Exchange 2003 MDBDATA folder, STF files filling the drive, not being removed

How many are you seeing and what is the time that these files span? These are temporary files used by exchange for content conversion and should clear on their own. If you restart the information store, these should also clear. How long has this been happening? I suggest you restart the IS service and see if you experience the same problem with them not deleting themselves.Tim Harrington | MVP: Exchange | MCITP: EMA 2007/2010, MCITP: Server 2008, MCTS: OCS | Blog: http://HowDoUC.blogspot.com | Twitter: @twharrington

The physical server was restarted this morning 7:30am Eastern. Zero STF files at that time. Currently 2:50 pm Eastern and the server had 269 STF files when I started typing, 276 now. All STF files have timestamps of today with update times within the last hour. We have been having problems of this nature since 2/16/11, the machine was running fine with no recent changes prior to that.

This has been resolved

On Fri, 9 Mar 2012 11:52:19 +0000, TSAM wrote: > > >Hello, > >I have Exchange 2003 with Windows 2003 running in a cluster. Transaction logs and MDBdata volumes are on a SAN. For past two weeks we are seeing considerable performance degradation with .STF files filling the local drive where Exchange server binaries are located. {for example: c:\Program Files\ Exchsrvr\}. One thing I noticed this .STF files will fill in the local drive at location C:\Program Files\Exchsrvr\MDBDATA\ within minutes and could fill up the entire local drive. I tried moving the cluster to a second node and the same thing happened. There is no files in MDBDATA other than .STF files for that day. Is there a way to dictate .STF file location to a SAN? What is the reason for the .STF file to accumualte on local drive? Anti Virus on this server is completely disabled from the registry. > >I will appreciate any insights to this. What those STF files are: http://support.microsoft.com/kb/258542 Have you excluded the directory from any AV scanning? Those temporary files should disappear once they're closed. If AV has them locked that won't happen. The location of the INBOUND working directory can be found (and changed) here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem Value name: Working Directory Value type: REG_SZ Value data: C:\Program Files\Exchsrvr\MDBDATA <== CHANGE THIS The directory you substitute in the "Value data" must already exist. After you change the value you must restart the Information Store service. To change the location of the working directory for OUTBOUND mail conversion you change the system's TEMP environment variable to the desired directory. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

On Sat, 10 Mar 2012 17:30:14 +0000, TSAM wrote: >AV is completed stopped from services and at the registry thus I could hash AV causing this pileup. The service being stopped doesn't disable the file sytem drivers. Remove/uninstall the AV. >My MDBData folder and edb files are on a SAN. Default MDBData folder has only .STF of today and it gets eventually deleted, not sure what is causing the pileup. I opened a case with MS and MS couldn't even pin the cause. At what time do they disappear? Is there some event that happens on the server (a service stopping, for example)? You can use Process Explorer to find out if there's an open file handle for any of those files: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Use the "Find" menu and put the fullpath of one of thos STF files in there. If it's not an open file you should be able to delete it -- which probably means that the AV had the file when the Information Store closed it. >Will changing inbound or outbound working directory to a SAN volume cause any sort of issues? Not that I'm aware of. They're just another directory. >I am not worried about IOPS as my array is a FC SAN with 8GB throughput. Also, can I change the inbound and outbound working directory to the same SAN volume where priv and pub edb are located? Sure. They're both on the local C: drive right now! --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks Rich. AV is completed stopped from services and at the registry thus I could hash AV causing this pileup. My MDBData folder and edb files are on a SAN. Default MDBData folder has only .STF of today and it gets eventually deleted, not sure what is causing the pileup. I opened a case with MS and MS couldn't even pin the cause. Will changing inbound or outbound working directory to a SAN volume cause any sort of issues? I am not worried about IOPS as my array is a FC SAN with 8GB throughput. Also, can I change the inbound and outbound working directory to the same SAN volume where priv and pub edb are located? TIATom

On Sat, 10 Mar 2012 17:30:14 +0000, TSAM wrote: >AV is completed stopped from services and at the registry thus I could hash AV causing this pileup. The service being stopped doesn't disable the file sytem drivers. Remove/uninstall the AV. >My MDBData folder and edb files are on a SAN. Default MDBData folder has only .STF of today and it gets eventually deleted, not sure what is causing the pileup. I opened a case with MS and MS couldn't even pin the cause. At what time do they disappear? Is there some event that happens on the server (a service stopping, for example)? You can use Process Explorer to find out if there's an open file handle for any of those files: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Use the "Find" menu and put the fullpath of one of thos STF files in there. If it's not an open file you should be able to delete it -- which probably means that the AV had the file when the Information Store closed it. >Will changing inbound or outbound working directory to a SAN volume cause any sort of issues? Not that I'm aware of. They're just another directory. >I am not worried about IOPS as my array is a FC SAN with 8GB throughput. Also, can I change the inbound and outbound working directory to the same SAN volume where priv and pub edb are located? Sure. They're both on the local C: drive right now! --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks again Rich, I will try out your suggestions and reply back. Tom

On Fri, 9 Mar 2012 11:52:19 +0000, TSAM wrote: > > >Hello, > >I have Exchange 2003 with Windows 2003 running in a cluster. Transaction logs and MDBdata volumes are on a SAN. For past two weeks we are seeing considerable performance degradation with .STF files filling the local drive where Exchange server binaries are located. {for example: c:\Program Files\ Exchsrvr\}. One thing I noticed this .STF files will fill in the local drive at location C:\Program Files\Exchsrvr\MDBDATA\ within minutes and could fill up the entire local drive. I tried moving the cluster to a second node and the same thing happened. There is no files in MDBDATA other than .STF files for that day. Is there a way to dictate .STF file location to a SAN? What is the reason for the .STF file to accumualte on local drive? Anti Virus on this server is completely disabled from the registry. > >I will appreciate any insights to this. What those STF files are: http://support.microsoft.com/kb/258542 Have you excluded the directory from any AV scanning? Those temporary files should disappear once they're closed. If AV has them locked that won't happen. The location of the INBOUND working directory can be found (and changed) here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem Value name: Working Directory Value type: REG_SZ Value data: C:\Program Files\Exchsrvr\MDBDATA <== CHANGE THIS The directory you substitute in the "Value data" must already exist. After you change the value you must restart the Information Store service. To change the location of the working directory for OUTBOUND mail conversion you change the system's TEMP environment variable to the desired directory. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Hello, I have Exchange 2003 with Windows 2003 running in a cluster. Transaction logs and MDBdata volumes are on a SAN. For past two weeks we are seeing considerable performance degradation with .STF files filling the local drive where Exchange server binaries are located. {for example: c:\Program Files\ Exchsrvr\}. One thing I noticed this .STF files will fill in the local drive at location C:\Program Files\Exchsrvr\MDBDATA\ within minutes and could fill up the entire local drive. I tried moving the cluster to a second node and the same thing happened. There is no files in MDBDATA other than .STF files for that day. Is there a way to dictate .STF file location to a SAN? What is the reason for the .STF file to accumualte on local drive? Anti Virus on this server is completely disabled from the registry. I will appreciate any insights to this. TIATom