The Microsoft Exchange Server 2007 may experience abnormal log or database growth when many log entries or messages are logged in a short time.
To help you troubleshoot this issue, download and install Update Rollup 2 for Exchange Server 2007 Service Pack 2, and then follow the steps to enable the update rollup.
The following list contains prerequisites for the update rollup:
You must have Microsoft Exchange Server 2007 Service Pack 2 installed to install this update rollup. For more information about how to obtain the latest Exchange Server 2007 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
937052 How to obtain the latest service pack or update rollup for Exchange 2007
For more information about Update Rollup 2, click the following article number to view the article in the Microsoft Knowledge Base:
972076 Description of Update Rollup 2 for Microsoft Exchange 2007 Service Pack 2
This update rollup introduces the following three new registry entries that let you troubleshoot the abnormal log or database growth issue:
The BytesLogWarningThreshold entry and the BytesLogErrorThreshold entry set an error and warning threshold for the size of the log or database. After these registry entries are enabled, when the Exchange server makes a RPC call, the Exchange server checks against the averaged value of the Log Bytes Write/sec performance counter on the Exchange server. If the real value is exceeded, the Exchange server logs a warning or error message.
The BytesLogCheckPeriodInMinutes entry sets the period after which the Exchange server will check to see how many bytes were written to the log or database. The minimum period that can be set is 1 minute after which the log or database size is checked.
After you apply this update rollup and enable the new registry entries, the Exchange server can log a new warning that has the event ID of 10107 and a new error message that has the event ID of 10108. These events are logged when the Log Bytes Write/sec performance counter value exceeds the value that you have set for the BytesLogWarningThreshold or the BytesLogErrorThreshold registry entries. The new events resemble the following:
Event ID: 10107 Event type: Error Event Source: MSExchangeIS Mailbox Store Description: User actions caused store transaction logs to exceed the warning limit of Value of BytesLogWarningThreshold. Current bytes: actual_bytes Mailbox: mailbox_name Account Name: domain\account_name Accessing User: legacyExchangeDN Mailbox: NULL Administrative Rights: false_or_true Identifier: ID Client Information (if Available): Machine Name: FQDN Address: address Process Name: Outlook.exe or other application Process Id: ID
Event ID: 10108 Event type: Error Event Source: MSExchangeIS Mailbox Store Description: User actions caused store transaction logs to exceed the warning limit of Value of BytesLogErrorThreshold. Current bytes: actual_bytes Mailbox: mailbox_name Account Name: domain\account_name Accessing User: legacyExchangeDN Mailbox: NULL Administrative Rights: false_or_true Identifier: ID Client Information (if Available): Machine Name: FQDN Address: address Process Name: Outlook.exe or other application Process Id: ID Application Id: N/A
How to add the new registry entries
The values of the new registry entries should be set to 0 to disable the entries. Then, when you troubleshoot the abnormal log or database growth issue, you can set the appropriate value of these entries, based on your environment. See the "How to calculate the registry values" section for more information about how to do this.
To add the new registry entries, follow these steps:
Click Start, click Run, type regedit, and then click OK.
Locate and then click the following subkey in the registry:
Exchange 2007 lets you set different message size limits that can be overridden at the user level if you have to provide exceptions for users in your organization. You should fully document these exceptions to make sure that Exchange 2007 server can meet the service level delivery times for your organization.
After you have determined what these values are, you can now calculate a reasonable value to which the registry values can be set.
For example, if the MaxSendSize value is 10 MB, and there are no user overrides, try the following settings:
Set the BytesLogWarningThreshold entry to 1.5 times the maximum send size, which is 15000000 bytes or 15 MB
Set the BytesLogErrorThreshold entry to 2 times the maximum send size, which is 20000000 bytes or 20 MB
Set the BytesLogCheckPeriodInMinutes entry to a value of 5, which represents a period of five minutes between checks.
Note These values should always be greater than the maximum allowed message size that can be sent in Exchange 2007, and this size should include any exceptions or overrides. If these values are set too low, this could result in too many events being logged in the Application log on the Exchange server. These values are example values only, based on the Exchange default settings, and these sizes should be customized to your organization's custom settings.