DXfoto.com - Fotolia

Manage Learn to apply best practices and optimize your operations.

How can I recover Exchange transaction logs space?

Exchange Server transaction logs have filled up my hard drive. How do I free up space taken by these logs? And can I prevent it from happening again?

This is a problem that I will venture to say every Exchange Server administrator has run into or will run into...


The core issue with Exchange transaction logs is disk space, requiring proper planning and maintenance of that space. Even with careful planning, there are capacity issues that organizations do not anticipate in their initial storage design for Exchange servers.

Here are three common examples of what causes the Exchange transaction log drive to fill up:

  • Backups fail to run and logs are not truncated as expected;
  • Mailbox moves -- especially migrations -- generate more Exchange transaction logs on the target server than anticipated;
  • Sudden email volume increase or changes in email usage in an organization, such as sending out annual contracts with large attachments to customers.

Assuming that you cannot extend the volume on which the Exchange transaction logs reside, you will need to remove the log files manually. Once the data written to the log file has also been committed to the .edb file, the Exchange database, that log file can be truncated from the file system.

If automated truncation fails or does not have a chance to run before the drive reaches capacity, the admin can use database and checkpoint headers to identify which Exchange transaction logs they can manually remove. This process varies if you run a version of Exchange Server older than 2010. In Exchange 2010 and higher, you can run the eseutil /mk command against the checkpoint E##.chk. For example, to initiate a file dump, run:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Bin\eseutil /mk "C:\Program Files \Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 1234567890\e00.chk"

In the output of the dump, look for the checkpoint value:

Checkpoint: (0x29,FFFF,FFFF)

Specifically, look for the first hex value. In this example, it is 0x29, which matches transaction log file E0000000029.log in the file system. Any log files older than the file you identify in the checkpoint header can be safely removed from your drive. Any newer Exchange transaction log files must remain in place.

You can also enable circular logging on the database(s). This will recover space currently consumed by transaction log files, and prevent the Exchange transaction logs from perpetually growing and filling up the hard drive.

This may be a short-term fix, but it is not a recommended answer for standalone mailbox servers, as this eliminates the log files as a potential disaster recovery option.

To prevent log jams in the future, allocate enough free space to compensate for the unexpected. Here are some suggestions:

  • Consider your worst-case scenario in terms of response time. This often happens because an administrator is away and the backup jobs fail. Since no one is there to address the problem, the hard drive fills up with transaction logs. Then, you get a phone call in the middle of your vacation. If you allocate enough space to handle log growth for a seven-to-14-day period, you will prevent a storage crisis in which the information store is shut down.
  • Track the amount of space log files take up daily and weekly. Identify upward trends in log file growth before they negatively affect storage.
  • Monitor disk space and set alerts when capacity falls below 20% free space.
  • Confirm that backups are performed and that log files are successfully truncated after each backup.
  • Before moving a large number of Exchange mailboxes, make sure the free drive space on the target mailbox server is greater than the total amount of mail you will be moving. I always take the total mailbox size for all mailboxes in the move and add 20%.

Next Steps

Control Exchange 2010 database log growth

What's new with Exchange Server transaction logs?

How to avoid Exchange 2013 storage snags

Multiple ways to analyze Exchange logs

Dig Deeper on Exchange Server setup and troubleshooting