Logs are not getting purged after successfull backup of exchange 2k13 snapshot backup using NBU

[smith_jones]

Hi,

Logs are not getting purged after successfull backup of exchange 2k13 snapshot backup using NBU. 

Created the bpbkar log folder and on client increased the logging level to 5.

But after backup nothing is there like truncate or something with it in the log file of bpbkar. There is not any event in event viewer regarding failed or successfull log trunation.

I just know that after successfull backup, NBU sends a signal to exchange that it can truncate the logs and I just want to show that in the log file that it is giving the signal to exchange for it. How to check?

I checked replication and everything fine on exchange, every queue length is zero. So many backups being taken and no one is purging the logs after backup.

we have snapshot grt backup using nbu and option selected is - passive copy only (or passive from the preferred list)

Thanks.

[Marianne]

NetBackup logs will not contain any information related to log truncation as this is 100% Exch function.

NBU will merely record status 0 (successful) backup. 
You will not find anything in NBU logs to say that Exch is informed of the successful backup - this is done via the API. 

You should see successful backup status in Event Viewer on Exch server. 
This is proof that Exch knows that backup was successful.
The Event Log should be sufficient to log a call with Microsoft if logs are not truncated despite successful backup.

PS:
Ensure that backups are indeed completing with status 0 - status 1 is not good enough...

[Michael_G_Ander]

You don't mention the snapshot type, but in VSS you have an option to disable log truncation, that might be worth checking.

For Exchange DAG the bpresolver log also can contain indications of what causes the problems with the backups.

[Lowell_Palecek]

Look in your bpfis log. Bpfis manages the snapshot; bpbkar backs up from the snapshot to media. There actually are two bpfis processes...

"bpfis create" takes the snapshot, processes the metadata, and notifies bpbrm that the snapshot is complete. Then it waits to find out whether the backup succeeds.

bpbkar copies data from the snapshot to bptm.

"bpfis delete" is executed with the backup status as a parameter, and transmits the status via named pipe to the bpfis create process.

During all of this, the bpfis create process opens a COM interface to the Exchange VSS writer. Look for all occurrences of IVSS in the bpfis log. The coordinated calls on the IVSS interface behave like a transaction.

At the end of the backup, bpfis makes a call on the interface to tell Exchange that the backup is complete, and another to tell it the status of the backup.  If the snapshot type is full or differential and if the backup is successful, then Exchange truncates its logs. If the snapshot type is not full or differential, you'll find an Event log from Exchange telling you that it will not be truncating the logs. If the backup fails, you'll find an entry in the bpfis log telling you that Exchange will not be truncating the logs because of the failure.

A user-initiated backup (USER schedule type) uses a copy snapshot. It does not produce log truncation.

[sclind]

In a 2014 case I had open I was told bpbkar *should* have some indication that truncation was called for:

>"we have upped the logging level on the exchange server to max and  are going to let the exchange backups run, >so we can capture the "truncate" messages in  the bpbkar logs."

[Lowell_Palecek]

Here's an example. I backed up one database on an Exchange 2010 mailbox server.

Selections from the bpfis log:
VssSnapshotVolume::Initialize() - calling IVssBackupComponents::InitializeForBackup
VssSnapshotVolume::Initialize() - calling IVssBackupComponents::SetContext with context: 0x0
Using fresh IVssBackupComponents for provider gather
VssSnapshotVolume::GetWriterMetaData() - calling IVssBackupComponents::GatherWriterMetadata.
VssSnapshotVolume::GetWriterMetaData() - waiting for IVssBackupComponents::GatherWriterMetadata to complete.
VssSnapshotVolume::GetWriterMetaData() - IVssBackupComponents::GatherWriterMetadata complete.
Informational: calling IVssBackupComponents::SetBackupSucceeded for status event 'SUCCESS (0x00000000)' with succeeded set to 1(True) for Component 'User?Data\Exchange Server\Microsoft Exchange Server\Microsoft Information Store\ROCKFALLSVM2\RF2DB1' object '087fde4e-90f3-48b6-86b9-c8a74f56d507' when detaching from Shadow?Copy?Components Dle
INF - vss__complete: Exchange Transaction Logs will be truncated by VSS.

The word "truncate" does not occur in the bpbkar log. (Both logging parameters at max levels.)

In the Windows application Event Log, I find ESE posted event 224:
Information Store (1964) RF2DB1: Deleting log files F:\RF2DB1\E010000463B.log to F:\RF2DB1\E010000483A.log.

Then MSExchangeIS posted event 9780:
Exchange VSS Writer (instance f44e168e-8217-4cd8-b5b8-505509df3e2b:4) has successfully completed the full or incremental backup of database 'RF2DB1'.　

The database engine has also successfully executed log file truncation procedures for this database. (Note that this may or may not have resulted in the actual truncation of log files, depending on whether any log files existed that were candidates for truncation.)

[smith_jones]

Hi Thanks for your replies.

@Lowell_Palecek  - Creating the bpfis directory at client.

@Michael_G_Ander - Where can I check the option to disable log truncation in VSS?

Also FYA, I am not able to get the correct server in the post, mine one is windows 2012 R2 for both client and master but media is nbu appliance 5230.

[Michael_G_Ander]

Don't know exactly, but would guess it is in the Writer part of the registry, like some many other settings for VSS.

As VSS is a Microsoft thing, you might have to create a case with them.

[Lowell_Palecek · Accepted solution]

Ultimately, as others have said, log truncation is up to the Exchange VSS writer. When it doesn't truncate logs, it will tell you in the Event log why not.

The reasons that bpfis knows of:
- The backup failed.
- The integrity check failed. (This is a Microsoft API.)
- The backup is not a type where log truncation is appropriate, or this is a VMware ASC job, for which log truncation is deferred to the VM phase of the backup.

In the first two cases, bpfis logs:
>Exchange Transaction Logs will not be truncated by VSS because of errors encountered during the backup, Backup Status = nnnn, Validation Status = nnnn

In the third point, bpfis logs one of these:
>Exchange Transaction Logs will not be truncated by VSS because this is a cumulative type backup.
>Exchange Transaction Logs will not be truncated by VSS because this is a pre-VM type backup.
>Exchange Transaction Logs will not be truncated by VSS because this is a user initiated type backup.

Otherwise, as shown in my example posted yesterday, bpfis logs:
>Exchange Transaction Logs will be truncated by VSS.

[smith_jones]

Hi,

I have attached the bpfis log and was not able to found something related to Log Truncation.

Please assist.

Thanks.

[Lowell_Palecek]

You are running at the minimal logging level. That's why you don't see the bpfis log entries I told you about.

However, looking at the "logparams" line for the Exchange backup, I see that your schedule type is CINC. Please go read what this means.

Have you checked the Windows Application Event log?  As I posted before, Exchange and VSS log exactly why they do or do not truncate logs. You will find an event telling you that logs will not be truncated because you did a differential snapshot.

[smith_jones]

Hi Lowell,

I was knowing that my backup is CINC from two days. I have to get the logs related to it in bpfis. I understand that in CINC log truncation not happens.

I never get anything related to log truncation in event viewer in exch 2k13 case, I do get those in exch 2k10 case (full backup).

In our case just event locked to tell VSS starting. freezing db and thawing db and exch cheking the health of all db's in dag, etc. but not about truncation

[smith_jones]

Hi Lowell,

Got the high level bpfis log and found what was needed. But I never got an event in windows about log truncation in my issue. I do see them on the server where truncation is happening (event 224 in exch 2k10) but I do not get them (not a single event) on the server where truncation is not happening (currently exch 2k13).

Thanks alot Lowell. Thanks guys :)