I found a page with some great scripts to run and the last one came up with this. get-logonstatistics |select-object username,Windows2000account,identity,messagingoperationcount,otheroperationcount,progressoperationcount,streamoperationcount,tableoperationcount,totaloperationcount | where {$_.totaloperationcount -gt 1000} | sort-object totaloperationcount -descending| ft I ran the command, then ran it again about 10 seconds later. You can see the numbers difference. UserName Windows200 Identity MessagingO OtherOpera ProgressOp StreamOper TableOpera TotalOpera 0Account perationCo tionCount erationCou ationCount tionCount tionCount unt nt -------- ---------- -------- ---------- ---------- ---------- ---------- ---------- ---------- Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 [PS] C:\Documents and Settings\srubin>get-logonstatistics |select-object username,Windows2000accoun ,identity,messagingoperationcount,otheroperationcount,progressoperationcount,streamoperationcount,t bleoperationcount,totaloperationcount | where {$_.totaloperationcount -gt 1000} | sort-object total perationcount -descending| ft UserName Windows200 Identity MessagingO OtherOpera ProgressOp StreamOper TableOpera TotalOpera 0Account perationCo tionCount erationCou ationCount tionCount tionCount unt nt -------- ---------- -------- ---------- ---------- ---------- ---------- ---------- ---------- Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Definitely looks suspicious so I'm going to start with her.

I have 2 2007 mailbox servers. Mailbox 1 is also a hub transport role. Mailbox 2 started using 66% more processor about 2 days ago. The store.exe process is the culprit, so I guess it's just busy. The log files associated with that also increased exponentially. How can I find out what all of this data is in the logs and where it's going?

By the way, there are 3 storage groups on this server, and only one of them is getting these massive number of logs. About 1GB a minute.

I ran the troubleshooter and it says that my RPC calls are high. That led me to a program called Exmon. I ran that against my mailbox server. The problem now is I'm not sure what's good or bad. My top user is taking about 55% process, but from what I've read that 55% of the users listed, not 55% of the cpu on the machine. He has 16046 dirties pages and 170716125 log Bytes.

IF you have a consistent top user in Exmon, I would ask that user to exit Outlook and close it and turn off any mobile device as a test to see if things get better.

I found a page with some great scripts to run and the last one came up with this. get-logonstatistics |select-object username,Windows2000account,identity,messagingoperationcount,otheroperationcount,progressoperationcount,streamoperationcount,tableoperationcount,totaloperationcount | where {$_.totaloperationcount -gt 1000} | sort-object totaloperationcount -descending| ft I ran the command, then ran it again about 10 seconds later. You can see the numbers difference. UserName Windows200 Identity MessagingO OtherOpera ProgressOp StreamOper TableOpera TotalOpera 0Account perationCo tionCount erationCou ationCount tionCount tionCount unt nt -------- ---------- -------- ---------- ---------- ---------- ---------- ---------- ---------- Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 Cindy Fu... IBTS\CF... /o=EXCH... 3352 744 0 124 0 4220 [PS] C:\Documents and Settings\srubin>get-logonstatistics |select-object username,Windows2000accoun ,identity,messagingoperationcount,otheroperationcount,progressoperationcount,streamoperationcount,t bleoperationcount,totaloperationcount | where {$_.totaloperationcount -gt 1000} | sort-object total perationcount -descending| ft UserName Windows200 Identity MessagingO OtherOpera ProgressOp StreamOper TableOpera TotalOpera 0Account perationCo tionCount erationCou ationCount tionCount tionCount unt nt -------- ---------- -------- ---------- ---------- ---------- ---------- ---------- ---------- Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Cindy Fu... IBTS\CF... /o=EXCH... 10554 2357 0 390 22 13328 Definitely looks suspicious so I'm going to start with her.

I found the following resources. I think I'm finally on the right patch to figuring this out. http://technet.microsoft.com/en-us/library/cc540454%28EXCHG.80%29.aspx http://social.technet.microsoft.com/Forums/en/exchangesvradmin/thread/30a9a323-0fa7-48b6-99d8-5d248dd30b06 http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/1d95e6b4-e3cf-4bce-85af-8ce0d94d9cef http://technet.microsoft.com/en-us/library/cc540454%28EXCHG.80%29.aspx http://blogs.technet.com/b/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx

I found the following resources. I think I'm finally on the right patch to figuring this out. http://technet.microsoft.com/en-us/library/cc540454%28EXCHG.80%29.aspx http://social.technet.microsoft.com/Forums/en/exchangesvradmin/thread/30a9a323-0fa7-48b6-99d8-5d248dd30b06 http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/1d95e6b4-e3cf-4bce-85af-8ce0d94d9cef http://technet.microsoft.com/en-us/library/cc540454%28EXCHG.80%29.aspx http://blogs.technet.com/b/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx

and this http://technet.microsoft.com/en-us/library/cc540464%28v=EXCHG.80%29.aspx

I haven't resolved the problem yet, but I think those links have me on the right path. For now I've turned on circular logging until after the Holiday.

So this problem isn't fixed. I thought it was then it came back. I followed a procedure to allow for a registry tweak to capture what is causing high RPC calls that are filling up my logs. I found multiple users (some much more than others but too many to pin on one or two users) causing these types of errors.. User actions caused store transaction logs to exceed the error limit of 50000000 bytes. Current bytes: 68392329. Mailbox: Howard Weissman Account Name: IBTS\Howard Accessing User: /o=EXCHANGE/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Howard Mailbox: <NULL> Administrative Rights: false Identifier: 000000003E32E490 Client Information (if Available): Machine Name: HODIR Address: 192.168.25.20 Process Name: w3wp.exe Process Id: 0 Application Id: Client=WebServices;UserAgent=Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.237) User actions caused store transaction logs to exceed the warning limit of 37500000 bytes. Current bytes: 44589130. Mailbox: Shyam Choudhary Account Name: IBTS\Shyam Accessing User: /o=EXCHANGE/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Shyam Mailbox: <NULL> Administrative Rights: false Identifier: 000000003E333620 Client Information (if Available): Machine Name: HODIR Address: 192.168.25.20 Process Name: w3wp.exe Process Id: 0 Application Id: Client=WebServices;UserAgent=Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.3625) Does anyone know what this could be?

Hi, Did you mean you had resolved this problem by installing the right patch? Cause some links you provided can not be opened well, which patch helped you solve this problem? Your solution might help others. Thanks.Best Regards!