How Much Database Storage Does Mailbox Audit Logging Consume?

Mailbox audit logging is a useful feature but some administrators become concerned when they learn that the audit logs are stored in the mailbox itself.

Does add a significant amount of data to the mailbox?

It really depends a lot on which audit options you’ve turned on, and how many mailbox in your organization are shared mailbox or have a lot of delegates performing actions on them.

What I can say is that my experience has been that mailbox audit logging, using the default 90 days retention and other audit settings, adds about 1-2% to the size of the mailbox. Of course, you should not take that as definitive and should perform some testing and analysis yourself, but I hope that my experience at least helps remove some of the uncertainty when it comes to storage impact of mailbox audit logging.

If you have turned on mailbox audit logging for a mailbox, and you know that actions are being logged already, you can check the size of the audits folder to see what kind of impact it is having.

[PS] C:\>get-mailbox Alan.Reid | Get-MailboxFolderStatistics -FolderScope RecoverableItems | fl name,foldersize

Name       : Recoverable Items
FolderSize : 5.804 MB (6,085,852 bytes)

Name       : Audits
FolderSize : 71.67 KB (73,394 bytes)

Name       : Deletions
FolderSize : 429.2 KB (439,483 bytes)

Name       : Purges
FolderSize : 0 B (0 bytes)

Name       : Versions
FolderSize : 0 B (0 bytes)

In the example above the Audits folder is just 71KB in size, for a mailbox of about 1Gb in total size. This mailbox has just a small amount of delegate activity though. Other mailboxes in the same organization have upwards of 2-3MB of audit data, which is still not very much compared to total mailbox sizes of several gigabytes.

If mailbox audit logging has been widely deployed you can also use a simple script to collect these stats from all mailbox. This example will list all mailboxes with their mailbox size and audit log size, and then export the stats for all of them to a CSV file at the end.

$report = @()

$mailboxes = @(Get-Mailbox -Resultsize Unlimited)

foreach ($mailbox in $mailboxes)
{
    $name = $mailbox.Name

    $auditsfolder = "$($mailbox.Identity)\Audits"

    $foldersize = ($mailbox | Get-MailboxFolderStatistics -FolderScope RecoverableItems | Where {$_.Name -eq "Audits"}).FolderSize
    if ($foldersize)
    {
        $foldersize = "{0:N2}" -f $foldersize.ToMB()
    }
    else
    {
        $foldersize = 0
    }

    $mailboxsize = (Get-MailboxStatistics $mailbox).TotalItemSize.Value.ToMB()

    $reportObj = New-Object PSObject
	$reportObj | Add-Member NoteProperty -Name "Name" -Value $name
    $reportObj | Add-Member NoteProperty -Name "Mailbox Size (MB)" -Value $mailboxsize
    $reportObj | Add-Member NoteProperty -Name "Audits Size (MB)" -Value $foldersize

    $report += $reportObj

    Write-Host "$name, $mailboxsize, $foldersize"
}

$report | Export-CSV AuditLogOverhead.csv -NoTypeInformation

You could easily customize that for your own environment if you have the need.

About Paul Cunningham

Paul is a Microsoft Exchange Server MVP and publisher of Exchange Server Pro. He also holds several Microsoft certifications including for Exchange Server 2007, 2010 and 2013. Find Paul on Twitter, LinkedIn or Google+, or get in touch for consulting/support engagements.

Leave a Comment

*

We are an Authorized DigiCert™ SSL Partner.