Article ID: 972705 - Last Review: January 22, 2010 - Revision: 1.1

The Microsoft Exchange Server 2007 log or database experiences abnormal growth

View products that this article applies to.

System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.

;

SYMPTOMS

The Microsoft Exchange Server 2007 may experience abnormal log or database growth when many log entries or messages are logged in a short time.

Back to the top

MORE INFORMATION

To help you troubleshoot this issue, download and install Update Rollup 2 for Exchange Server 2007 Service Pack 2, and then follow the steps to enable the update rollup.

Back to the top

Prerequisites

The following list contains prerequisites for the update rollup:

You must have Microsoft Exchange Server 2007 Service Pack 2 installed to install this update rollup. For more information about how to obtain the latest Exchange Server 2007 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
937052 (http://support.microsoft.com/kb/937052/ ) How to obtain the latest service pack or update rollup for Exchange 2007

For more information about Update Rollup 2, click the following article number to view the article in the Microsoft Knowledge Base:

972076 (http://support.microsoft.com/kb/972076/ ) Description of Update Rollup 2 for Microsoft Exchange 2007 Service Pack 2

Back to the top

Registry Update

This update rollup introduces the following three new registry entries that let you troubleshoot the abnormal log or database growth issue:

BytesLogWarningThreshold
BytesLogErrorThreshold
BytesLogCheckPeriodInMinutes

The BytesLogWarningThreshold entry and the BytesLogErrorThreshold entry set an error and warning threshold for the size of the log or database. After these registry entries are enabled, when the Exchange server makes a RPC call, the Exchange server checks against the averaged value of the Log Bytes Write/sec performance counter on the Exchange server. If the real value is exceeded, the Exchange server logs a warning or error message.

The BytesLogCheckPeriodInMinutes entry sets the period after which the Exchange server will check to see how many bytes were written to the log or database. The minimum period that can be set is 1 minute after which the log or database size is checked.

Back to the top

After you apply this update rollup and enable the new registry entries, the Exchange server can log a new warning that has the event ID of 10107 and a new error message that has the event ID of 10108. These events are logged when the Log Bytes Write/sec performance counter value exceeds the value that you have set for the BytesLogWarningThreshold or the BytesLogErrorThreshold registry entries. The new events resemble the following:

Event ID: 10107
Event type: Error
Event Source: MSExchangeIS Mailbox Store
Description:
User actions caused store transaction logs to exceed the warning limit of Value of BytesLogWarningThreshold. Current bytes: actual_bytes
Mailbox: mailbox_name
Account Name: domain\account_name
Accessing User: legacyExchangeDN
Mailbox: NULL
Administrative Rights: false_or_true
Identifier: ID
Client Information (if Available):
Machine Name: FQDN
Address: address
Process Name: Outlook.exe or other application
Process Id: ID

Event ID: 10108
Event type: Error
Event Source: MSExchangeIS Mailbox Store
Description:
User actions caused store transaction logs to exceed the warning limit of Value of BytesLogErrorThreshold. Current bytes: actual_bytes
Mailbox: mailbox_name
Account Name: domain\account_name
Accessing User: legacyExchangeDN
Mailbox: NULL
Administrative Rights: false_or_true
Identifier: ID
Client Information (if Available):
Machine Name: FQDN
Address: address
Process Name: Outlook.exe or other application
Process Id: ID
Application Id: N/A

How to add the new registry entries

The values of the new registry entries should be set to 0 to disable the entries. Then, when you troubleshoot the abnormal log or database growth issue, you can set the appropriate value of these entries, based on your environment. See the "How to calculate the registry values" section for more information about how to do this.

To add the new registry entries, follow these steps:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
On the Edit menu, point to New, and then click DWORD Value.
Type BytesLogWarningThreshold, and then press ENTER.
On the Edit menu, click Modify.
Type 0, and then click OK.
On the Edit menu, point to New, and then click DWORD Value.
Type BytesLogErrorThreshold, and then press ENTER.
On the Edit menu, click Modify.
Type 0, and then click OK.
On the Edit menu, point to New, and then click DWORD Value.
Type BytesLogCheckPeriodInMinutes, and then press ENTER.
On the Edit menu, click Modify.
Type 0, and then click OK.
Exit Registry Editor.

Back to the top

How to calculate the registry values

To calculate the appropriate value to which the registry settings must be set, you must determine what the maximum message size limits are at the organizational level and at the user level.

To determine what the global send size is for your organization, you can run the following command at a Windows PowerShell command-line interface:

Get-TransportConfig | fl MaxSendSize

Note this value. By default, this value is 10 MB in any given organization

For more information about Windows PowerShell, visit the following Microsoft Web site:

Windows PowerShell Web site (http://www.microsoft.com/powershell)

Exchange 2007 lets you set different message size limits that can be overridden at the user level if you have to provide exceptions for users in your organization. You should fully document these exceptions to make sure that Exchange 2007 server can meet the service level delivery times for your organization.

After you have determined what these values are, you can now calculate a reasonable value to which the registry values can be set.

For example, if the MaxSendSize value is 10 MB, and there are no user overrides, try the following settings:

Set the BytesLogWarningThreshold entry to 1.5 times the maximum send size, which is 15000000 bytes or 15 MB
Set the BytesLogErrorThreshold entry to 2 times the maximum send size, which is 20000000 bytes or 20 MB
Set the BytesLogCheckPeriodInMinutes entry to a value of 5, which represents a period of five minutes between checks.

Note These values should always be greater than the maximum allowed message size that can be sent in Exchange 2007, and this size should include any exceptions or overrides. If these values are set too low, this could result in too many events being logged in the Application log on the Exchange server. These values are example values only, based on the Exchange default settings, and these sizes should be customized to your organization's custom settings.

Back to the top