Hello,

Using Exchange 2010, in last few days started getting SCOM alerts stating that the Data Copy (log) drives on our Exchange DAG servers are running low on space.  Free space has been rapidly dropping since that first alert.

Have checked Event Viewer on Exchange servers, can't see anything obviously wrong. 

Is there any way (using PowerShell for instance) that I can interrogate a particular mail database to see where most its load is being created?  I.e. Maybe checking which individual mailbox could be hammering the DB?

Here is the go to blog for dealing with large log growth:

http://blogs.technet.com/b/exchange/archive/2013/04/18/troubleshooting-rapid-growth-in-databases-and-transaction-log-files-in-exchange-server-2007-and-2010.aspx

The article DJ mentions is a good one and

1. Another one is the log parser 2.2 https://www.microsoft.com/en-us/download/details.aspx?id=24659  It comes with quite a few "canned" routine queries in which one of them is for Active sync. You can edit the AS query to show top 500 users or whatever number you want. You then point it to IIS log file folder (W3SVC) and select the amount of files you want to check. You will get a report and you are looking for a user or group of users that have a large number of sync/hits. Typically, users should be 1K and under but I have seen users in the 10K-50K range causing excessive log files. Once you identify them, you can take action. Excessive AS traffic can be caused by a user with old IOS, an email stuck in their outbox on their device or in some cases I have seen a user with a corrupt calendar event causing issue as well. .

2. A quick method to see the issue is coming from ActiveSync clients because of old iOS on iPhones etc , is to just shut down active sync and see if the issue stops, however the fallout is that all ActiveSync clients will lose connectivity  If it stops then next thing to do would be to get all iPhone users to update their IOS, then bounce teh phones and Active-sync again and see if it persist

More detailed sleuthing


There was also a problem with the MS CRM client awhile back so if you are using that check out this link. http://social.microsoft.com/Forums/en/crm/thread/6fba6c7f-c514-4e4e-8a2d-7e754b647014

You can also use these additional  tracking methods to see if you can hone in on the culprits, i.e. If you want to see if the problem is coming from an internal Device/Machine you can use one of the following, however the log parsing is best IMHO

MS USER MONITOR: http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en and here is a link on how to use it http://www.msexchange.org/tutorials/Microsoft-Exchange-Server-User-Monitor.html


You could also check out ExMon since you can use it to confirm which mailbox is unusually active , and then take the appropriate action.
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en

Hi,

As Troy mentioned, it may be caused by ActiveSync. Heres an script about Exchange ActiveSync to monitor and analyze IIS log:
http://blogs.technet.com/b/exchange/archive/2012/01/31/a-script-to-troubleshoot-issues-with-exchange-activesync.aspx

Besides, please refer to below link which has similar issue about Exchange 2010 database log files growing rapidly yet the database isnt:
https://social.technet.microsoft.com/Forums/office/en-US/5592ccdc-63f5-47d9-b363-2d2e69840723/exchange-2010-database-log-files-growing-rapidly-yet-the-database-isnt?forum=exchange2010

Thanks

Hi ,

Please use the below mentioned command to find out which mailbox is accumulating large no of logs in your environment.

Get-MailboxDatabase | Get-StoreUsageStatistics | Sort-Object LogRecordBytes,sampetime  -desc | select-object -first 6 | ft displayname, DigestCategory, logrecordcount, LogRecordBytes, *time* -auto