How to Manually Reduce Old Exchange logs (4032483)

Old logs which are no longer required by Exchange can be left behind by Exchange.

Below are some steps that can be used to manually reduce old logs. Please ensure that logs are not deleted, just moved to a different place, as seen in step '6.'

1. 

Look for the directory where the database and logs files are saved.

For example:

C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 0379286631

There will be a checkpoint log file, Enn.chk

(where 'nn' is a number)

2.

In a command prompt, navigate to the bin directory of the installation of Exchange Server

For example:

cd C:\Program Files\Microsoft\Exchange Server\V14\bin

3.

Run the eseutil command for the Enn.chk file

For example:

C:\Program Files\Microsoft\Exchange Server\V14\Bin>eseutil /mk "C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 0379286631\E00.chk"

4.

Look the output. There will be a line like:

Checkpoint: (0x1C4,FFFF,FFFF)

Pickup the first number. In the above example, the first number is '0x1C4' which means that the oldest log that needs to be backup is the one that ends with '1C4'

5.

Go to the folder in which the transaction logs are saved. Order the files by the ‘Modified Time’ and find the logfile, whose name ends with the number that you found in the previous step

6.

Create a new folder with name old_logs and you can move to this new folder all the log files that are older than the logfile identified in the step '4.'

7. Perform a Full Backup of the database.

8. Backup the old_logs directory using the Plug-in for Filesystem

Additional notes:

* The log number pointed by the checkpoint (in the above example '0x1C4') is the oldest log that needs to be included in the Exchange backup. For this reason you can keep it in the Exchange Directory and not move it to the 'old_logs' directory.

* About truncation. The checkpoint tells us the oldest log that has not been yet flushed to the database files. Which means that the transaction in the older logs, are already posted in the Exchange databases. Then, if you backup the Exchange Databases, plus the transaction log file pointed by the checkpoint, and all the newer logs than the one pointed by the checkpoint, then you have the set of files that are needed for recovery.

* Likely it might not be necessary to have to use the 'old_logs' in the case of a future recovery. However, we cannot discard all the possible scenarios that can occur. For example, the 'old_logs' could be needed if your current Exchange databases are corrupted. But in the other hand, you will have signs right now of such need. Which means that if currently your Exchange Server is not requesting fixing any of your databases, then you might not need to use the 'old_logs' for recovery. Another reason to keep the old logs is to comply with policy regulations. For example, a given Company Policy might require the Exchange Administrators to keep track of every single transaction log that is generated.

* The Exchange Backup will perform the backup of the logs based on the logs that are present in the logs directory. I.e. the log pointed by the checkpoint and any newer log (note that it would backup as well any older log if it were present, that is the reason we moved them to the old_logs directory, to not be included in the Exchange Backup). The Exchange backup will backup the necessary logs, and purge the necessary logs (only from the logs that are present in the logs directory)

* The 'old_logs' can be backup at any time, using for example the Filesystem Plug-in. Once they are backup, they can be removed to liberate the disk space.