Exchange 2007 Log files

[brahma]

Morning All.

 

I've had an issue this weekend whereby my Exchange Server just stopped responding. Any clients that tried to connect got a message saying somehting like "Outlook Folders Can't Befound" and then something like "The Exchagne Server maybe down". When I checked, the server was up and running.

 

My first guess was to reboot the server as I thought the network service had stopped but this didnt resolve the problem. I then checked the services and a number of the Exchange Services weren't running. When I tried to start these manually, they failed. I then decided to check disk space and found that I was down to 358KB on my D drive - this stores the Transaction Logs. I have delete all log files from when the server was installed at the end of October up to 30/11/08 - this has given me about 3GB of disk space back. Restarting the services still did not work, so I rebooted the server again; this time everything came up fine and email is working again.

 

Sorry for the long preamble, but thought you might like to know a bit of background! My question is - there are still 28,500 log files in this folder! I need to be sure that this issue doesn't reoccur. Shouldn't the log files be cleared down automatically or will manual intervention always be required? Also, how long should you keep your log files for - is one month sufficient? And filnally, what are the log files used for - I'm assuming you need them if ever you want to do a restore?

 

Many thanks and sorry for the long post!!

Edited February 9, 2009 by brahma
Typo!!

[srochford]

Oops!

 

Log files present mean that you have no backups that have worked.

 

When you back up the Exchange store the final part of the (automatic) process is to delete those log files. If the log files are present then you do not have good backups.

 

Assuming that you are using an Exchange aware backup, check its logs to see what it's telling you (and look in event viewer - you'll see a message at the point when the backup takes place and it will also tell you that the log files are deleted)

 

If you delete the log files and the system fails (eg hardware failure) then you are going to have real problems recovering.