Do I have a worm on my server? 2

[timoteo]

I am starting to think I have a worm on my Exchange 2000 server. For the second time in a week the C: drive has filled up. And I am getting some strange messages in the application log. For example, Event ID 482 "An attempt to write to the file C:..E00tmp.log failed, their is not enough space on the disk.

I have scanned with an Symantec Anti Virus (with the latest definitions) and it did not find and thing.

Does anyone know what is wrong?

Thanks in advance for any advice.

Timoteo

 

[Davetoo]

Are you backing up your server on a regular basis with an Exchange aware program?

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[timoteo]

lander215

No, I am not currently backing up my Exchange data.

 

[Davetoo]

Then it's most likely your log files taking up all the space.

Take a look at your \exchsrvr\mdbdata folder...lots of files in there about 5MB each?

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[timoteo]

lander215,

You are right. I have about 11GB of files named sequentially E0000001, E0000002, etc. going back to 2002 when the Exchange was first installed.

Is it safe to delete them to recover space?

 

[rphips]

timoteo

Yes it safe to remove them but I would leave at least a weeks worth in the directory. Also you need to go to your service manager under administrative tools and under server click properties and set how long you want exchange to keep the files. I have a lot of space so I keep 3 weeks worth



bob

"ZOINKS !!!!!"

Shaggy

 

[timoteo]

rphips,

Thanks for the information. I did as you suggested, but when I got to the service manager it was already set to save the logs for 7 days. Why do I have 2 years worth of logs?

Timoteo

 

[rphips]

timoteo

When I first started exchange it did the same thing so I back it down to 3 days removed the files and rebooted the system. And it that worked. Then I reset the days and now it removes the log automatically.



bob

"ZOINKS !!!!!"

Shaggy

 

[rphips]

timoteo

Also what ever you do DO NOT REMOVE the E00, PRIV1, PUB1, RES1, or the temp files

bob

"ZOINKS !!!!!"

Shaggy