1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Exchange 2003 logs growing fast

Discussion in 'Servers and Enterprise Solutions' started by iMacMart, Mar 13, 2014.

  1. iMacMart

    Capodecina

    Joined: Jun 8, 2006

    Posts: 10,883

    Location: Hertfordshire

    Hi Guys

    Got an issue at work where an exchange mailstore log drive has run out of space, its growing an a phenomenal rate maybe a 1gb every 30 mins!

    After some investigation it appear to be logs created via IIS and the mobile devices we have connecting to exchange like iPhones, Android, iPads etc

    If I turn IIS off the growth stops, what I need to do is search the logs thats filling the drive and see which users device is doing this but I can't work out the best way to open/search them..

    Any exchange geeks able to help?

    Many thanks Mart
     
  2. #Chri5#

    Soldato

    Joined: Feb 27, 2003

    Posts: 6,857

    Location: Shropshire

    Notepad++ isn't bad for bigger files (compared to Notepad) but that can choke on silly files. You could try this.

    Alternatively, change the log schedule to hourly (if not already) so you can get some smaller log files to look at.
     
  3. iMacMart

    Capodecina

    Joined: Jun 8, 2006

    Posts: 10,883

    Location: Hertfordshire

    They are 5mb in size so thats a good call, the backup cleared the logs last night so I have some breathing space this morning

    Thanks
     
  4. #Chri5#

    Soldato

    Joined: Feb 27, 2003

    Posts: 6,857

    Location: Shropshire

    5MB? They sound more like Exchange EDB log files than IIS log files - are the file names like E0009549.log? That would be consistent with a backup job flushing the EBD log files.
     
  5. iMacMart

    Capodecina

    Joined: Jun 8, 2006

    Posts: 10,883

    Location: Hertfordshire

    Sorry yes they are Exchange logs but being created by large amounts of traffic from IIS as if an activesync process is stuck or in a loop, appears to have stopped this morning, which I hate as I want to know what the issue was

    Will monitor it, thanks
     
  6. jake108

    Gangster

    Joined: Nov 10, 2010

    Posts: 464

    You using Exchange 2003 with optional add-ins per chance tied to IIS (Trend Micro AV, NOS etc)?

    Been a while since I've worked with Server 2003 + Exchange + IIS + Trend but I remember if Exchange / IIS encountered issues with individual components with these add-ins enabled it would automatically start logging the errors in verbose mode from the failed component. From memory there was a Microsoft hotfix or in one of the SPs that fixed it.

    Usually with Trend sometimes it would unsync itself with the exchange mailstore if exchange was also doing something with the mailstore (think moving or repairing / undelete / archive was the main culprits) at the same time resulting in errors of that description if a user was using ActiveSync on the same mailstore.

    Hope it helps
     
    Last edited: Mar 16, 2014
  7. smargh

    Associate

    Joined: Dec 29, 2010

    Posts: 74

    Google for the iOS exchange calendar item bug & the method(s) of blocking that particular iOS version.

    Of course it might not be that, but it's my first thought.
     
  8. traveyb

    Wise Guy

    Joined: Jul 25, 2012

    Posts: 1,264

    How often are you performing a full backup? As a temp solution you can turn on circular logging (google this before hand to understand what it is).
    I think it's iOS 6 that has a calendar bug where it bombards to CAS with requsts. We now have a policy where we block anyone not running the latest iOS version to stop this