We are having a problem where the log files on one of our storage groups is filling up it's volume again and again. It just one minute we have 41 5mb log files generated, and this is happening every minute. We have tried to figure out what is generating so much traffic but are unable to figure it out. We have looked at the user's mail box totals in the MMC and can't find any mailbox that is jumping up. We looked at the message tracking to see who was sending the email, but the messages listed there wouldn't do anything to generate the log load we are seeing. Because this exchange server has around 1200 users on it we can't just reboot it at the drop of a dime. We have been copying the log files off that volume for the last several hours trying to keep the server afloat until we could figure it out. Does anyone have any suggestions, (other than rebooting which we are trying to hold off on doing until late tonight)? Thanks very much in advance. Ted

Is there a mail loop going on? I've seen that happen from time to time. Try using Exmon to see if any users are using high CPU on the box that's generating traffic. Also use the message tracking to see what mail is going in and out. I would search for a 15 min time frame to see if anything is obvious.Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:ES, SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com

Any new entourage client joined your network recently? As Mark Said , run Exmon and Exbpa and look for issues?Also if you can, run a AV scan on your clients. Check for spams and open relay on your server.Raj

We have seen this issue on E2K7. So far we have tracked it down to specific mailboxes using Exmon, and the information in these two posts:http://andreslozada.blogspot.com/2009/07/troubleshooting-exchange-2007-store.htmlhttp://blogs.technet.com/mikelag/archive/2008/10/17/steps-to-help-mitigate-excessive-paging-and-working-set-trimming-issues.aspxTheinfo in both blogs we found useful. Hope it helps!

In addition to all the other replies, how many stores in the storage group? If possible, dismount one at a time until you can at least identify the problem store. If there is only 1 store in the SG, you could at least dismount it and keep the others up to temporarily stop the madness.Also consider using strings to look for transaction log patterns:http://blogs.msdn.com/scottos/archive/2007/11/07/remix-using-powershell-to-parse-ese-transaction-logs.aspxRemix!! Using Powershell to parse ESE Transaction Logs ...

Just for supplement, please always make sure you have the latest updates installed on the server.

Glad to hear you found the culprit. Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:ES, SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com