Hi I will explain my exchange server setup. It is Exchange Server 2007 withh CCR setup. One hub and cas server, 2 mailbox servers. My problem is the echange databse server file is growing too fast. It was 246 GB and now it reaches 271 GB with in a span of 5 days. it was stable with 246 GB for along period. User's are not archiving their mailboxes as it is done by Syamntec Enterprise Vault. I check the EV server everythign is working fine. But why this exchange database growing such a fast pace is really a problem for me. Is there any way to find what problem or which user creating the problem. How I can know the see the usage of different users on exchange for a given moment of time. Expecting a early reply from you ..

Russ Where I need to apply Exmon. Is it on Hub/cas or Mailbox servers. My Exchange is 2007 with version 8.1 .

You actually install it on mailbox server you wish to monitor.

I installed ExMOn on mailbox server. NOw I put a time interval of 20 minutes . let me see the result after 20 min. There is a strange thing that one username is not there.. just a ' ? ' in username column. It has comsumed around 24% of CPU and bytes In/Out is also high. How can I find those user. Also if it is Dynamics CRM .. how we can resolve it. As we had CRM 4.0 installed and most of the users had it configured thru outlook . Also thru CRM only our mail shots are sending out.

I believe the online defragmnentation is not happening for 20-23 days. We had small problem with the backup earlier and when we resolved it backup is doing fine but its taking too much time. May be the online maintenance time is pverlapped by backup job of exchange all these days. So today let me see to hold the backup to let the Exchange to do the onlone defragmentation. Now the size of exchange is 283 gb. Whether the time 1AM to 6 AM is enough to complete the online defrag of these big database?

You would want to look for Event 703 in your event log to determine when the last online defragmentation too place http://technet.microsoft.com/en-us/library/bb691410%28v=exchg.80%29.aspxHere is another useful article for you as well http://technet.microsoft.com/en-us/library/bb123760.aspxIf your database backup overlaps the nightly online maintenance schedule it will stop the online maintenance process. So it could very well be that its never being allowed to finish the defrag process. SO I would recommend two things. A: to force the maintenance process you can TEMPORARILY set the maintenance to run at all times http://technet.microsoft.com/en-us/library/bb629590%28v=exchg.80%29.aspx This will impact the box performance for until its done but as long as you set it back to a reasonable schedule it will be short lived. B: then examine your backup schedule times and then det your online maintenance to run outside the backup timesTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

You would want to look for Event 703 in your event log to determine when the last online defragmentation too place http://technet.microsoft.com/en-us/library/bb691410%28v=exchg.80%29.aspxHere is another useful article for you as well http://technet.microsoft.com/en-us/library/bb123760.aspxIf your database backup overlaps the nightly online maintenance schedule it will stop the online maintenance process. So it could very well be that its never being allowed to finish the defrag process. SO I would recommend two things. A: to force the maintenance process you can TEMPORARILY set the maintenance to run at all times http://technet.microsoft.com/en-us/library/bb629590%28v=exchg.80%29.aspx This will impact the box performance for until its done but as long as you set it back to a reasonable schedule it will be short lived. B: then examine your backup schedule times and then det your online maintenance to run outside the backup timesTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

It seems my database is not performing a full pass of online defarg with in 4 hrs (1AM to 5AM). I can see the event log as follows:- MSExchangeIS (4320) First Storage Group: Online defragmentation of database 'D:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group\Mailbox Database.edb' was interrupted and terminated. The next time online defragmentation is started on this database, it will resume from the point of interruption. Also there was another event when onlionedefrag starts yesterday showing the full pass didnt complete for the past 27 days. MSExchangeIS (4320) First Storage Group: Online defragmentation is resuming its pass on database 'D:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group\Mailbox Database.edb'. This pass started on 6/3/2012 and has been running for 27 days. I bileive it was my fault that both backup and online defarg overlap after few problme in the backupserver. Now it seems 4 hr is not enough to do a complete online defrag of my 283 GB database Whether there is any eay option to complete the online defrag within the stiulated time ? Is there any performance issue or other related issue of we run the online defarg during the office working hours? A quick reply from you people are highly appreciated

I would configure it to TEMPORARILY run at all times so that it can catch up. It will impact the performance of the server but it shouldn't be horrible. I would try it out and see what the impact is and if its too disruptive, i.e. you get many complaints you can turn it back to the default schedule or set it to run at all times on the weekend when you will have less users online. Once you get it to complete then you can go back to an adjusted schedule that does not overlap with backup actionsTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

On Sun, 1 Jul 2012 15:37:52 +0000, Troy Werelius wrote: >I would configure it to TEMPORARILY run at all times so that it can catch up. It will impact the performance of the server but it shouldn't be horrible. I would try it out and see what the impact is and if its too disruptive, i.e. you get many complaints you can turn it back to the default schedule or set it to run at all times on the weekend when you will have less users online. Once you get it to complete then you can go back to an adjusted schedule that does not overlap with backup actions I let the online defrg run for a lot more hours on Saturday and Sunday mornings. I usually get a complete pass on all databases at least once a week that way. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks for your replies. Last night also didnt complete the full pass. I put a time between 9PM and 6AM. That is around 9 hrs. Still it shows the event 704 saying online defrag interuppted and terminated at 6 AM. So it cannot able to complete the full pass. I believe this will be common if my onlione defrag was not running full pass for the past 28 days. Also even the database grows from 246 GB to 285 GB ; The 1221 event shows it freed only 97 MB with defrag between these 9 hrs. Do my exchange edb had any issue or its quite common. How can we know what the pecentage of defrag completed.

Well the big issue at the moment is that you have not been able to complete a full online maintenance process for some time, therefore the first time will take a much longer period of time, hence my suggestion of letting it run at all times over the weekend. That said your current extended time will allow it to incrementally get closer to completion since you have widened the maintenance period and if possible you may consider adjusting it to be even wider in order to supply the maximum amount of time for a maintenance window that will not impact users, i.e. if most people start arriving at 8AM then run it until 7:30 AM etc. Once the full online maintenance has completed subsequent passes will not take as long to complete so you can then tighten up the schedule again. NOTE: * Also remember that if a backup kicks off during the time the maintenance is running it will stop the maintenance process until the backup is completed * There is no way to tell the % of the online defrag that has completed you just need to get it to the point of completionTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

On Mon, 2 Jul 2012 05:26:08 +0000, Sabir_rm wrote: >Thanks for your replies. > >Last night also didnt complete the full pass. I put a time between 9PM and 6AM. That is around 9 hrs. Still it shows the event 704 saying online defrag interuppted and terminated at 6 AM. So it cannot able to complete the full pass. I believe this will be common if my onlione defrag was not running full pass for the past 28 days. > >Also even the database grows from 246 GB to 285 GB ; The 1221 event shows it freed only 97 MB with defrag between these 9 hrs. That's a pretty big jump in size for one day. If you have only 97MB free in the 250GB then your database will continue to grow, but not because the online defrag's taking too long! >Do my exchange edb had any issue or its quite common. How can we know what the pecentage of defrag completed. I don't think your problem is the online defrag. What's your default deleted item retention time? You may just be keeping to many items for recovery. What other stuff have you enabled (e.g. litigation hold, retention tags, etc.) that may be accumulating messages in the database that can't be removed? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

On Mon, 2 Jul 2012 05:26:08 +0000, Sabir_rm wrote: >Thanks for your replies. > >Last night also didnt complete the full pass. I put a time between 9PM and 6AM. That is around 9 hrs. Still it shows the event 704 saying online defrag interuppted and terminated at 6 AM. So it cannot able to complete the full pass. I believe this will be common if my onlione defrag was not running full pass for the past 28 days. > >Also even the database grows from 246 GB to 285 GB ; The 1221 event shows it freed only 97 MB with defrag between these 9 hrs. That's a pretty big jump in size for one day. If you have only 97MB free in the 250GB then your database will continue to grow, but not because the online defrag's taking too long! >Do my exchange edb had any issue or its quite common. How can we know what the pecentage of defrag completed. I don't think your problem is the online defrag. What's your default deleted item retention time? You may just be keeping to many items for recovery. What other stuff have you enabled (e.g. litigation hold, retention tags, etc.) that may be accumulating messages in the database that can't be removed? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

I think what Troy said was correct. Last night I started it from 6PM to today morning 9:00 AM . Eventhough it didnt complete the full pass, I can see the event log that around 17 GB has been got back after the online defrag. So today there wasnt any increase in my total edb size. So I bilieve 2 more days these schedule should work out. I will update the details.

Excellent to hear you are making progress and Rich made an excellent point as well that you may want to consider, i.e. evaluate your deleted item retention to ensure that it meets your business goals as well as ensuring that items are not kept too long. Thanks for the updateTroy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope

On Tue, 3 Jul 2012 14:02:48 +0000, Sabir_rm wrote: >I think what Troy said was correct. Last night I started it from 6PM to today morning 9:00 AM . Eventhough it didnt complete the full pass, I can see the event log that around 17 GB has been got back after the online defrag. So today there wasnt any increase in my total edb size. So I bilieve 2 more days these schedule should work out. I will update the details. Have a look at your Application log and find events 9535 (for deleted mailbox cleanup) and 1206 (for cleanup of expired messages). The defrag just consolidates free space in the database, but if expired items in the database have never been removed there's nothing the defrag can do. Your online maintenance (what you refer to as the online defrag) includes more work than just space consolidation. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks rich, Troy. it was sorted and one full pass completed last week. Now I believe its taking less time to complete the full pass and the EDB size is stable and around 28 GB free space can be visible from the event viewer. Also please let me know how much is default retention period as best practise

On Sun, 8 Jul 2012 12:25:57 +0000, Sabir_rm wrote: >Thanks rich, Troy. it was sorted and one full pass completed last week. Now I believe its taking less time to complete the full pass and the EDB size is stable and around 28 GB free space can be visible from the event viewer. Also please let me know how much is default retention period as best practise I don't think there's any "best practice" for retention times. The defaults are 14 days for deleted itmes and 30 days for deleted mailboxes. What you might want (or need) could be quite different. Shortening the deleted item retention, for example, may lead to more database restores to recover accidentally deleted messages. Increasing it leads to larger database sizes. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Agree with Rich in terms of a specific time frame for best practice, it all comes down to the needs of the organization in terms of how often people need item level recovery since vs db size, time to backup, retention of backups etc.Troy Werelius www.Lucid8.com Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline EDB's and Live Exchange Servers with Lucid8's DigiScope