Exchange 2003 logs growing fast

[iMacMart]

Hi Guys

Got an issue at work where an exchange mailstore log drive has run out of space, its growing an a phenomenal rate maybe a 1gb every 30 mins!

After some investigation it appear to be logs created via IIS and the mobile devices we have connecting to exchange like iPhones, Android, iPads etc

If I turn IIS off the growth stops, what I need to do is search the logs thats filling the drive and see which users device is doing this but I can't work out the best way to open/search them..

Any exchange geeks able to help?

Many thanks Mart

 

[#Chri5#]

Notepad++ isn't bad for bigger files (compared to Notepad) but that can choke on silly files. You could try this.

Alternatively, change the log schedule to hourly (if not already) so you can get some smaller log files to look at.

 

[iMacMart]

They are 5mb in size so thats a good call, the backup cleared the logs last night so I have some breathing space this morning

Thanks

 

[#Chri5#]

5MB? They sound more like Exchange EDB log files than IIS log files - are the file names like E0009549.log? That would be consistent with a backup job flushing the EBD log files.

 

[iMacMart]

Sorry yes they are Exchange logs but being created by large amounts of traffic from IIS as if an activesync process is stuck or in a loop, appears to have stopped this morning, which I hate as I want to know what the issue was

Will monitor it, thanks

 

[jake108]

You using Exchange 2003 with optional add-ins per chance tied to IIS (Trend Micro AV, NOS etc)?

Been a while since I've worked with Server 2003 + Exchange + IIS + Trend but I remember if Exchange / IIS encountered issues with individual components with these add-ins enabled it would automatically start logging the errors in verbose mode from the failed component. From memory there was a Microsoft hotfix or in one of the SPs that fixed it.

Usually with Trend sometimes it would unsync itself with the exchange mailstore if exchange was also doing something with the mailstore (think moving or repairing / undelete / archive was the main culprits) at the same time resulting in errors of that description if a user was using ActiveSync on the same mailstore.

Hope it helps

 

[smargh]

Google for the iOS exchange calendar item bug & the method(s) of blocking that particular iOS version.

Of course it might not be that, but it's my first thought.

 

[traveyb]

How often are you performing a full backup? As a temp solution you can turn on circular logging (google this before hand to understand what it is).
I think it's iOS 6 that has a calendar bug where it bombards to CAS with requsts. We now have a policy where we block anyone not running the latest iOS version to stop this