Exchange log files

Let me start by admitting that I don't take good enough care of my SBS 2000
box - that should avoid the 'serves you right' replies :-)

I have SBS 2000 serving approx 35 employees, and I back the server up using
Backup Exec 9.0. I run a FULL backup each weekday night.

I have 2 large Exchange files...
priv1.edb 2.8Gb
priv1.stm 8.3Gb

However, I have noticed today that I also have approx 12Gb of log files on
another drive (e.g. E0008EDA.log), and the vast majority of these are from
Sunday 7th December.

Can somebody explain what is going on ?
I thought the log files were deleted once they were backed up ?
How can I have 12Gb of log files from a day when the server was barely used
?


Ian.

fbrown
Mon Dec 08 07:49:49 CST 2003

You may want to review the following article to verify you're not an open
relay:

324958 HOW TO: Block Open SMTP Relaying and Clean Up Exchange Server SMTP
http://support.microsoft.com/?id=324958

You may also want to verify that someone is not using an account on your
system to relay messages:

1st enable diagnostic logging on the server -- Exchange system manager,
drill down to your server and display the properties page of the server.
Click the diagnostic logging tab and click the MSExchangeTransport service.
Click the smtp protocol and change the logging level to Maximum. Then
restart the smtp service

Once restarted check the application log for event ID 1708 which will be
any authentication attempt to the Exchange server. Review of the event
will give you the username that may be being used for relay -- change the
password for that account and that should shut down the relay. You may
also want to review your password policy and force your users to change
their passwords to include alphnumeric characters as well as special
characters to prevent passwords from being cracked.

Regards,

Frank Brown
Microsoft Small Business Server Support

This posting is provided "AS IS" with no warranties, and confers no rights.

Marina
Mon Dec 08 15:07:26 CST 2003

You are not doing anything with the M-drive, right? You don't scan it, you
don't backup it.

Marina

"Ian Sime" <iansime@hotmail.com> schreef in bericht
news:br1q4k$rf1$1$8302bc10@news.demon.co.uk...
> Let me start by admitting that I don't take good enough care of my SBS
2000
> box - that should avoid the 'serves you right' replies :-)
>
> I have SBS 2000 serving approx 35 employees, and I back the server up
using
> Backup Exec 9.0. I run a FULL backup each weekday night.
>
> I have 2 large Exchange files...
> priv1.edb 2.8Gb
> priv1.stm 8.3Gb
>
> However, I have noticed today that I also have approx 12Gb of log files on
> another drive (e.g. E0008EDA.log), and the vast majority of these are from
> Sunday 7th December.
>
> Can somebody explain what is going on ?
> I thought the log files were deleted once they were backed up ?
> How can I have 12Gb of log files from a day when the server was barely
used
> ?
>
>
> Ian.
>
>

Ian
Tue Dec 09 02:46:30 CST 2003

Marina - No, I am not backing up or virus-scanning the M: drive (although I
did check just to make extra-extra-sure !).

When I checked this morning, virtually all of the log files are gone.

I will therefore check out the document mentioned by Frank, just to ensure
that the server is not acting as an open relay. I am pretty sure I have
checked this in the past, but I will do so again and report back.

Thanks for the help so far.

Ian.

Ian
Tue Dec 09 03:56:51 CST 2003

* Bows head in shame *
Marina - I have an admission to make. It appears that I WAS scanning the M:
drive every Sunday.

What is frustrating is that I knew this was a bad idea, and I deliberately
set out to avoid doing this. The Symantec Client software on the server was
set to never scan the M: drive.
However, I hadn't banked on the Symantec Server software doing it's own
thing, and setting up a scan job for ALL drives (including M:) for each
Sunday.

Many thanks for your help Marina and Frank.


Ian.

Marina
Tue Dec 09 08:32:18 CST 2003

Hi Ian,

Glad you've got it solved now. No need to bow your head though. We all make
stupid mistakes sometimes.

Marina

"Ian Sime" <iansime@hotmail.com> schreef in bericht
news:br466s$ok6$1$8300dec7@news.demon.co.uk...
> * Bows head in shame *
> Marina - I have an admission to make. It appears that I WAS scanning the
M:
> drive every Sunday.
>
> What is frustrating is that I knew this was a bad idea, and I deliberately
> set out to avoid doing this. The Symantec Client software on the server
was
> set to never scan the M: drive.
> However, I hadn't banked on the Symantec Server software doing it's own
> thing, and setting up a scan job for ALL drives (including M:) for each
> Sunday.
>
> Many thanks for your help Marina and Frank.
>
>
> Ian.
>
>