-
Title
How to verify if the logs are truncated after a Full Backup of the Exchange Database -
Description
How to verify if the logs are truncated after a Full Backup of the Exchange Database?
All changes made to the Exchange Server database are first committed to transaction log files. Any time a user modifies data stored in a mailbox or data is added to the mailbox, that change is written to a transaction log file before it is written to the Exchange Server database.
-
Cause
After the transaction logs are written to the edb, they are no longer needed and deletion is requested after a full Backup for exchange is successfully completed.
Disable Circular LoggingCircular logging does not wait for a full backup is performed in order to overwrites log files, so you might loss some changes already played forward into the edb file when you are restoring a Exchange Database.Also the Plugin for Exchange utilize transaction logs to capture Exchange data since the last backup in order to perform incremental/differential backups, reason for which Circular logging must be disable to make possible reliable restores from Transaction logs. -
Resolution
How to get the location path for the Exchange logs.
- Open Exchange Management Shell
- Run this command:
Get-Mailbox | fl Name,EdbFilePath,LogFolderPath
How to verify what logs has been committed to the edb
1. Open a CMD and change directory to the bin folder within the Exchange installation path. It would look similar to this:
C:\>cd "Program Files\Microsoft\Exchange Server\V15\Bin"
2. Use eseutil.exe /mk and checkpoint file like this:
C:\Program Files\Microsoft\Exchange Server\V15\Bin>eseutil.exe /mk "T:\NVDB01Logs\E01.chk"
3. Order log files by Date modified and look for the log file that ends with 11D in the name.
This means is that all the logs files previous to 16/9/17 9:05 a.m. has been committed into the edb and they should be deleted after running a full backup. Event 2046 is logged in the Exchange server indicating the backup for our Mailbox Database NBDB01 has successfully completed and the log truncation is requested.
You also can run this command in PowerShell:
Get-EventLog Application | Where-Object {$_.EventID -eq 2046} | fl
After that, the event 224 logs the log file deletion.
Or:
Get-EventLog Application | Where-Object {$_.EventID -eq 224} | fl
Keep in mind that truncation does not occurs immediately after an Exchange backup in a DAG - replicated configuration.
Please refers to this KB Article: