0

This is more of a learning question then a problem per say (hopefully that's okay to ask here!).

So, standard logging in Exchange. My understanding is as follows:

Changes to the database, incoming mail, sent items, etc. are written to log files stored in Program Files....\Logs.

When a backup is run, these logs get flushed, which is great - but when are those changes committed to the .edb (the database) itself? Is it done at a set time, or randomly when Exchange isn't 'busy'?

Furthermore - that means if backups aren't run on an Exchange server, lets just say this is the case, logs won't ever be flushed. So how could you get rid of them?

Would dismounting and remounting the database commit the logs to the EDB and flush the logs for example? Or rebooting the Exchange server?

Thanks!

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
PnP
  • 1,684
  • 8
  • 39
  • 65

3 Answers3

2

but when are those changes committed to the .edb (the database) itself? Is it done at a set time, or randomly when Exchange isn't 'busy'?

They're actually being committed all the time. The reason the logs since the last backup are kept is to facilitate a roll-forward of the database.

Say your database and your logs are on different volumes, and some cosmic rays destroy your database volume. You will then restore your databases from the most recent backup.. but it's missing everything that happened since that backup.

That's what the logs are for - you can then apply them to the restored database in order to bring it up to date with the state of the database right before the crash.

that means if backups aren't run on an Exchange server, lets just say this is the case, logs won't ever be flushed. So how could you get rid of them?

If you're not running backups, the only good the logs are doing you is allowing DAG replication (which pulls and replays current logs as they're created). You're right in thinking that by default, the logs will build up forever.

That's why Circular Logging can be enabled; the logs will then be deleted as soon as they've been written to all of the DAG partners they need to be written to.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251
  • So the only way to get rid of logs without manual deletion is to actually run an Exchange aware backup? – PnP Aug 31 '12 at 18:41
  • @TheD Or enable circular logging. – Shane Madden Aug 31 '12 at 18:42
  • So Circular Logging - if we had no DAG partners - changes made would be written to a log, committed to the EDB, then the next transaction log would simply overwrite the previous one that was just written to the database? – PnP Aug 31 '12 at 18:44
  • @TheD They'll still have incrementing file names, and you may have several at one time, but yes, they'll be deleted automatically in short order. – Shane Madden Aug 31 '12 at 18:46
  • 1
    @TheD, you would and should never manually delete the Exchange transaction logs. Either have them flushed as part of your backup routine or enable circular logging. – joeqwerty Aug 31 '12 at 19:02
  • So what is the risk associated in terms of disaster recovery with Circular logging enabled if it is always committing changes to the Database, and on that note, same with normal logging? – PnP Aug 31 '12 at 19:13
  • (If, they are on the same drive, say DATA drive. – PnP Aug 31 '12 at 19:15
  • @TheD If you don't have every log going all the way back to your most recent backup, then you have no way to apply changes to the restored database that occurred after it was backed up. – Shane Madden Aug 31 '12 at 19:16
  • But surely this would only be useful in a scenario whereby you lose just the Database on a seperate drive? – PnP Aug 31 '12 at 19:20
  • @TheD Not necessarily, no. The database can be lost or corrupted in any number of ways without losing the entire disk. – Shane Madden Aug 31 '12 at 19:22
  • So just to wrap my head around this - in a scenario such like: We have a backup of logs + the database from Monday. On Tuesday, your Exchange DB gets corrupted, you restore the DB from Monday, along with all the logs generated after the Monday backup completed, giving you a complete restore? This of course only if just your EDB got corrupted, since if you lose the whole drive with both the database and the logs, since Monday's backup, you would have no way of recovering the data – PnP Aug 31 '12 at 19:25
  • @TheD Correct. Though it's important to note that the backup never captures logs, it just triggers the flush of logs; the moment the backup completes, the only logs you care about are the ones in the future. – Shane Madden Aug 31 '12 at 19:27
  • So at the stage of backup, we use Attix5 for example, all logs would of been, or will be, committed to the DB before it is transmitted off-site for example. – PnP Aug 31 '12 at 20:04
  • Saying that Attix5 does backup the logs, and send them to it's offsite location - it backs up all the logs prior to them being flushed. – PnP Aug 31 '12 at 20:12
1

All DB related logs, wherever you choose to store them, (ideally different disk than the DB) are kept regardless of you mounting/dismounting DB. They're being removed only by backup process or (which is not recommended generally) if you switch the logging to circular. If the backup is never run, the logs folder will keep growing. You can (which is not recommended) to remove the logs manually, by stopping the DB, running eseutil /mh (I think) command, which will show you the state of the DB and the last applied Log. From which down, you can delete. However, why bother? No normal backup software? Just use Microsoft's Backup which is included with the server and exchange-aware.

Vick Vega
  • 2,398
  • 16
  • 22
1

In addition to the answers posted already:

The Exchange transaction logs, which are logs related to the mailbox databases, can/will be flushed as part of your backup process if you're backing up the mailbox databases with an Exchange aware backup program that is configured to flush the transaction logs.

As for the other logs related to Exchange (Transport Role logs), which are the logs related to incoming email, outgoing email, and the various other transport roles, those aren't flushed as part of your mailbox database backup process. The default age for those logs is 30 days. The default size for those logs is 10MB and the default log directory size is 250MB.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172