I am running Exchange 2007 SP1. One store per storage group. Seperate drives for database and seperate one for logs.One of the log drives is filling up fast. The last backup was last night so no issue there.Any idea how I can find out what is causing all this activity? If it's someone's Outlook client sending out hundreds of mails by accident (e.g. virus, application gone crazy), how can I find this out?

Have you run EXMON to see if there is any unusual client activity? I believe you can download it for free now. Had a similar issue where it was an Unpatched Outlook 2007 client that was trying up send an email with a large attachment. We ran Exmon and seen the behavior.

On Thu, 18 Mar 2010 22:01:44 +0000, Joe Budden wrote:>I am running Exchange 2007 SP1. One store per storage group. Seperate drives for database and seperate one for logs.One of the log drives is filling up fast. The last backup was last night so no issue there.Any idea how I can find out what is causing all this activity? If it's someone's Outlook client sending out hundreds of mails by accident (e.g. virus, application gone crazy), how can I find this out? You can start with this:http://blogs.msdn.com/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspxMessage tracking logs may help. SMTP log files might help if the logfile generation is casued by the actual sending or receiving of email.They won't be much help if it's just activity that modifies anexisting message in the mailbox or just deposits the message in afolder without "sending" it through the Hub Transport.If you're in a desperate situation you can also enable circularlogging whie you puzzle out the answer.---Rich MatheisenMCSE+I, Exchange MVP--- Rich Matheisen MCSE+I, Exchange MVP

Thanks both, we found the cause of this because the user actually owned up when he found out he had a faulty application running on his machine (was a developer messing around with an app that hooked into Exch). I guess Exmon would have been perfect here, so thanks for the advise I will remember it next time. That said - is Exchange 2007 able to find out per user information without ExMon using any Powershell commandlets (e.g get-mailboxstatistics ...)? Thanks again guys!

On Sun, 21 Mar 2010 16:45:13 +0000, Joe Budden wrote:>>>Thanks both, we found the cause of this because the user actually owned up when he found out he had a faulty application running on his machine (was a developer messing around with an app that hooked into Exch). >>I guess Exmon would have been perfect here, so thanks for the advise I will remember it next time. >>That said - is Exchange 2007 able to find out per user information without ExMon using any Powershell commandlets (e.g get-mailboxstatistics ...)? Sure. get-mailboxstatistics, get-mailboxfolderstatistics,get-agentlog, get-messagetrackinglog should all work. You can couplethem with select-object, measure-object, unique-object, sort-object,etc. to get some insight into the activity on the machine(s).---Rich MatheisenMCSE+I, Exchange MVP--- Rich Matheisen MCSE+I, Exchange MVP