp, Sender, Recipients, MessageSubject, EventID, TotalBytes, RecipientCount, RecipientStatus, ServerHostName, MessageLatency*, ConnectorID

    This should get you the information if mailboxes have been used for sending or receiving email.  If you have any retention enabled in your system, this will cause messages to be removed from mailboxes.  And there is the common daily calendar management that the systems does.  If you have the recoverable items and recoverable mailboxes in place, these will be removed over time.  And finally, Exchange closes log files so that the database can be recovered to a certain point in time, regardless of whether there is traffic on the database.  So even if you have removed all access from your mailboxes, and in fact even if you have removed all your mailboxes, you will have transaction logs being closed.

    • Marked as answer by chicagotech Sunday, December 7, 2014 3:58 AM
    Wednesday, December 3, 2014 1:31 PM
  • What you are seeing is normal log churn:

    http://blogs.technet.com/b/timmcmic/archive/2009/06/09/exchange-2007-sp1-ccr-lcr-scr-transaction-log-roll.aspx


    Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    • Marked as answer by chicagotech Sunday, December 7, 2014 3:58 AM
    Wednesday, December 3, 2014 1:51 PM

All replies

  • An easy way to see what mailboxes are being used on your system is to check your message tracking logs - run the following:

    Get-TransportServer | Sort Name | % { get-messagetrackinglog -Start "11/3/2014" -ResultSize Unlimited } | Select TimeStamp, Sender, Recipients, MessageSubject, EventID, TotalBytes, RecipientCount, RecipientStatus, ServerHostName, MessageLatency*, ConnectorID

    This should get you the information if mailboxes have been used for sending or receiving email.  If you have any retention enabled in your system, this will cause messages to be removed from mailboxes.  And there is the common daily calendar management that the systems does.  If you have the recoverable items and recoverable mailboxes in place, these will be removed over time.  And finally, Exchange closes log files so that the database can be recovered to a certain point in time, regardless of whether there is traffic on the database.  So even if you have removed all access from your mailboxes, and in fact even if you have removed all your mailboxes, you will have transaction logs being closed.

    • Marked as answer by chicagotech Sunday, December 7, 2014 3:58 AM
    Wednesday, December 3, 2014 1:31 PM
  • What you are seeing is normal log churn:

    http://blogs.technet.com/b/timmcmic/archive/2009/06/09/exchange-2007-sp1-ccr-lcr-scr-transaction-log-roll.aspx


    Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    • Marked as answer by chicagotech Sunday, December 7, 2014 3:58 AM
    Wednesday, December 3, 2014 1:51 PM
  • Bob, did these responses answer your question, or did you need to know anything else about Exchange transaction logs?
    Friday, December 5, 2014 1:01 PM
  • I run Exchange user monitor and find it is ADFS accessing Exchange. This page may have more details.

    How to use Exchange User Monitor  - Step by step with screenshots


    Bob Lin, MCSE & CNE Networking, Internet, Routing, VPN Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net How to Install and Configure Windows, VMware, Virtualization and Cisco on http://www.HowToNetworking.com

    Sunday, December 7, 2014 4:00 AM