Exchange Transaction Logs

[DRH]

Does Enterprise Vault cause Exchange Transaction Logs to be created when archiving mailboxes? We are seeing a large increase in our tlogs while we are deploying EV to the end users.

Thanks

[S_Jackson_in_WA]

Yes.  When you archive, you are changing data in the Exchange database: adding shortcuts, processing safety copies.  All these changes generate transaction logs.

During our initial implementation we changed our Exchange backups to incremental on weeknights to flush the transaction logs.

[DRH]

Thanks for the reply. I was expecting this behavior just not at this rate. I have around 6200 users across three sites that I am trying to enable at a rate of 300 to 400 at a time. Two of the sites seem to be operating just fine but this one seems to have a spike in the transaction logs on Exchange from time to time. We are running the archiving pass from 6A to 6P every evening and all weekend long with incremental jobs everyday for EV and full Exchange backups every night. We have now implemented an incremental job for Exchange during the day also.

If you have any pointers or best practices to pass along that would be great.

[Brian_Day]

Any change within the EDB/STM files of Exchange 2003 create a transaction log entry. If you are creating so many to the point where you might run out of space you have a couple of options.

1) Change the storage group to use circular logging (restart the IS service) and do a backup immediately after your archive run (circular logging means restores are ONLY to time of last backup, you cannot reply any TL's in case of database failure). Then if you wish you can change it back to normal and restart the IS service again.

2) Monitor your Databases ==> Checkpoint Log Depth value for each storage group. This is how many transaction logs have yet to be committed to the databse. If it says 5 then the last 5 TL's cannot be safely deleted without losing data. If you had 3600 TLs in the directory, you could safely delete 3595 of them.

I prefer #1.

[S_Jackson_in_WA]

For best practices, are you talking for Exchange or EVault or both?

Here's a comprehensive discussion of Exchange transaction logs on the Microsoft Exchange Team blog.

How to Recover from "Disk Full" on an Exchange Log Drive
http://msexchangeteam.com/archive/2004/05/12/130556.aspx

More on Exchange logs
http://msexchangeteam.com/archive/2004/05/17/133770.aspx

What can cause huge amounts of transaction logs to show up?
http://msexchangeteam.com/archive/2004/05/10/129149.aspx

Here's an EV Provisioning best practices document (thanks Tony S.).  Some other articles there look interesting also.

http://www.symantec.com/enterprise/stn/articles/article_detail.jsp?articleid=best_practice_for_granu...

[DRH]

Thanks for the link. Yes, I was referring to EV best practices. I am seeing this event in the EV event log

There are 23576 index delete operations that have not yet been committed to disk for Vault Store

I am also seeing that the Provisioning Task is not running at its scheduled time. It is set to automatic and scheduled to run twice daily but no report is being generated. It does generate the report when I run it manually though.

Thanks for all the help...