Exchange database has been grown

Hello dear visitors,

It’s been a long time we haven’t talked, it is because of my new role at Consist, as most of you already known I joined to IT Team at Consist company.

Just 2 weeks has been passed and already faced with some issue at my customer, came in the morning and got a call that Exchange service doesn’t work properly, after 2-3 minute of viewing into event viewer I noticed that the database was unmounted, then I realize that exchange’s disk was out of space,

I started to run some PowerShell commands which helped me to realize that there was a user who was responsible for this case, I would like to share with you the PowerShell commands I have run, run this command several times and try to catch a mailbox which grows rapidly.

In addition, I downloaded the following tool to check who takes the most resources, from Exchange server by CPU utilization,

Download Exchange User Monitor:

http://www.microsoft.com/downloads/details.aspx?FamilyID=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en

I would recommend refreshing the list every minute to see if a user makes the trouble on.

You also can check general QUEUE by running this query:

 

get-exchangeserver | where {$_.IsHubTransportServer -eq "true"} | Get-Queue | where {$_.Deliverytype –eq “MapiDelivery”} | Select-Object Identity, NextHopDomain, Status, MessageCount | export-csv QueuesEX.csv

 

Or check Users outbox folder:

get-mailbox -ResultSize Unlimited| Get-MailboxFolderStatistics -folderscope Outbox | Sort-Object Foldersize -Descending | select-object identity,name,foldertype,itemsinfolder,@{Name="FolderSize MB";expression={$_.folderSize.toMB()}} | export-csv OutboxItems.csv

 

  • You can the below query which may help you to realizes which user has the most usage.
  • I found a user that his LogRecordByte value was high, repeatedly appears several times on the output, from some reason user’s mobiles was sending too much information to Exchange(Probably some sync issue), I was wondering if it’s tried to re-sync contacts or even some virus on android was potential option to my mind, Eventually I decided to remove his mobile device from his account and instantly we got a big difference. That was very interesting troubleshooting which made me be satisfied.

 

Get-StoreUsageStatistics -Database “db_name” | Sort-Object LogRecordBytes -desc | Select-Object -First 25 | ft DigestCategory,DisplayName,LogRecordBytes,*time* -auto