SMBs

DIY: Clear Exchange logs that filled up a C drive

Jack Wallen provides instructions on what to do if Exchange logs have filled up your C drive. Find out why he says the solution is risky.

I've received this question a number of times: "What do I do when Exchange logs have filled up my C drive causing Exchange to stop working?" The answer to this one is a bit more complicated than "just do X." Why? First and foremost, there must be a policy in place to clear the Exchange logs, and the policy will be specific to your company. However, the easiest and the cheapest way to clear the logs is to create a scheduled NT Backup job that backs up the Exchange Stores. This will automatically clear the logs, thus clearing up space.

But when the backup job (and log clearing) has been neglected, what do you do? Here are my suggested steps:

  1. Clear enough space to install CCleaner (on a drive other than C if possible). You won't need much space for this install.
  2. Run CCleaner to clear up as much space as possible on the C drive.
  3. Attempt to run an NT Backup job immediately.

If that NT Backup job will not run, there are two possible reasons why:

  • There is still not enough space on C.
  • Exchange is not running.
Check the services.msc tool to see if Exchange is running. If it is, it's time to clear out more space. If you can't find anything that can be deleted, follow these steps very carefully:

  1. Locate the Exchange logs.
  2. Select the oldest log files (be careful to delete only the oldest log files) and delete them.
  3. Empty the Recycle Bin.

If the NT Backup still won't run, you should continue deleting the oldest log files until you have enough space for it to run. Once you have Exchange back up and running, you should create a scheduled NT Backup job to regularly clean out the Exchange logs.

Caution: This is not a best practice, but I have run into situations with clients where there was no other option, and the described method managed to get their Exchange server back up and running. It's risky, but sometimes you have to take risks in order to get your clients' systems running. In an emergency, this method will work. Ask Jack: If you have a DIY question, email it to me, and I'll do my best to answer it. (Read guidelines about submitting DIY questions.)

About

Jack Wallen is an award-winning writer for TechRepublic and Linux.com. He’s an avid promoter of open source and the voice of The Android Expert. For more news about Jack Wallen, visit his website getjackd.net.

4 comments
birumut
birumut

Great!!! thanks for sharing this information to us! sesli chat sesli sohbet

tom.marsh
tom.marsh

That being: What are your exchange logs doing on your C: drive in the first place? Surely you didn't leave your mail store in the default location... Exchange Logs should have their own separately presented (i.e. not a partition on the same physical volume) drive which is also separate from the drive your Exchange database lives on. For example, if the OS is on C:, D: is your optical, E: and F: should be your database and log drives respectively. This is critical to performance and stability in your Exchange environment--without separate volumes you face the prospect of both log and database being out of space at the same time, which can potentially create a database corruption which is even less-fun to deal with than a full log-drive.

greg
greg

I'd also copy the logs first to a usb stick or burn them to DVD before I started deleting anything. Don't recall if this works in a crisis situation, but can't you copy the logs folder to another volume, then change the path to the new location and delete the logs contents on the C drive entirely?

tom.marsh
tom.marsh

"Moving the log path" is much simpler in Exchange 2010 sp1 than previous versions... Basically trivial. You could very easily do that if you have the capacity to quickly present another large volume to the server (say in a VM, or SAN environment.) However, the long-term solution is to troubleshoot the backup to make sure it's completing fully, and that your backup solution is fully compatible with the version of Exchange you're using, so your logs will flush properly on their own. In an ideal world with a properly configured backup you should never have to manually flush Exchange logs.

Editor's Picks