Truncate Exchange Transaction Logs

Manually truncate Exchange logs after a failed backup, without a backup

I received an alert today that the disk drive with our Exchange transaction logs was low on disk space. How low? 160KB free of 190GB! In fact, it was so low that Exchange dismounted the database on that server and moved it over to another host in the DAG.

Something like this is usually the result of backup problems. Exchange won’t purge transaction logs until it knows that they’ve been successfully backed up, since a successful restore of backup data requires a full backup plus all incremental transaction logs since then.

Of course, there’s a nice little trick to tell Exchange that a full backup was just performed… without actually performing a full backup. That lets Exchange start purging the transaction logs, which frees up disk space, which means Exchange can remount your database(s). It’s all thanks to the magic of VSS and DiskShadow.exe.

This needs to be done in an elevated command prompt on the server where the databases are mounted. If your databases and transaction logs are on different volumes, you’ll need to add both of them. In my case, Transaction Logs are on D:\ and Databases are on E:\ .

At a high level:

  • Load diskshadow
  • add volumes
  • begin backup
  • create
  • end backup
  • exit
C:\Windows\system32>diskshadow
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  EXCHANGE04,  9/3/2021 2:00:14 PM

DISKSHADOW> add volume d:
DISKSHADOW> add volume e:
DISKSHADOW> begin backup
DISKSHADOW> create

Alias VSS_SHADOW_1 for shadow ID {b7d4f4f0-8293-4dbd-8bae-3901023e3e6b} set as environment variable.
Alias VSS_SHADOW_2 for shadow ID {c994095e-dbdb-4950-b285-cf73b3e5ca1a} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {a0f96cbf-f4f2-40d9-9453-e84e6986c932} set as environment variable.

Querying all shadow copies with the shadow copy set ID {a0f96cbf-f4f2-40d9-9453-e84e6986c932}

        * Shadow copy ID = {b7d4f4f0-8293-4dbd-8bae-3901023e3e6b}               %VSS_SHADOW_1%
                - Shadow copy set: {a0f96cbf-f4f2-40d9-9453-e84e6986c932}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 2
                - Original volume name: \\?\Volume{c19abc70-413e-4ea7-b4d4-1ed69c382d6f}\ [D:\]
                - Creation time: 9/3/2021 3:27:13 PM
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy63
                - Originating machine: EXCHANGE04.company.com
                - Service machine: EXCHANGE04.company.com
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  Auto_Release Differential

        * Shadow copy ID = {c994095e-dbdb-4950-b285-cf73b3e5ca1a}               %VSS_SHADOW_2%
                - Shadow copy set: {a0f96cbf-f4f2-40d9-9453-e84e6986c932}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 2
                - Original volume name: \\?\Volume{64abb4bb-d15b-42f9-893f-224c5a2f25a5}\ [E:\]
                - Creation time: 9/3/2021 3:27:13 PM
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy64
                - Originating machine: EXCHANGE04.company.com
                - Service machine: EXCHANGE04.company.com
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  Auto_Release Differential

Number of shadow copies listed: 2

DISKSHADOW> end backup
DISKSHADOW> exit

C:\Windows\system32>

The EMC/Powershell can display the last backup that Exchange is aware of:

[PS] C:\Windows\system32>Get-MailboxDatabase -status | select Name, LastFullBackup | ft

Name       LastFullBackup
----       --------------
Journaling 9/5/2021 5:35:06 PM
Tier3-C    9/5/2021 5:35:07 PM
Tier3-D    9/5/2021 5:35:06 PM
Tier3-A    9/6/2021 10:04:43 AM
Tier3-M    9/6/2021 10:04:43 AM
Tier3-X    9/6/2021 10:04:43 AM
Tier3-L    9/5/2021 5:35:06 PM
Tier3-B    9/5/2021 5:34:48 PM

An alternate trick is to delete any unmounted database copies on the server that’s out of Transaction Log space through proper Exchange methods (EAC or Powershell). Once that’s done, delete the Transaction Logs belonging to that database. It should free up a small amount of space - perhaps enough breathing room to get a database online, users up and running again, and time for you to take proper measures.

If you’re running Exchange as a VM or the disks are on a SAN, you could also provision more disk space, then extend the volume.

The DiskShadow/VSS method should result in the following entries in the Application Event Log. These are from Windows Server 2016:

Event ID Source
Exchange VSS Writer metadata preparation 2021 MSExchangeRepl
Exchange VSS Writer database preparation 2110 MSExchangeRepl
Exchange VSS Writer prepared for backup 2023 MSExchangeRepl
A Full Shadow copy was started 2005 ESE
Backup starting 960 ESE BACKUP
Shadow copy freeze started 2001 ESE
Exchange VSS Writer freezes databases 2027 MSExchangeRepl
Shadow copy freeze ended 2003 ESE
Exchage VSS Writer freeze ended 2029 MSExchangeRepl
VSS Writer backup success 2046 MSExchangeRepl
Shadow copy success 2006 ESE
Exchange VSS Writer backup completion 2033 MSExchangeRepl
Exchange VSS Writer backup ended 2037 MSExchangeRepl
Exchange VSS Writer post-backup processing 2035 MSExchangeRepl
Tombstone table cleanup 40013 MSExchangeIS
Tombstone table cleanup complete 40017 MSExchange IS

You may also see events for:

  • Exchange VSS Writer preparation (Event ID 9811, MSExchangeIS)
  • Logs are now purged (Event ID 224, ESE)
  • Backup is now complete (Event ID 9780, MSExchangeIS)
Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 10:03:28 AM
Event ID:      2021
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange VSS Writer has successfully collected the metadata document in preparation for backup.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 10:04:40 AM
Event ID:      2110
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange VSS Writer instance 02f75633-f3a1-4ac2-8e6e-5fb60f168e42 has successfully prepared for a full or a copy backup of database 'Tier3-L'.  The following database will be backed up: Tier3-L.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 9:26:33 AM
Event ID:      2023
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange Replication service VSS Writer (Instance 39cca171-a3ed-43e5-85d4-4c66dfae6e21) successfully prepared for backup.



Log Name:      Application
Source:        ESE
Date:          9/6/2021 9:26:35 AM
Event ID:      2005
Task Category: ShadowCopy
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
Information Store - Journaling (23412,G,0,15.01.2308.014) Shadow copy instance 1 starting. This will be a Full shadow copy.

For more information, click http://www.microsoft.com/contentredirect.asp.



Log Name:      Application
Source:        ESE BACKUP
Date:          9/6/2021 9:26:40 AM
Event ID:      960
Task Category: General
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
msexchangerepl (5596) This computer is performing a surrogate backup.  The master server is Exchange04.



Log Name:      Application
Source:        ESE
Date:          9/6/2021 9:26:40 AM
Event ID:      2001
Task Category: ShadowCopy
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
Information Store - Tier3-D (37104,D,0,15.01.2308.014) Tier3-D: Shadow copy instance 1 freeze started.

For more information, click http://www.microsoft.com/contentredirect.asp.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 9:26:40 AM
Event ID:      2027
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange VSS Writer instance 39cca171-a3ed-43e5-85d4-4c66dfae6e21 has successfully frozen the databases.



Log Name:      Application
Source:        ESE
Date:          9/6/2021 9:26:42 AM
Event ID:      2003
Task Category: ShadowCopy
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
Information Store - Tier3-C (8036,G,0,15.01.2308.014) Shadow copy instance 1 freeze ended.

For more information, click http://www.microsoft.com/contentredirect.asp.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 9:26:42 AM
Event ID:      2029
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange VSS Writer instance 39cca171-a3ed-43e5-85d4-4c66dfae6e21 has successfully thawed the databases.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 10:09:08 AM
Event ID:      2046
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange Replication service VSS Writer instance 02f75633-f3a1-4ac2-8e6e-5fb60f168e42 has successfully completed the backup of database 'Tier3-A'.

Database log truncation has been requested for this database. Log truncation will occur on the active copy after the next log generation is created. Log truncation will occur automatically on the passive copies after that log file is copied.



Log Name:      Application
Source:        ESE
Date:          9/6/2021 10:09:08 AM
Event ID:      2006
Task Category: ShadowCopy
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
Information Store - Tier3-A (35276,G,0,15.01.2308.014) Shadow copy instance 1 completed successfully.

For more information, click http://www.microsoft.com/contentredirect.asp.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 10:09:08 AM
Event ID:      2033
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange Replication service VSS Writer (Instance 02f75633-f3a1-4ac2-8e6e-5fb60f168e42) has successfully processed the backup completion event.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 10:09:08 AM
Event ID:      2037
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange Replication service VSS Writer (Instance 02f75633-f3a1-4ac2-8e6e-5fb60f168e42) backup has been successfully shut down.



Log Name:      Application
Source:        MSExchangeRepl
Date:          9/6/2021 9:26:42 AM
Event ID:      2035
Task Category: Exchange VSS Writer
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The Microsoft Exchange Replication service VSS Writer (Instance 39cca171-a3ed-43e5-85d4-4c66dfae6e21) has successfully processed the post-snapshot event.



Log Name:      Application
Source:        MSExchangeIS
Date:          9/6/2021 9:36:15 AM
Event ID:      40013
Task Category: Logical Data Model
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The tombstone table has reached an excessive number of entries and/or total size. A maintenance task has been dispatched to perform urgent cleanup.

Database: Journaling (6b141c8e-f158-4dea-aede-87ea1eb83e41)
Number of entries (estimated): 1453
Total size of entries (estimated): 5369912232 bytes



Log Name:      Application
Source:        MSExchangeIS
Date:          9/6/2021 9:36:26 AM
Event ID:      40017
Task Category: Logical Data Model
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Exchange04.company.com
Description:
The urgent tombstone table cleanup task has finished executing.

Database: Journaling (6b141c8e-f158-4dea-aede-87ea1eb83e41)
Message tombstones deleted: 134
Subobject tombstones deleted: 1315
Total size of deleted entries: 5358535877 bytes
Remaining number of entries (estimated): 4
Total size of remaining entries (estimated): 11376355 bytes
Elapsed time: 11.1328017 seconds
Pass completed: True
Subobjects in-use: 4
Mailboxes quarantined: 0
Mailboxes locked: 0
Mailboxes should stop maintenance: 0
Exchange
Licensed under CC BY-NC-SA 4.0
© 2020 - 2024 Greg Beifuss
Built with Hugo
Theme Stack designed by Jimmy