Log files - 82GB 3

[WillShakespeare]

Guys,

In my MDBDATA folder I have log files of the following format:

E0024944.log

And each one is 5MB. I have over 17,000 of them, adding up to 82GB!!

Can I safely cut and paste them to an archive drive?

Will

 

[paulha]

You need to do an Exchange aware backup

Further reading :

http://www.tek-tips.com/viewthread.cfm?qid=1191812

 

[WillShakespeare]

Unfortunately, we already backup using NTBackup. We do a full backup every day, and I have verified the backup on occasion, and it works great.

Still have all these log files, tho...

Will

 

[WillShakespeare]

I have noticed, since the date of teh first one, a lot of 9548 ExchangeIS warnings, which before the first log were not so numerous. WOudl that have an effect?

Will

 

[smoss51]

Check this KB for a hotfix to the 9548 events:

<

http://support.microsoft.com/kb/555410/en-us>

What is the date/time stamp on the first log? Is it before or after your last backup?

 

[paulha]

I cant say I know the definitive answer to that one, but when I delete a user account and dont run the mailbox cleanup agent, my Veritas Backup reports the next morning that the backup was unsuccessful as it could not access the mailbox.

Hotfix available for 9548 :

http://support.microsoft.com/kb/903158/

Workaround :

http://www.amset.info/exchange/disabledaccount.asp

 

[WillShakespeare]

Well, I have managed to get rdi fo the disabled account (been meaning to do this for ages), but still no joy. I have confirmed that the backup runs successfully, apart from the occasional error: 8001 End Backup 'Warnings or Errors were encountered'. Consult the backup report for more details.

Anyone know where these reports are stored? There errors happened occasionally, but admittedly have increased in volume since the date of the start of these Logs. There may be a correlation.

I tried running eseutil, but it keeps coming up with an error: 1003 (JET_errInvalidParamter, Invalid API Parameter)

That may simply be because I am trying to use the default switch settings.

If anyone can shed any light, I'd appreciate it.

Will

 

[WillShakespeare]

Interestingly, it turns out I simply did not have my switches set up correctly. So I managed to start the eseutil recovery, but I get error -1032 Access is denied. Can I only run the eseutil on a dismounted mail store (database)?

If so, how long do you think it would take? I could take it down at lunch today. Or I may have to schedule it for tonight...

Will

 

[WillShakespeare]

Hmm... I just (luckily) found out that running Repair/Restore should only be a last resort... so I'm trying to do tha harmless /mh and /k switches... but the same error comes up, Access Denied, file is in use... 1032

Will

 

[Zelandakh]

Will - don't take the store down!!

Manually start ntbackup from Start, run. Use the backup wizard, tick the Information Store and run it. That should clear your log files for you.

Honestly, you don't need to use eseutil at all!!

 

[WillShakespeare]

I may not have been clear, but I have already done this!! We back it up with Exchange enabled NTBackup, and do a FULL backup every day. We have been doing this for over 18 months, and only in the last month has this problem arisen.

I ran the backup manually last night to attempt what you ahve suggested above, and it took 6 hours to run, and DID NOT clear the log files.

Hence why I am still posting. Using ESEUtil has been suggested by a few people and in other forum threads. Why not use it?

I mean, apart from the fact I need to dismount the store to do it... I can plan this without trouble.

Will

 

[Zelandakh]

Can you post the backup report?

 

[justanotherhack]

are all of the stores mounted? in order for the logs to be truncated all info stores must be mounted at the time of backup. - there should be an associated err in the app evt log that gives some details on why the truncation didn't happen....

 

[WillShakespeare]

Thanks all.

Essentially, my predecessor, who was sac... who left 3 months ago had some wild idea of setting up a new Information store for Archiving. After he left I found 5 mail boxes had been set up in this store. I moved them to the main store and took the new store offline, without realising the consequences. The idea was to see if we needed it, and if not, delete it.

So, when I ran the backup as I said, the normal store backed up fine (successfully as posted), but when I finally found where to read the report, I saw that the other store which I had forgotten about was failing because it "had to be mounted" as the report clearly stated.

We deleted this store, ran the backup again (which took 1 hours!!), and all is well again. Only a nrmal number of logs.

Thanks to all of you who helped. bk66md had the right idea, though I had already discovered this before seeing his post. However, please note that the app event log was not very forthcoming in this situation. It was the report in ntbackup which was useful, and now I know where this is for future refernce. We live and learn!

Will

 

[Zelandakh]

Excellent. You learned, we helped, problem solved.

Thanks for letting us know the outcome.

 

[WillShakespeare]

LOL - No probs. I just noticed a typo in my last post. Should say "18 hours", not "1 hours"!!

Thanks again,

Will