Re: Exchange - Huge (x10) mismatch between size of priv1.edb and actual size of mailboxes in mailbox store

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Yes - for a period it was adding 20 logs an hour but that has now stopped -
no new logs for the last 5 hours.

I'll check the 1221 event.


"Dave Nickason [SBS MVP]" <gwdibble@xxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:%234C6nNx9HHA.748@xxxxxxxxxxxxxxxxxxxxxxx
How much free space does the 1221 event from this morning say is in that
database?

My last full backup completed at 2:45 AM (about 14 hours ago) and I have
about 40 transaction logs. That's with about 20 users and not especially
heavy mail volume. Are you saying that your Exchange is adding 20 logs an
hour?

I'm not really an expert on the inner workings of the databases, but my
understanding is that it's not only incoming e-mail that gets cached in
the transaction logs. I think client actions that read from the database
are going to result in the read information going into the logs as well.
All this stuff is well documented - for a start see
http://technet.microsoft.com/en-us/library/d42ef860-170b-44fe-94c3-ec68e3b0e0ff.aspx.


"Roger Cook" <roger-nospam-or-junk-at-redpuma.co.uk> wrote in message
news:urgigCx9HHA.1900@xxxxxxxxxxxxxxxxxxxxxxx
No - the log files are normally cleared out on a daily basis by the
backup but we seem to have gone from the usual circa 4 or 5 log files a
day to 20 + an hour at one stage today (this is in the space of a week
with the same number of users).
It was as if a huge amount of email was coming in but not going
anywhere - hence why I wanted to examine the contents of the exchange
transaction log files

The POP3 connector is in use, not SMTP. POP3 logging was not turned on
(it is now) at the time so not sure what happened. (Trend CSMSS is
installed)

I find it hard to believe that there has ever been 1.8GB of data on the
system - the users generally have minimal amounts of email in their
mailboxes and the system is not that old.


"Dave Nickason [SBS MVP]" <gwdibble@xxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:ed3ue6w9HHA.5404@xxxxxxxxxxxxxxxxxxxxxxx
A full, online backup of Exchange will commit the transaction logs to the
databases, so you start each day with new logs. If you're seeing an
ever-increasing number of log files, there's something going on with your
backup.

On the size topic: Let's say you have a GB of database and it's full
with ten 100 MB mailboxes. You delete one of the mailboxes, so now you
have 900 MB of data. The size of the database does not decrease, but
rather it now has 100 MB of "slack" space. You add a mailbox, and as
that mailbox increases in size, it starts occupying the slack space
until the database again becomes full. At that point, the database size
will grow automatically, but it will never shrink automatically.

You can see this by looking in the server's application log for Event ID
1221, which will tell you how much free space exists in each database
(priv and pub). You'll never get a perfect match between that and what
shows in ESM, because the mailbox size information in ESM is not
perfectly accurate. There are other considerations as well, such as
items in Deleted Item Retention.

What shrinks the databases is an offline defrag. I don't recommend that
except in the very rare instance where you've permanently reduced the
size of your mailbox store, and really need to recover that space.
Personally, I would never do it in the absence of a really good reason -
there's always at least some risk involved, and in most cases little or
no benefit. The databases are designed to operate this way, and in most
cases they do so without resorting to offline defrags or other manual
intervention.


"Roger Cook" <roger-nospam-or-junk-at-redpuma.co.uk> wrote in message
news:OJAZ%23Uw9HHA.1188@xxxxxxxxxxxxxxxxxxxxxxx
I am looking at a v lightly-used SBS 2003 server which has just
experienced a massive jump in the number of Exchange transaction log
files being created. I also note a huge disparity between the size of
"priv1.edb" at 1.8GB and the displayed sizes of the constituent
mailboxes visible in Exchange System Manager - total of all mailboxes
shown under the mailbox store is less than 180MB !

What could account for this tenfold difference ?

Also is there any way to see inside the Exchange transaction logs to
examine the headers of the component messages ?

Finally I understand the desirability of disabling circular logging on
larger systems but what is the advantage on SBS systems where the log
files and Exchange databases often reside to the same partition ? - if
the hard drive crashes it will take both logs and database with it
anyway unlike a larger system where the logs are on a separate drive.











.

Relevant Pages

  • Re: Exchange - Huge (x10) mismatch between size of priv1.edb and actual size of mailboxes in mai
    ... stopped - no new logs for the last 5 hours. ... Are you saying that your Exchange is adding 20 logs ... I think client actions that read from the database ... mailboxes and the system is not that old. ...
    (microsoft.public.windows.server.sbs)
  • Re: Dynamic Firewall/IDS System
    ... some thoughts about event handling software. ... > is almost impossible to handle manually just reading logs. ... > This is how we fill our database. ... this is logging, way like acid does with snort logs. ...
    (FreeBSD-Security)
  • Re: Exchange - Huge (x10) mismatch between size of priv1.edb and actual size of mailboxes in mai
    ... about 40 transaction logs. ... I think client actions that read from the database are ... mailboxes and the system is not that old. ...
    (microsoft.public.windows.server.sbs)
  • Re: Error in Exchange
    ... Will you provide me some linkes to get more info about the role these logs ... play in .edb file or with database and how information is saved into .edb ... > backup on Sept 8. ... > transaction logs are saved in that backup. ...
    (microsoft.public.exchange.admin)
  • Re: Database locking during kprops, MIT 1.8
    ... It checks the log timestamps and when it notices a difference between two sysatme it propagates only differences in the logs rather than the whole database. ... You could probably mitigate 1 and 2 by a full propagation independently at a quiet time once a night, ... Our setup is such that we have a once every five minute kdb5_util dump ...
    (comp.protocols.kerberos)