4/13/11

Time (or Space) is running out.. on Exchange ?!

Hello Again,

This time I'm going to talk about an issue that has happened to me a few time (to my misfortune). Hopefully, It'll help you deal with said issue in a more relaxed fashion and save you some trouble.
Picture the following scene - Your favorite monitoring system alerts that space is running low on the drive that stores your exchange transaction logs (for a specific group), but nobody notices, and it keeps running out.
This usually happens when your Exchange Server isn't being backed up in time.
One way to prevent this from happening, is making your monitoring system alert in a proper way - so there's no way this kind of thing can be overlooked. Another way is to schedule a backup of the exchange server more frequently (or schedule one at all - if you didn't think about it earlier).
Now, free space on your "log drive" is reaching it's critical mark, once it has reached zero available space it will automatically dismount all the stores of the group in question, but fear not - there is a way to deal with it.
First, you can try a manual backup of the exchange server (with your favorite backup manager or even ntbackup) - you might still have enough time to save the day.
Second, or should I say if time is of the essence, you'll need to resort to extreme measures - you'll need to delete  all the transaction logs of the group in question. "But wait, won't that affect me in some horrible way?" - Rest assured dear reader, follow these steps and everything will be ok.
  1. Navigate to the MDBDATA folder on the drive in question. While in the folder, select the first 3-4 days of logs "on record" and copy them to a location that can contain them (i.e. another drive that has lots of 
  2. free space).
  3. When you're finished copying, open a new Notepad instance and do the following - 
    • Open the Exchange System Manager
    • Navigate to the Group in question
    • For each Store, locate the .edb file location and copy it to a new line in the recently opened notepad instance.
  4. Now, for each line in your Notepad instance add the following in front of the line - eseutil /mh
  5. After completing these steps you are prepared to dismount all the store of the group, but be advised, this action will temporarily disconnect all mailboxes connected to these stores (on the bright side, it would've happened anyway, if not now then later). You can now dismount all the stores of the group in question.
  6. After you've done dismounting, open a CMD prompt, navigate to the folder where the exchange server is installed, copy all the content of your Notepad instance and paste it back to the CMD prompt. For each line that runs, you should get a "Clean Shutdown" in the "Shutdown State" line. (if this is not the case, you now have a serious problem, and you can address it using this post)
  7. Navigate to the MDBDATA folder from step 1 and remove the files you have backed up eralier.
  8. Now, select the rest of the files and cut them. Create a new folder and paste them info that folder.
  9. Now mount all the stores (and pray it all works as it should work).
  10. Once the stores are mounted you can delete the new folder you've created earlier and the files that you've backed up in step 1.
  11. Done.
To make sure this does not happen again - do as I mentioned earlier and make sure your backup plan for the exchange server is planned right and executed as scheduled.
Hopefully, you'll never have to resort to these measures, but just in case you do, I hope this post helps you.

Best Wishes, 
Dani.

p.s.
If you have any thoughts on the subject, leave a comment and I'll be sure to reply :)

3 comments:

  1. What's the purpose of backing up the first 3-4 days of logs?

    ReplyDelete
  2. It's nothing special. It's just a number I came up with. On one hand, it wouldn't take you too long to copy it, and on the other hand, it will free enough space for you to mount the stores.

    ReplyDelete
  3. Should I say "ESHHHH" or just Great?
    Hope that the next time the backup would work properly....

    ReplyDelete