Index locations experience recent surge in disk space usage

[EVSpinner]

Hi everyone, can I get a peer review of my logic on this one

I've been asked to try and explain a recent surge in Index location disk usage, and I just wanted to have another set of eyes review my logic

Disk utilisation stats over 6months see the disk util hovering around the 92% mark. Then a sharp upward spike from the 1st of Jan of 1% before levelling out for  a few days and then another spike of 2 to 3%. The last spike coincides with everyone coming back to work after christmas

My suggestion for resolution is to move some of the larger indexes to another disk - easy

The aspect I'm struggling with is to explain why the index sizes/disk util suddenly spiked. There is nothing in the event log to indicate a problem. No indication there was a backlog of items that were waiting to be indexed that had suddenly processed

Overall, I think I'm either looking for an event in EV that will demonstarte items backedup somewhere that suddenly started to process, or an increase in emails received/archived to account for this behaviour. Am I missing anything as a potential cause? Can Index items loop perhaps?

Ideas welcome. Many thanks

[TonySterling · Accepted solution]

The first thing I would look at is the amount of items archived per night and compare that to the index size increase.

Also, you could look to see if you have some index rebuild jobs running.

Indexing doesn't depend on items being backed up, so that would be a bit of a red herring I would think.

[AndrewB · Accepted solution]

index usage should directly correlate to the size of the items being archived. maybe you changed an archiving policy? maybe you hit a period of mail with large attachments? maybe an increase in mailflow. also, changing indexing levels from brief/medium/full would have a great impact.

you can use this script to see your daily archiving rates. the rest would depend on operational knowledge of your environment.

--Runs against the VaultStore Database. Change the date range accordingly.
select "Archived Date" = left (convert (varchar, S.archiveddate,20),10),
"Daily Rate" = count (*),
"Avg Item Size" = sum (S.itemsize)/count (*),
SUM(SP.OriginalSize)/1024/1024 "Original Exchange Size (MB)"
FROM   Saveset S,
       SavesetProperty SP
WHERE  S.SavesetIdentity = SP.SavesetIdentity
AND archiveddate between '2015-01-01' and '2015-01-12'
group by left (convert (varchar, archiveddate,20),10)
order by "Archived Date" desc

[EVSpinner]

Thanks guys