Exchange 2010 SP3, RU5 - Massive Transaction Log File Generation

Question

Hey All,
I am trying to figure out why 1 of our databases is generating 30k Log Files a day! The other one is generating 20K log files a day. The database does not grow in size as the log files are generated, the problem is log file generation.
I've tried running through some of the various solutions out there, reviewed message tracking logs, rpc client access logs, IIS Logs - all of which show important info, but none of which actually provide the answers.
I Stopped the following services to see if that would affect the log file generation in any way, and it has not!
MS Exchange Transport
Mail Submission
IIS (Site Stopped in IIS)
Mailbox Assistants
Content Indexing Service
With the above services stopped, I still see dozens (or more) log files generated in under 10 minutes, I also checked mailbox size reports (top 10) and found that several users mailboxes were generating item count increases for one user of
about 300, size increases for one user of about 150Mb (over the whole day).
I am not sure what else to check here? Any ideas?
Thanks,
Robert
Robert

Answer 1

Hmm - this sounds like an device is chewing up the logs.
If you use log parser studio, are there any stand out devices in terms of the # of hits?
And for the ExMon was that logged over a period of time?  The default 60 second window normally misses a lof of stuff.  Just curious!
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne 
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
Rhoerick, 
Thanks for the response. When checking the logs the highest number of hits were the (Source) Load Balancers, Port 25 VIP. The problem i was experience was the following: 
1) I kept expecting the log file generation to drop to an acceptable rate of 10~20 MB Per Minute (Max). We have a large environment and use the exchange sevrers as the mail relays for the hated Nagios monitoring environment
2) We didn't have our enterprise monitoring system watching SMTP traffic, this is  being resolved. 
3) I needed to look closer at the SMTP transport database counters, logs, log files and focus less on the database log generation, i did do some of that but not enough of that. 
4) My troubleshooting kept getting thrown off due to the monitoring notifications seeming to be sent out in batches (or something similar) stopping the transport service for 10 ~ 15 minutes several times seemed to finally "stop the transactions logs
from growing at a psychotic rate". 
5) I am re-running my data captures now that i have told the "Nagios Team" to quit killing the exchange servers, with their notifications, sometimes as much as 100+ of the same notifications for the same servers, issues. so far at a quick glance
the log file generation seems to have dropped by about 30%. 
Question: What would be the best counters to review in order to "Put it all together"? Also note: our Server roles are split, MBX and CAS/HT. 
Robert 
Robert