Exchange 2010 Hard Drive Space Issues

[Mike Davis]

Once the Microsoft Exchange System Attendant service is stopped, you don't need to worry about the rest. If that service is not running you won't get stuck in a loop.

[wirestyle22]

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

[JaredBusch]

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

[wirestyle22]

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

[scottalanmiller]

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

[wirestyle22]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

The only exchange server I've personally managed was a standalone box in which the logs were stored locally, but this is an inherited server (all of them are). I question a lot of their logic honestly

[Dashrender]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

[wirestyle22]

I personally would've loved to make this a priority earlier before we were in this position but I wasn't here yet. Exchange is typically the most visible and universal server in my experience and as such I like to make it a higher priority, but not highest.

[scottalanmiller]

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

The only exchange server I've personally managed was a standalone box in which the logs were stored locally, but this is an inherited server (all of them are). I question a lot of their logic honestly

You can always start shipping logs "now". Just because it wasn't done in the past doesn't mean you can't do it in the future.

[scottalanmiller]

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/microsoft-infrastructure-monitoring/splunk-app-for-microsoft-exchange.html

[Dashrender]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

The only exchange server I've personally managed was a standalone box in which the logs were stored locally, but this is an inherited server (all of them are). I question a lot of their logic honestly

You can always start shipping logs "now". Just because it wasn't done in the past doesn't mean you can't do it in the future.

How does Log cleanup work in this situation with backups?
Heck, how do you replay those logs in a restore/repair situation?

[wirestyle22]

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

The only exchange server I've personally managed was a standalone box in which the logs were stored locally, but this is an inherited server (all of them are). I question a lot of their logic honestly

You can always start shipping logs "now". Just because it wasn't done in the past doesn't mean you can't do it in the future.

How does Log cleanup work in this situation with backups?

I'd imagine you just need to run a custom backup of the log locations on that specific server instead of exchange

[Dashrender]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/microsoft-infrastructure-monitoring/splunk-app-for-microsoft-exchange.html

OK makes sense for tracking, etc... but what about recovery?

[scottalanmiller]

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/microsoft-infrastructure-monitoring/splunk-app-for-microsoft-exchange.html

OK makes sense for tracking, etc... but what about recovery?

Recovery of the logs, or recovery of email?

[JaredBusch]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

The logs are going to the same box? Why not send logs to a central service?

WTF? This is not how Exchange is designed. These are DB rollback logs. Not usage logs. They do not get shipped out for monitoring.

[Dashrender]

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/microsoft-infrastructure-monitoring/splunk-app-for-microsoft-exchange.html

OK makes sense for tracking, etc... but what about recovery?

Recovery of the logs, or recovery of email?

recovery of email in case of a failure - it's my understanding that you restore you IS, then replay the logs to get the newer data back.

[scottalanmiller]

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

The logs are going to the same box? Why not send logs to a central service?

WTF? This is not how Exchange is designed. These are DB rollback logs. Not usage logs. They do not get shipped out for monitoring.

Oh, sorry, didn't realize what logs we were discussing.

[scottalanmiller]

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@Dashrender said in Exchange 2010 Hard Drive Space Issues:

@scottalanmiller said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

@JaredBusch said in Exchange 2010 Hard Drive Space Issues:

@wirestyle22 said in Exchange 2010 Hard Drive Space Issues:

My thought is I can dismount my datastore, change the name of the log folder from Mailbox - Domain to Mailbox - Domain.old and then create a new folder named Mailbox - Domain. If the logs populate correctly I should be able to delete the old logs and do a fast full backup with the logs truncating properly.

Note: I just did this and it seems to be generating logs properly.

This was horribly risky, but is something I have done before too. I would certainly have tried other means first, but you seem to have some really odd constraints.

I'm talking to Microsoft right now and they basically just told me I have two options in this situation, after reading my logs. 1. Turn on circular logging which will increase my CPU utilization significantly (this server sits at 70%+ utilization consistently) which would most likely seize it or do what I did. I considered each option and spoke to my boss. We are running out of space rapidly and he said at this point we unfortunately are going to have to take the risk. This realistically should have been fixed a year ago, but from what I understand they were running around putting out fires.

The logs are going to the same box? Why not send logs to a central service?

Does exchange logging work that way?

https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/microsoft-infrastructure-monitoring/splunk-app-for-microsoft-exchange.html

OK makes sense for tracking, etc... but what about recovery?

Recovery of the logs, or recovery of email?

recovery of email in case of a failure - it's my understanding that you restore you IS, then replay the logs to get the newer data back.

Right, now I see, these are the DB logs, not the application logs.

[wirestyle22]

@JaredBusch Can you explain some of the risks associated with what I did just for my own knowledge? I did verify clean shutdown in powershell.

[JaredBusch]

@wirestyle22 you could have potentially been unable to mount the database again.