Exchange 2010 Excessive Archive Transaction Logs

I've got an Exchange 2010 environment with about 225 users over 6 mailbox DB's with corresponding Archive DB's.
They're seeing log files for the archive DB's growing by about 25-30% of the total DB size daily. Those logs are generally about 8 x the logs generated by the corresponding primary mailbox database.
Something like
DB1 = 20GB daily average logs 2GB
DB1Archive = 90GB daily average logs ~28GB
I don't see any Retention policies that have duplicated Tags and the Default policy has no tags assigned.
The customer wants to continue with their existing backup process of weekly fulls and daily incremental/differentials, and missing two days is enough to max out their transaction log volumes. (which are as large as their combined database size).
The archive db's have been in place for at least 12 weeks now so it's not just initial population, which is obvious by the fact that the archive db's are much larger than the original db's and the total logs in a week exceed the DB volumes by 2-3 times.

Hi,
First, please make sure there is no corruption in the retention policies.
If there is no corruption, I recommend you create a new archive mailbox database and move archive mailbox to this new database to check result.
Besides, here is a similar thread for your reference.
http://social.technet.microsoft.com/Forums/en-US/77845ba9-96c4-4b94-8d55-b47c51ef8974/exchange-2010-archive-transaction-logs?forum=exchange2010
Hope this is helpful to you.
Best regards,
Belinda Ma
TechNet Community Support

Similar Messages

Exchange 2010 DAG backup & Transaction logs

Hi,
What is Microsoft recommended best practise for Exchange DAG group backup in an environment where there are Active & multiple (2-3) passive copies of the databases?
Is it a good practice to backup transaction logs as frequently as possible in addition to daily full backup ? This I belive will allow to restore the DB to the latest possible state
using last good full backup & transaction logs (Like restoring SQL databases)
Thanks

Hi,
Windows Server Backup can't backup passive copy. If you want to backup both active and passive copies, you need to use DPM or other third party.
Here is a similar thread for your reference.
Exchange 2010 DAG Backup Best Practices
http://social.technet.microsoft.com/Forums/exchange/en-US/269c195f-f7d7-488c-bb2e-98b98c7e8325/exchange-2010-dag-backup-best-practices
Besides, here is a related blog below which may help you.
Backup issues and limitations with Exchange 2010 and DAG
http://blogs.technet.com/b/ehlro/archive/2010/02/13/backup-issues-and-limitations-with-exchange-2010-and-dag.aspx
Hope this helps.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Exchange 2010 - Load balancing transaction logs in a DAG

I have a single Exchange 2010 DAG. Within the DAG, I have two mailbox servers. I have 2 DB's mounted on server A, and 3 DB's mounted on server B.
The size and quantity of transaction logs on server A always seem to be larger. It might be the nature of the mailboxes on server A, but I was wondering if there is a tool or script to verify best practices for how the transaction logs should be configured.
Thanks
Ron

I have a single Exchange 2010 DAG. Within the DAG, I have two mailbox servers. I have 2 DB's mounted on server A, and 3 DB's mounted on server B.
The size and quantity of transaction logs on server A always seem to be larger. It might be the nature of the mailboxes on server A, but I was wondering if there is a tool or script to verify best practices for how the transaction logs should be configured.
Thanks
Ron
So one of the DBs is not replicated? Im not sure what you mean by "how the transaction logs should be configured".
You only real choices are disk location, whether you want to lag a copy or if you want to enable circular logging. Things that with 2 mailbox servers you wouldn't want do other than define the disk location. Otherwise, there isn't much to configure as far
as the logging.
Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

Exchange 2010 Mail Submission Service Logging

Hi,
Is there a way to log all submitted messages from outlook clients (online mode) so I can see what is happening to messages that are getting stuck in the Outbox from the server's perspective?
Thank you.

If you look at the logging section in this post
http://blogs.technet.com/b/rmilne/archive/2013/11/20/exchange-2010-tweaks.aspx
add key="LoggingTag" value="ConnectDisconnect, Logon, Failures, ApplicationData, Warnings, Throttling" />.
You can also add ROP logging, which are the individual Outlook commands sent, by adding the tag to the above line.
This gets *VERY* busy. *VERY* quickly, so maybe try this out on a test box first to see what that gives you.
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Exchange 2010 - deleting IIS Advanced log entries

Hi
I am trying to increase the free space on the system drive of our Exchange 2010 servers. Is it OK to delete the entries in
inetpub - Logs - Advanced Logs?
Thanks
J.

Hello,
You can also use a scheduled script:
https://social.technet.microsoft.com/Forums/systemcenter/en-US/d989b249-0159-41fc-b78c-1f1d91ce8bb3/inetpublogslogfilesw3svc1-getting-very-large?forum=configmgrgeneral
Thanks,
Simon Wu
TechNet Community Support

Exchange 2010 personal archive database massive log file generation

Exchange Server 2010 SP3 + Update Rollup 4
Windows Server 2008 R2, all updates
VMware ESXi 5.5
Server config: 2 x Xeon Quad Core 2.20GHz, 16GB RAM
We recently started using personal archives. I created a database for this purpose ("Archive Mailboxes") on the same datastore as our live mailbox database ("Live Mailboxes"). It works great except that the mailbox maintenance generates
massive amounts of log files, over 220GB per day on average. I need to know why. The Live Mailbox database generates around 70GB of log files every day. The database sizes are: Live = 159.9GB, Archive = 196.8GB. Everything appears to be working fine, there
are no Error events related to archiving. There are 10025 MSExchangeMailboxAssistant warning events logged every day. I have moved those mailboxes back-and-forth to temp databases (both Live and Archive mailboxes) and the 10025 events have not stopped so I'm
reasonably certain there is no corruption. Even if there were it still doesn't make sense to me that over 100 log files are generated every single minute of the day for the Archive store. And it's not that the database isn't being fully backed up; it is, every
day.
Do I need to disable the 24x7 option for mailbox maintenance to stop this massive log file generation? Should I disable mailbox maintenance altogether for the Archive store? Should I enable circular logging for the Archive store (would prefer to NOT do this,
though I am 100% certain we have great backups)? It appears to me that mailbox maintenance on the Live store takes around 12 hours to run so I'm not sure it needs the 24x7 option.
This is perplexing. Need to find a solution. Backup storage space is being rapidly consumed.

I'm sure it will be fine for maintenance to run only on weekends so I'll do that.
We use Veeam B&R Enterprise 7.0.0.833. We do not run incremental backups during the day but probably could if necessary. All this is fine and dandy but it still doesn't explain why this process generates so many logs. There are a lot of posts around
the internet from people with the same issue so it would be nice to hear something from Microsoft, even if this is expected behavior.
Thank you for the suggestions!

To find timestamp of Exchange 2010 Online Archive Execution Status

Hi,
I would like to have Exchange online archive execution timestamp whenever it's running through managed retention policies.
Can anyone help to provide the script or way to find the last online archive completion status for individual mailbox level?
The following command does not providing when the last online archive completed.
==============================================================
Get-Mailbox "user1" | Get-MailboxStatistics -archive | fl displayName,Database,itemcount,totalitemsize,LastLogonTime,lastlogofftime,storagelimitstatus
DisplayName        : Online Archive - User1
Database           : MBX-OnlineArchive1
ItemCount          : 5216
TotalItemSize      : 789.3 MB (827,625,361 bytes)
LastLogonTime      : 12/31/2013 1:19:00 PM
LastLogoffTime     : 12/31/2013 1:20:47 PM
StorageLimitStatus : BelowLimit
================================================================
MD

Hello,
Come back and mark the replies as answers if they help and unmark them if they provide no help.
I'm marking the reply as answer as there has been no update for a couple of days.
If you come back to find it doesn't work for you, please reply to us and unmark the answer.
Cara Chen
TechNet Community Support

Exchange 2010 Online Archiving - Folder Structure Incorrect

Greetings,
We have recently been enabling Exchange Archiving for various users with great success. I have one particular user that we have enabled it on, and it appears the Online Archive folder structure is not being generated when items are processed to be
archives. Items are being archive to the root of the Online Archive mailbox, where with other users, we notice that it create a folder that matches the same folder in the users primary mailbox and then moves the messages to that folder.
What would be causing this not to generate a folder structure that matches the folder structure on the users primary inbox? We have seen these successfully done on multiple users, but this particular users it is not working. As I stated above, all
archived e-mails are being stored in the root folder of the Online Archive Mailbox.
Any thoughts are greatly appreciated.
Cheers

Hi,
I would like to verify if you use the same method to enable online archive for these users.
I recommend you use the following cmdlet to enable online archive for this problematic user.
Enable-Mailbox [email protected] -RemoteArchive -ArchiveDomain "xxx.xxx.xxx"
What's more, you can use the Get-Mailbox alias -Archive | fl name,archive* to check the archive information.
Here is a helpful article for your reference.
Enable a Personal (On-Premises) or Cloud-Based Archive for an Existing Mailbox
http://technet.microsoft.com/en-us/library/dd979796(v=exchg.141).aspx
Hope it helps.
Best regards,
Amy
Amy Wang
TechNet Community Support

Exchange 2010 / Outlook 2010 "client error in synchronization log"

Exchange
2010:
Error
in Synchronization Log
19:28:32 Error synchronizing
folder
19:28:32                               [8004010F-501-8004010F-0]
19:28:32                               The
client operation failed.
19:28:32                               Microsoft
Exchange Information Store
19:28:32                               For
more information on this failure, click the URL below:
19:28:32                               http://www.microsoft.com/support/prodredirect/outlook2000_us.asp?err=8004010f-501-8004010f-0
Please
assist with this error. Is it serious? The URL provided does not offer nor reflect any worthwhile information. Thanks.

The error means that the client hasn’t located the resource it’s looking for
Does the error appear on all outlook clients?
Do you use organizational forms library? (KB
933358)
The error can be caused by incorrect permission on the “EFORMS REGISTRY”, so please run the cmdlet below to check the permission on
the Default group, the permission should be “Reviewer”
Get-PublicFolderClientPermission “\NON_IPM_SUBTREE\EFORMS REGISTRY”
Per my research, you can avoid this error by removing all the subfolders in the “EFORMS REGISTRY” folder, if you don’t use organizational
forms library. But, please use the Get-PublicFolderStatistics cmdlet to verify that no items under the “EFORMS REGISTRY” folder before. And, if the error still appears, please remove the OST file and then recreate the mail profile
Please run ExBPA against the exchange servers for health/permission check
Notes: If forms library replicas are added to Exchange 2010 servers, 80004005-501-4B9-560
will appear in the sync message, yet it can be safely ignored
Resources:
“The Organizational Forms Library has been deleted and re-created after the .ost file has synchronized the library” section
in You receive an error message when you try to synchronize your offline folder file if the Organizational Forms Library on your Exchange computer has
been re-created or cannot be located
James Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact [email protected]

Transaction Logs Troubleshooting

Hi,
I have recently deployed a brand new Exchange 2013 scenario for a customer and the exchange system is working well but I have found the transaction logs are growing at an extra ordinary rate and I'm struggling to troubleshoot the issue.
There are two Exchange servers in this deployment with a WAN connection between the two locations. I have also setup a DAG with a copy of the database at both locations.
The Mail flow is good users are using the system.
This issue only applies to one of the Exchange servers where the transaction logs are being created at about 1 every 5 seconds. There are only about 12 Mailboxes in each location so I see no reason for so many transactions taking place.
I have tried to locate whats causing the issue and have tried to use ExMon but this doesnt appear to work with Exchange 2013. The only bit of useful information I have found was to use this:
http://blogs.technet.com/b/exchange/archive/2012/01/31/a-script-to-troubleshoot-issues-with-exchange-activesync.aspx
where it did show there was one particular Android device that had a very high Hit count. I have asked the user to disable the device's email for the time being while I investigate further but the transaction logs are still growing.
From the same results I also see the Healthmailbox's have high hit numbers.
The script also has a line with some 55000 hits but its user is blank. What is this likely to be?
Is there a tool I can use to help me identify whats causing these logs to grow so fast?
I have installed some backup software to run every night that helps reduce the logs and also enable circular logging which I understand will help prevent running out of space on the drive.
Would really appreciate some guidance.
Thanks
Bill

Do you have any third party software AV installed on Exchange mailbox servers. If so can you disable them for a while or set exclusions for Exchange files on them.
Check the queue and see if there are any emails stuck in the queue
Just run below command to check if there are any large emails with attachment stuck in any of the users mailbox which might cause the issue
get-mailbox -ResultSize Unlimited| Get-MailboxFolderStatistics -folderscope Outbox | Sort-Object Foldersize -Descending | select-object identity,name,foldertype,itemsinfolder,@{Name="FolderSize MB";expression={$_.folderSize.toMB()}} | export-csv OutboxItems.csv
In your case most likely any third party AV might be causing this. Just disable third party AV if any and check.
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you

The transaction log for database 'WSS_Content' is full. To find out why space in the log cannot be reused, see the log_reuse_wait_desc column in sys.databases

Hi all,
Observing the below error in event logs once in every day at 3:30 AM on the on SQL Server Machine, it is being used for TFS 2010.
The transaction log for database 'WSS_Content' is full. To find out why space in the log cannot be reused, see the log_reuse_wait_desc column in sys.databases
Kindly advice me here on what to do?
Thanks in advance

First thing to check is, what is happening at 3:30am to cause the log to fill up? Is there any maintenance tasks being run against the DB, such as index re-organizations or rebuilds? If so, take a look at what the job is doing, maybe it could
be tuned (ex: A Maintenance Plan with a rebuild indexes task will rebuild *every* index whether it needs it or not. Look at using something that checks how fragmented an index is, and then intelligently determines what, if anything, to do to that
index.)
Basically, the error is telling you that SQL is trying to do something in the DB, and has filled up the log (either because it's not getting backed up often enough, or the transaction in question is running *very* long, or your log is set to not auto-grow)
So, a couple possible solutions:
Increase the frequency of Transaction Log backups of WSS_Content (only works if the DB is in Full Recovery)
If you've got the disk space, turn on auto-growth for the TLog (or just manually grow it larger) {This will work for both Full and Simple Recovery}
It would be nice to know what's causing the space to not be re-used, but with this occuring at 3:30am, you'll either need to set up an Agent job to run around that time and record its results, or manually run something like "select log_reuse_wait_desc from
sys.databases where name = 'WSS_Content';" Me, I prefer to be soundly sleeping at 3:30am and would set up an Agent job to run from say about 3:00am to 3:45am once per minute (maybe even more frequently.)
DON'T shrink the log, though. SQL will idealy grow the log as large as it needs it (if autogrowth is enabled) and no more. If you shrink the file, SQL will just have to re-grow it later again, which can affect performance.
Jason A.

Cleaning up transaction logs on a CE507/560

Hi,
We are exporting the CE transaction logs to an FTP server.
Is there any function on the CE that will delete any transaction log that has been FTP'ed off of the box?
Thx.

HI,
I could not copy the archived transaction logs to the ftp server, here is the message i received every time:
Jun 08, 2004 12:45:29 Session 25, Peer xx.xx.xx.xx 550 temp : No such file or directory.
i cannot specify the directory to which the transaction logs are copied.
Can you give me a detailed example explaining how to define the ftp directory. i'm using 3cdaemon ftp server.
Regards

IPhones using activesync causing excessive transaction log growth on Exchange 2010

Hi there.
We have around 60 iPhone or iPad users who are retrieving their emails from our Exchange 2010 SP2 servers using activesync.
Back when everyone was using the 3GS this worked just fine but late in 2011 we noticed that the transaction logs on our exchange servers were growing out of control. They should be roughly two times the volume of emails sent or received but all of a sudden we were getting fourty times as many! We only send just over 1GB of emails per week but have 50GB of transaction logs in that time.
I've spent ages trying to track down the cause and have an open TAC case with Microsoft that's been dragging on for several months now. We have recently proved that it's activesync causing the log growth - disable it and everything returns to normal - but they don't seem to be in any rush to identify a fix and I suspect their answer will be "Stop using iPhones".
Has anyone else seen this behaviour before and if so did you find a fix?
I was hoping iOS 6 might provide a solution but I'm reluctant to get everyone to upgrade because of the well publicised problems with maps and now I see that there are different Activesync bugs involving cancellation of meeting requests.
Anyone who can provide me with a resolution will win a prize as I'm at my wits end here.
Thanks

I have seen the issue twice in two weeks. Two different users, the commonality is both an iphone, and an ipad. In both cases the ipad was on wifi. I was able to turn on device logging in the ECP and in 20 minutes captured over 1 MB log on i-pad. I disabled the i-pad via the ecp and issue disipated.
When I reviewed the log the content that was being sync'd was over 5 months old. I instructed the user to back off to 30 days. Device is still stable, and the 30 days is just a temporary solution. I have opened a case with Microsoft for further review of the session log. What is interesting is that the log is consumed with a particular fetch and message class: ipm.note.eas <- EAS is the Exchange Archiving System stub created by Zantaz. I confirmed with our admin that we did not do any sync on the EAS server. I am looking into if the User initiated an Outlook resync of stubs.
<Fetch>
     <ServerId>8:19930</ServerId>
     <Status>1</Status>
     <ApplicationData>
      <To xmlns="Email:" bytes="50"/>
      <From xmlns="Email:" bytes="35"/>
      <Subject xmlns="Email:" bytes="18"/>
      <DateReceived xmlns="Email:">2012-08-26T04:01:29.964Z</DateReceived>
      <DisplayTo xmlns="Email:" bytes="16"/>
      <ThreadTopic xmlns="Email:" bytes="14"/>
      <Importance xmlns="Email:">1</Importance>
      <Read xmlns="Email:">0</Read>
      <Body=4502 bytes/>
      <MessageClass xmlns="Email:">IPM.Note.EAS</MessageClass>
      <InternetCPID xmlns="Email:">1252</InternetCPID>
      <Flag xmlns="Email:"/>
      <ContentClass xmlns="Email:">urn:content-classes:message</ContentClass>
      <NativeBodyType xmlns="AirSyncBase:">3</NativeBodyType>
      <ConversationId xmlns="Email2:">BEF20C7413954F8DAC2C558F7AE26FF0</ConversationId>
      <ConversationIndex xmlns="Email2:">CD8206EA510011DCEC00FFFF9F122F8002B86D80</ConversationIndex>
      <Categories xmlns="Email:"/>
     </ApplicationData>
    </Fetch>
device details:
Device OS:
iOS 6.0.1 10A523
Device language:
en
User agent:
Apple-iPhone4C1/1001.523
Device OS:
iOS 6.0.1 10A523
Device language:
en
User agent:
Apple-iPad3C2/1001.523

Moving Exchange 2010 Transaction Log

Hi. Running a single instance of SBS2011 with Exchange 2010. We only have one mailbox.
Earlier today I moved our main exchange database (.edb) file to a different hard drive. Used EMC, went through smoothly, no issues.
I then started moving the transaction logs. Same process:
Exchange Management Console > Organization Configuration > Mailbox > Move
Database Paths
This appeared to be going fine but after 40 mins came up with an error along the lines of "WinRM cannot process the request in the time specified"
Now I cant access any mailboxes. OWA giving the error - Your mailbox appears to be unavailable. Try to access it again in 10 seconds. If you see this
error again, contact your helpdesk
I have checked in EMC and the mailbox is successfully mounted. I have restarted all exchange services.
I also now have 8.5GB of log files in the "new" location. Not if these are just copies or exchange is actually using this drive.

Hi:
I think you may be over complicating this. SBS includes a wizard in the SBS Console to move most/all of the user impacted data stores, including Exchange, SharePoint, WSUS and Redirected folders. The transaction logs are limited in size if you
use either the SBS backup or a third party backup that is "Exchange Aware" to backup the server or the Exchange subsystem, so there is really no need to move the logs, assuming you are making good backups.
Larry Struckmeyer[MVP] If your question is answered please mark the response as the answer so that others can benefit.

Exchange 2010 SP3, RU5 - Massive Transaction Log File Generation

Hey All,
I am trying to figure out why 1 of our databases is generating 30k Log Files a day! The other one is generating 20K log files a day. The database does not grow in size as the log files are generated, the problem is log file generation.
I've tried running through some of the various solutions out there, reviewed message tracking logs, rpc client access logs, IIS Logs - all of which show important info, but none of which actually provide the answers.
I Stopped the following services to see if that would affect the log file generation in any way, and it has not!
MS Exchange Transport
Mail Submission
IIS (Site Stopped in IIS)
Mailbox Assistants
Content Indexing Service
With the above services stopped, I still see dozens (or more) log files generated in under 10 minutes, I also checked mailbox size reports (top 10) and found that several users mailboxes were generating item count increases for one user of
about 300, size increases for one user of about 150Mb (over the whole day).
I am not sure what else to check here? Any ideas?
Thanks,
Robert
Robert

Hmm - this sounds like an device is chewing up the logs.
If you use log parser studio, are there any stand out devices in terms of the # of hits?
And for the ExMon was that logged over a period of time? The default 60 second window normally misses a lof of stuff. Just curious!
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
Rhoerick,
Thanks for the response. When checking the logs the highest number of hits were the (Source) Load Balancers, Port 25 VIP. The problem i was experience was the following:
1) I kept expecting the log file generation to drop to an acceptable rate of 10~20 MB Per Minute (Max). We have a large environment and use the exchange sevrers as the mail relays for the hated Nagios monitoring environment
2) We didn't have our enterprise monitoring system watching SMTP traffic, this is being resolved.
3) I needed to look closer at the SMTP transport database counters, logs, log files and focus less on the database log generation, i did do some of that but not enough of that.
4) My troubleshooting kept getting thrown off due to the monitoring notifications seeming to be sent out in batches (or something similar) stopping the transport service for 10 ~ 15 minutes several times seemed to finally "stop the transactions logs
from growing at a psychotic rate".
5) I am re-running my data captures now that i have told the "Nagios Team" to quit killing the exchange servers, with their notifications, sometimes as much as 100+ of the same notifications for the same servers, issues. so far at a quick glance
the log file generation seems to have dropped by about 30%.
Question: What would be the best counters to review in order to "Put it all together"? Also note: our Server roles are split, MBX and CAS/HT.
Robert
Robert

Exchange 2010 Excessive Archive Transaction Logs

Similar Messages

Maybe you are looking for