How to verify if the logs are truncated after a Full Backup of the Exchange Database?
All changes made to the Exchange Server database are first committed to transaction log files. Any time a user modifies data stored in a mailbox or data is added to the mailbox, that change is written to a transaction log file before it is written to the Exchange Server database.
After the transaction logs are written to the edb, they are no longer needed and deletion is requested after a full Backup for exchange is successfully completed.
How to get the location path for the Exchange logs.
Get-Mailbox | fl Name,EdbFilePath,LogFolderPath
How to verify what logs has been committed to the edb
1. Open a CMD and change directory to the bin folder within the Exchange installation path. It would look similar to this:
C:\>cd "Program Files\Microsoft\Exchange Server\V15\Bin"
2. Use eseutil.exe /mk and checkpoint file like this:
C:\Program Files\Microsoft\Exchange Server\V15\Bin>eseutil.exe /mk "T:\NVDB01Logs\E01.chk"
3. Order log files by Date modified and look for the log file that ends with 11D in the name.
This means is that all the logs files previous to 16/9/17 9:05 a.m. has been committed into the edb and they should be deleted after running a full backup. Event 2046 is logged in the Exchange server indicating the backup for our Mailbox Database NBDB01 has successfully completed and the log truncation is requested.
You also can run this command in PowerShell:
Get-EventLog Application | Where-Object {$_.EventID -eq 2046} | fl
After that, the event 224 logs the log file deletion.
Or:
Get-EventLog Application | Where-Object {$_.EventID -eq 224} | fl
Keep in mind that truncation does not occurs immediately after an Exchange backup in a DAG - replicated configuration.
Please refers to this KB Article:
