Exchange 2010 FAQ: Why is My Disk Filling Up with Log Files?

Exchange Server 2010 customers sometimes ask why their server disk drive is filling up with log files. Usually they are referring to the transaction log files created by the mailbox databases.

Update February 2013 – there is a specific issue with iOS 6.1 that causes excessive log generation on Exchange servers. Click here for more details.

Each Exchange 2010 mailbox database comprises two main parts:

  • the transaction log files
  • the database file itself

The folder containing the log files will look something like this.

A best practice for Exchange 2010 mailbox servers is to store the database and transaction log files on completely separate disks. This is to protect the server from data loss if one disk or the other has a failure.

The way this works is that each database change is written to a memory buffer and also recorded in a transaction log file. Periodically the memory buffer information is also written to the database file. When this occurs a checkpoint is updated that tells the server which transaction log entries have and have not been written to the database yet.

If the server was to unexpectedly restart, the database comes online in a “dirty shutdown” state and the checkpoint is used to tell the server which transaction log entries need to be replayed into the database to recover the information that was lost in the memory buffer when the server failed.

Over time these transaction logs will grow, because of course the mailbox database is continually changing as new mail arrives in mailboxes (as just one example). Eventually the log files will fill up the disk if they are not removed.

To remove the transaction log files the database needs to be backed up. When an Exchange Server database is backed up by a proper application-aware backup product, after the backup is finished the backup program will issue a command to VSS (Volume Shadow-copy Service) on the server that the backup was successful and to go ahead and truncate the transaction logs.

The server then proceeds to remove the transaction log files up to the nearest checkpoint prior to the backup commencing. Because the database can continue to change and write new transaction log files while a backup is in progress it is not unusual for multiple transaction log files to still be present after a backup has completed. However most of them will be removed, and regular backups are the method by which transaction logs can be kept from consuming all free disk space on the server (as well as the obvious benefit of having your Exchange databases safely backed up).

So if your Exchange Server disk is being filled up by transaction log files, the issue is likely to be one of the following:

Cause: You aren’t backing up the mailbox server

Solution: Back up the mailbox server with a proper Exchange Server application-aware backup product. There are commercial products available for this such as Symantec Backup Exec or you can use the built-in Windows Server Backup for the task.

Cause: You’re using the wrong type of backup

Solution: Make sure you’re running a backup job type that will truncate the logs. Full and Incremental backups will truncate the transaction log files, whereas Differential and Copy will not.

Cause: The backup is not completing successfully

Solution: Check your backup product for log file entries that indicate what the issue is.

Cause: The backup is completing successfully but transaction logs are not truncating

Solution: Check the Application Event Log on the mailbox server for errors with the log truncation process.

 

About Paul Cunningham

Paul is a Microsoft Exchange Server MVP and publisher of Exchange Server Pro. He also holds several Microsoft certifications including for Exchange Server 2007, 2010 and 2013. Find Paul on Twitter, LinkedIn or Google+, or get in touch for consulting/support engagements.

Comments

  1. In my case I was having problems backing up the server due to a very high amount of log files having been made before I had opportunity to implement backup (65,000) I was down to 3 GB of disk space and this was impacting delivery of mail. In my scenario we have Mailstore Server archiving all incoming and outgoing email on a hourly basis from an Exchange Journal Mailbox.

    To remove the transactional files and commit them to the database freeing up disk space I Enabled Circular Logging, this very quickly commits those logs and free’s up your disk space. I would only advise doing this though if you have another way of backing up or archiving your email.

    • Hi Sean, I’ve had to use that method myself to save the day a few times in the past. Definitely has its risks and I agree that a good backup as soon after is highly recommended.

  2. Hi Paul,

    We had the issue described above on Friday of last week where by the Ex2010 log files filled our entire log file volume. We are not using an application in the application layer to backup Exchange but instead are using backup direct from storage layer level snapshots, so our VMware infrastructure that Exchange sits on is completely unaware of the backup process. In this kind of environment is there anyway to signal to Exchange that our storage level backup has completed?

    Daniel

    • Some storage-level backup products are still VSS-aware and will work. Check your documentation to see if there is an option that is not set correctly.

      Otherwise, if you find that your backup product is not compatible, either switch to one that is or turn on circular logging and live with the risks.

  3. Hi Please can you help me? I have an Exchange 2010 sp1 server on Windows Server r2. The backs up are configured correctly but the Transactiion log just wont clear. the logs are now at 125 and 175 on two mailstores.

    Please help

  4. Hello,

    If any one can answer my query…

    My case scenario- 2 DAG Members, 2 HUB/CAS NLB. 5 DB’s in total, out of 5 databases, only 1 of the database on one of the passive node where the database is not mounted log file drive show more utilized space.

    If I see the T logs size inside the drive the folder size is only 300+ mb but if I right click to the drive to check the drive size it shows utilized space 45 GB !!!

    Where as on the active node where this DB is mounted, the log file drive shows the actual utilized space (300 mb+)

    • Something else must be consuming that space, perhaps a system or hidden folder? Is the drive dedicated to the transaction logs only, or does it also have the database and content index files on it?

      Also check that the disk has not been configured as a shadow copy destination for other drives on the server.

      • Hello Paul,

        I figured out the system volume information is the culprit, this is consuming most of the disk space, could you please tell me the way to eradicate this?.

        Thank you

        • Did you already check for shadow copies?

        • I have the same issue with the System Volume Information file using 50 some GB of space. I do not have Shadow Copies enabled, though when I view this I see: F:\ (Our EDB Drive) Disabled 0 39673 MB on F:\

          Is there a way to clear this up, and is there a way to free up the space that the System Volume Information folder is consuming?

          Thanks,
          Robert

        • I found this to clear up the Shadow Copies\

          Run command prompt/Admin

          diskshadow

          list shadows all

          delete shadows all

          Took care of my System Volume Information issue.

  5. Hi,
    What is the mechanism of choosing hard disk space for Exchange 2010 log files? Any percentage against Mailbox size? (Eg. 1% from DB size or..)

    • It depends on the rate of change within each database. More changes mean more logging. It also depends on frequency of backups.

      I tend to go for log volume size of no less than 30% the size of the database volume. Sometimes more if its a high email traffic environment.

      More is better than not enough.

  6. David Fletcher says:

    I am backing up a exchange 2010 with DPM 2012. How long after a back up does the truncation take place?

    • vartaxe says:

      was wondering the same… any idea? how long after backup will exchange need to delete those logs?

  7. Nino Iaccarino says:

    I have a question related to my drive filling up, in which I am trying to determine the cause.

    Firstly, my backup of the 2010 Exchange Server was completing successfully, but the logs were not being truncated (which is fine as I am ware of this now)

    Secondly, my new Exchange 2010 DB Transaction Logs have started to go berserk ! Logs are being created at a rate of about 5 every minute at 1Mb in size each.

    I have done alot of searching this morning since I noticed the drive filling up and have tried a few troubleshooting methods. I have run ExMon to try and determine if there is a specific user causing the problem, but at the moment I am stumped.

    I have also stopped the ActiveSync app pool just incase it was our iPhones causing a problem, but the logs continued to be created as this very rapid rate.

    I was wondering if anyone has come across this before, or can point me in the right direction. Most of the articles I have read, people have used ExMon to identify troublesome users or mailboxes which stand out, but I cannot see anything out of the ordinary using this tool.

    Any help would be much appreciated !

  8. My log files aren’t clearing and the Backpressure has, from time to time, stopped incoming mail flow. I have changed the setting in the .config file to continue receiving email.

    I have the maildstore on a 150 Gig drive. I am using about 29 Gig for the database and log files. Why would this be happening with so much space available.

    Thanks for your assistance.

    Sam

    • Nino Iaccarino says:

      Silly question, but are you backing up your Exchange? I had a simliar problem above. I was backing up my Exchange VM with Veeam, but I failed to set the job to Prune the Transaction Logs therefore my logs continued to grow very rapidly. As soon as I reconfigured my backups properly, the next back it successfully truncated my log and cleared a few hundred gigs of space. Has been happy ever since…

    • Hi Sam, back pressure may indicate some other issue, as it is not always caused by lack of disk space.

      You’ve said your database and logs only use 29Gb together? But how much actual free space is on the disk? Are there other things also using up space?

      If it is indeed back pressure you’re seeing, you should look into those event log entries to determine the actual cause of it. Here’s some reading if you need some info to get started:

      http://exchangeserverpro.com/exchange-transport-server-back-pressure

  9. Yes. I am backing up the Exchange 2010 server with the WSB on Server 2008 R2

    Event 2006 Cat ShadowCopy
    Information Store (6620) Shadow copy instance 7 completed successfully.

    For more information, click http://www.microsoft.com/contentredirect.asp.

    Event 9780 Event Exchange VSS Writer
    Exchange VSS Writer (instance 715f979e-b037-4ecf-a78c-edae2f7f0206:7) has successfully completed the full or incremental backup of database ‘Mailbox Database XXXXX1290′.

    The database engine has also successfully executed log file truncation procedures for this database. (Note that this may or may not have resulted in the actual truncation of log files, depending on whether any log files existed that were candidates for truncation.)

    Event 225 Task Cat ShadowCopy
    Information Store (6620) Mailbox Database XXXXXX1290: No log files can be truncated.

    For more information, click http://www.microsoft.com/contentredirect.asp.

    Event 11000 Task Cat (11)
    Microsoft Forefront Protection VSS Writer has successfully collected the metadata document in preparation for backup or restore.

  10. Hello Paul, i would like to first thank for your website.

    I have a doub that i’ve been discussing with a coworker here.
    After a full backup was finished (we use TSM), how Exchange knows that is able to start with log truncation? I mean, where he retrieves the information that the backup was made?

    thanks!

    Guido.

  11. Hi Paul,

    I’m running Exchange 2013 and I only have a few users on that server. So currently I don’t have any backup agent installed… Symantec recently just came out with an agent that I plan on installing this weekend. My drive is almost full. What do you think I should do in order to free some space until I can install the Symantec Agent. How should I delete the logs manually to free up some space?

    Joey

  12. Thanks! That’s what I exactly did.

  13. Hello Paul, Love the site.

    We have a 4 node dag across 2 sites. I have 28 databases and backup works normally most time. (Symantec BE from Active Server only). Sometimes, however, the log files are not truncated. It took a couple of scary log build ups but we made the connection. Log Truncation Issues = Check all DAG Replication!

    We’ve experienced the issue of log files building up even with successful backups. This was due to DAG replication issues (occasionally that happens). If ALL the passive database copy have not yet been fully replicated to all dag members, the logs on the Active server are not truncated. Once replication is repaired and Copy queue length returns to 0, log truncation should occur.

    This makes sense if you think about it…

    Marcina

  14. Exactly what I needed. Thanks a lot !!

Leave a Comment

*

We are an Authorized DigiCert™ SSL Partner.