skip to Main Content

Truncate Exchange logs with PowerShell

The Exchange logs disk is getting full, and you want to truncate Exchange logs without a backup. If you enable circular logging to clear Exchange database transaction logs, you have to unmount and mount the database before changes take effect. What if there is a way to remove Exchange database logs without unmounting and mounting the database? In this article, you will learn how to truncate Exchange database logs with PowerShell.

Information

Before we start, it’s good to know that Exchange database logs should truncate when a backup is running. If it didn’t run properly, you have to troubleshoot and see what is going on. Sometimes you don’t have the time, and the disk is getting full, and you need a temporary fix to clear the Exchange database logs.

There are a couple of ways to do that:

  1. Enable circular logging, dismount database, mount database
  2. VSSTester PowerShell script

Both options will do the same in the end, that’s truncating the Exchange database logs. But, there is a significant difference in how they do it.

With option one, you have to unmount and mount the database, which leads to disruption to the users. If the mailbox database is big and there are terabytes of logs, this will take time. You have to do it after work hours unless you have a DAG and do a server switchover.

Option two will keep the database mounted. It means that the database will not go offline, and the users don’t get any disruptions. It will also create a snapshot of the database and logs volume.

Before running the script

At the moment, the mailbox database log volume shows that only 1,40 GB is free.

Truncate Exchange logs with PowerShell disk full

Prepare truncate Exchange logs PowerShell script

Download VSSTester.ps1 PowerShell script from GitHub or here (direct). At the moment of writing, the latest version is VSSTester 1.2. Save it on the Exchange Server. Create a scripts folder on the C: drive and place the script in C:\scripts.

Scripts folder

Truncate Exchange logs with PowerShell script

Start PowerShell as administrator and run VSSTester.ps1PowerShell script. The VSSTester script version 1.2 for Exchange 2010, 2013, 2016 shows.

PS C:\> C:\scripts\.\VSSTester.ps1

****************************************************************************************
****************************************************************************************
**                                                                                    **
**             VSSTESTER SCRIPT VERSION 1.2 (for Exchange 2010, 2013, 2016)           **
**                                                                                    **
****************************************************************************************
****************************************************************************************



Saturday, October 17, 2020 7:02:38 PM


Please select the operation you would like to perform from the following options:


  1. Test backup using built-in Diskshadow
  2. Enable logging to troubleshoot backup issues


Selection:

After the script started, we do have two options. The one that we are looking for is option 1. Test backup using built in Diskshadow.

Insert 1 and press Enter.

PS C:\> C:\scripts\.\VSSTester.ps1

****************************************************************************************
****************************************************************************************
**                                                                                    **
**             VSSTESTER SCRIPT VERSION 1.2 (for Exchange 2010, 2013, 2016)           **
**                                                                                    **
****************************************************************************************
****************************************************************************************



Saturday, October 17, 2020 7:02:38 PM


Please select the operation you would like to perform from the following options:


  1. Test backup using built-in Diskshadow
  2. Enable logging to troubleshoot backup issues


Selection: 1

Specify a directory path, for example, C:\temp\ and press Enter.

Please specify a directory other than root of a volume to save the configuration and output files.
Directory path (e.g. C:\temp): C:\temp\

It will verify the Exchange Server version and the VSS writer status. After that, it will check which mailbox databases are available and ask us which one to backup. In my example, we like to clear the logs of the mailbox database DB02, which is number 1. Type 1 and press Enter.

Saturday, October 17, 2020 7:09:39 PM
Getting Server name...

--------------------------------------------------------------------------------------------------------------

EX01-2016


Saturday, October 17, 2020 7:09:39 PM
Verifying Exchange version...

--------------------------------------------------------------------------------------------------------------

EX01-2016 is an Exchange 2016 server.


Saturday, October 17, 2020 7:09:43 PM
Checking VSS Writer Status: (All Writers must be in a Stable state before running this script)

--------------------------------------------------------------------------------------------------------------

Writer name: 'Task Scheduler Writer'
   State: [1] Stable

Writer name: 'VSS Metadata Store Writer'
   State: [1] Stable

Writer name: 'Performance Counters Writer'
   State: [1] Stable

Writer name: 'System Writer'
   State: [1] Stable

Writer name: 'ASR Writer'
   State: [1] Stable

Writer name: 'Registry Writer'
   State: [1] Stable

Writer name: 'Shadow Copy Optimization Writer'
   State: [1] Stable

Writer name: 'COM+ REGDB Writer'
   State: [1] Stable

Writer name: 'IIS Metabase Writer'
   State: [1] Stable

Writer name: 'IIS Config Writer'
   State: [1] Stable

Writer name: 'Microsoft Exchange Writer'
   State: [1] Stable

Writer name: 'MSMQ Writer (MSMQ)'
   State: [1] Stable

Writer name: 'WMI Writer'
   State: [1] Stable

Writer name: 'BITS Writer'
   State: [1] Stable



Saturday, October 17, 2020 7:09:45 PM
Getting databases on server: EX01-2016

--------------------------------------------------------------------------------------------------------------


Number Name Mounted Server
------ ---- ------- ------
     0 DB01    True EX01-2016
     1 DB02    True EX01-2016





Select the number of the database to backup : 1

Check which drive is not in use. In our example, drive X: is not in use, and that’s what we will use. Enter X: and press Enter.

The database guid for 'DB02' is: 313554ce-1503-4f81-8796-4ab0764d80c2

The database is mounted on server: EX01-2016

Saturday, October 17, 2020 7:15:58 PM
Status of 'DB02' and its replicas (if any)

--------------------------------------------------------------------------------------------------------------

DB02\EX01-2016 is Mounted



Saturday, October 17, 2020 7:15:58 PM
Creating diskshadow config file...

--------------------------------------------------------------------------------------------------------------


The selected database path is 'G:\DB02\DB02.edb' so adding volume G: to backup scope


The selected database log folder path is 'H:\DB02' so adding volume H: to backup scope



Adding the volume for DSH file
add volume G: alias vss_test_G
Adding the volume for DSH file
add volume H: alias vss_test_H


Saturday, October 17, 2020 7:15:58 PM
Getting drive letters for exposing backup snapshot
--------------------------------------------------------------------------------------------------------------


Since different volumes are used for this database's EDB and logs, we need two drive
letters to expose the backup snapshot.


Enter an unused drive letter with colon (e.g. X:) to expose the DATABASE volume : X:

This time it asks for an unused drive letter for the log volume. We will use drive letter Y: because it’s not in use and press Enter.

Enter an unused drive letter with colon (e.g. Y:) to expose the LOG volume : Y:


Saturday, October 17, 2020 7:18:48 PM
Enabling Diagnostics Logging...

--------------------------------------------------------------------------------------------------------------

MSExchange Repl\Service  -  Expert

MSExchange Repl\Exchange VSS Writer  -  Expert


Saturday, October 17, 2020 7:18:49 PM
Enabling VSS Tracing...

--------------------------------------------------------------------------------------------------------------

The command completed successfully.

Saturday, October 17, 2020 7:18:49 PM
Enabling ExTRA Tracing...

--------------------------------------------------------------------------------------------------------------


LastWriteTime : 10/17/2020 7:18:49 PM
Length        : 0
Name          : EnabledTraces.Config



Creating Exchange Trace data collector set...
The command completed successfully.
Starting Exchange Trace data collector...
The command completed successfully.



Saturday, October 17, 2020 7:18:49 PM
Starting DiskShadow copy of Exchange database: DB02

--------------------------------------------------------------------------------------------------------------

Running the following command:

"C:\Windows\System32\diskshadow.exe /s C:\temp\\diskshadow.dsh /l C:\temp\\diskshadow.log"


Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  EX01-2016,  10/17/20 19:18:49

-> set verbose on
-> set context persistent
->
-> writer exclude {e8132975-6f93-4464-a53e-1050253ae220}
-> writer exclude {2a40fd15-dfca-4aa8-a654-1f8c654603f6}
-> writer exclude {35E81631-13E1-48DB-97FC-D5BC721BB18A}
-> writer exclude {be000cbe-11fe-4426-9c58-531aa6355fc4}
-> writer exclude {4969d978-be47-48b0-b100-f328f07ac1e0}
-> writer exclude {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
-> writer exclude {afbab4a2-367d-4d15-a586-71dbb18f8485}
-> writer exclude {59b1f0cf-90ef-465f-9609-6ca8b2938366}
-> writer exclude {542da469-d3e1-473c-9f4f-7847f01fc64f}
-> writer exclude {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
-> writer exclude {41e12264-35d8-479b-8e5c-9b23d1dad37e}
-> writer exclude {12ce4370-5bb7-4C58-a76a-e5d5097e3674}
-> writer exclude {cd3f2362-8bef-46c7-9181-d62844cdc062}
-> writer exclude {dd846aaa-A1B6-42A8-AAF8-03DCB6114BFD}
-> writer exclude {B2014C9E-8711-4C5C-A5A9-3CF384484757}
-> writer exclude {BE9AC81E-3619-421F-920F-4C6FEA9E93AD}
-> writer exclude {F08C1483-8407-4A26-8C26-6C267A629741}
-> writer exclude {6F5B15B5-DA24-4D88-B737-63063E3A1F86}
-> writer exclude {368753EC-572E-4FC7-B4B9-CCD9BDC624CB}
-> writer exclude {5382579C-98DF-47A7-AC6C-98A6D7106E09}
-> writer exclude {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
-> writer exclude {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
-> writer exclude {0bada1de-01a9-4625-8278-69e735f39dd2}
-> writer exclude {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
->
-> writer exclude "Microsoft Exchange Writer:\Microsoft Exchange Server\Microsoft Information Store\EX01-2016\e18b64
16e-4bb8-bac2-a06b14ae35c7"
->
-> Begin backup
-> add volume G: alias vss_test_G
-> add volume H: alias vss_test_H
-> create

COM call "lvssObject4->GetRootAndLogicalPrefixPaths" failed.
Component "\Microsoft Exchange Server\Microsoft Information Store\EX01-2016\e18b648d-916e-4bb8-bac2-a06b14ae35c7" fr
riter "Microsoft Exchange Writer" is explicitly excluded.
Component "\config\sysq" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it requires volume C:\ which is not in the shadow copy set.
Component "\config\registry" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it requires volume C:\ which is not in the shadow copy set.
Component "\config\mapping" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it requires volume C:\ which is not in the shadow copy set.
Component "\storage\queue" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it requires volume C:\ which is not in the shadow copy set.
Component "\Microsoft Exchange Server\Microsoft Information Store\EX01-2016\e18b648d-916e-4bb8-bac2-a06b14ae35c7\Fil
rom writer "Microsoft Exchange Writer" is excluded from backup,
because it requires volume E:\ which is not in the shadow copy set.
Component "\Microsoft Exchange Server\Microsoft Information Store\EX01-2016\e18b648d-916e-4bb8-bac2-a06b14ae35c7\Log
rom writer "Microsoft Exchange Writer" is excluded from backup,
because it requires volume F:\ which is not in the shadow copy set.
Component "\config" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it has an excluded descendent: "sysq".
Component "\storage" from writer "MSMQ Writer (MSMQ)" is excluded from backup,
because it has an excluded descendent: "queue".
Component "\Microsoft Exchange Server\Microsoft Information Store\EX01-2016\e18b648d-916e-4bb8-bac2-a06b14ae35c7" fr
riter "Microsoft Exchange Writer" is excluded from backup,
because it has an excluded descendent: "File".
The writer "MSMQ Writer (MSMQ)" is now entirely excluded from the backup,
because it does not contain any components that can be included.

* Including writer "Microsoft Exchange Writer":
        + Adding component: \Microsoft Exchange Server\Microsoft Information Store\EX01-2016\313554ce-1503-4f81-8796
0764d80c2

Alias vss_test_G for shadow ID {b4ba1ded-6ed4-46b1-8f13-9cce0de8ee71} set as environment variable.
Alias vss_test_H for shadow ID {02c7fb75-39c3-4b97-9f43-2b26933ad5ec} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {406ad2fd-7850-48b4-b1e1-c49c4aa41606} set as environment variable.
Inserted file Manifest.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file BCDocument.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM0.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM1.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM2.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM3.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM4.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM5.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM6.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM7.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM8.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM9.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM10.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM11.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM12.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file WM13.xml into .cab file 20-10-17_-18-58_EX01-2016.cab
Inserted file diskshadow.log into .cab file 20-10-17_-18-58_EX01-2016.cab

Querying all shadow copies with the shadow copy set ID {406ad2fd-7850-48b4-b1e1-c49c4aa41606}

        * Shadow copy ID = {b4ba1ded-6ed4-46b1-8f13-9cce0de8ee71}               %vss_test_G%
                - Shadow copy set: {406ad2fd-7850-48b4-b1e1-c49c4aa41606}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 2
                - Original volume name: \\?\Volume{b050fa5e-48f1-4941-bde7-c8175378669e}\ [G:\]
                - Creation time: 17/10/2020 19:18:58
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
                - Originating machine: EX01-2016.exoip.local
                - Service machine: EX01-2016.exoip.local
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  No_Auto_Release Persistent Differential

        * Shadow copy ID = {02c7fb75-39c3-4b97-9f43-2b26933ad5ec}               %vss_test_H%
                - Shadow copy set: {406ad2fd-7850-48b4-b1e1-c49c4aa41606}       %VSS_SHADOW_SET%
                - Original count of shadow copies = 2
                - Original volume name: \\?\Volume{114715bf-ed89-4814-ac77-d82735a68f92}\ [H:\]
                - Creation time: 17/10/2020 19:18:58
                - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
                - Originating machine: EX01-2016.exoip.local
                - Service machine: EX01-2016.exoip.local
                - Not exposed
                - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
                - Attributes:  No_Auto_Release Persistent Differential

Number of shadow copies listed: 2
->
-> expose %vss_test_G% X:
-> %vss_test_G% = {b4ba1ded-6ed4-46b1-8f13-9cce0de8ee71}
The shadow copy was successfully exposed as X:\.
-> expose %vss_test_H% Y:
-> %vss_test_H% = {02c7fb75-39c3-4b97-9f43-2b26933ad5ec}
The shadow copy was successfully exposed as Y:\.
-> end backup
->

Saturday, October 17, 2020 7:19:00 PM
Disabling ExTRA Tracing...

--------------------------------------------------------------------------------------------------------------


Stopping Exchange Trace data collector on EX01-2016...
The command completed successfully.
Deleting Exchange Trace data collector on EX01-2016...
The command completed successfully.



Saturday, October 17, 2020 7:19:01 PM
Disabling Diagnostics Logging...

--------------------------------------------------------------------------------------------------------------

MSExchange Repl\Service  -  Lowest

MSExchange Repl\Exchange VSS Writer  -  Lowest


Saturday, October 17, 2020 7:19:01 PM
Disabling VSS Tracing...

--------------------------------------------------------------------------------------------------------------

The command completed successfully.


Saturday, October 17, 2020 7:19:01 PM
Checking VSS Writer Status: (after backup)

--------------------------------------------------------------------------------------------------------------


Writer name: 'Task Scheduler Writer'
   State: [1] Stable

Writer name: 'VSS Metadata Store Writer'
   State: [1] Stable

Writer name: 'Performance Counters Writer'
   State: [1] Stable

Writer name: 'System Writer'
   State: [1] Stable

Writer name: 'ASR Writer'
   State: [1] Stable

Writer name: 'IIS Config Writer'
   State: [1] Stable

Writer name: 'IIS Metabase Writer'
   State: [1] Stable

Writer name: 'Registry Writer'
   State: [1] Stable

Writer name: 'Microsoft Exchange Writer'
   State: [1] Stable

Writer name: 'BITS Writer'
   State: [1] Stable

Writer name: 'Shadow Copy Optimization Writer'
   State: [1] Stable

Writer name: 'COM+ REGDB Writer'
   State: [1] Stable

Writer name: 'WMI Writer'
   State: [1] Stable

Writer name: 'MSMQ Writer (MSMQ)'
   State: [1] Stable


Saturday, October 17, 2020 7:19:06 PM
Diskshadow Snapshots

--------------------------------------------------------------------------------------------------------------


If the snapshot was successful, the snapshot should be exposed as drive(s) X: and Y:.
You should be able to see and navigate the snapshot with File Explorer. How would you like to proceed?

When ready, choose from the options below:

  1. Remove exposed snapshot now
  2. Keep snapshot exposed

WARNING: Selecting option 1 will permanently delete the snapshot created, i.e. your backup will be deleted.

Selection :

Start File Explorer and have a look at the X: and Y: drives.

Truncate Exchange logs with PowerShell script snapshot

Select option 1 and press Enter to delete the snapshot.

Selection : 1

LastWriteTime : 10/17/2020 7:26:44 PM
Length        : 0
Name          : removeSnapshot.dsh

Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  EX01-2016,  10/17/20 19:26:44

-> delete shadows exposed X:
Deleting shadow copy {b4ba1ded-6ed4-46b1-8f13-9cce0de8ee71} on volume \\?\Volume{b050fa5e-48f1-4941-bde7-c8175378669e}\
from provider {b5946137-7b9f-4925-af80-51abd60b20d5} [Attributes: 0x00120009]...

1 shadow copy deleted.
-> delete shadows exposed Y:
Deleting shadow copy {02c7fb75-39c3-4b97-9f43-2b26933ad5ec} on volume \\?\Volume{114715bf-ed89-4814-ac77-d82735a68f92}\
from provider {b5946137-7b9f-4925-af80-51abd60b20d5} [Attributes: 0x00120009]...

1 shadow copy deleted.
-> exit

Saturday, October 17, 2020 7:26:44 PM
Getting events from the application and system logs since the script's start time of (10/17/2020 19:02:38)

--------------------------------------------------------------------------------------------------------------

Getting application log events...
Getting system log events...
Getting events complete!


Saturday, October 17, 2020 7:26:49 PM
Stopping transcript log...

--------------------------------------------------------------------------------------------------------------

Transcript stopped, output file is C:\temp\vssTranscript.log



Please use the  key to exit...:

Press Enter to exit the PowerShell script.

Verify Exchange database logs

Verify that the snapshots are removed and that the logs are cleared.

Truncate Exchange logs with PowerShell logs disk cleared

Open the database log volume and verify that Exchange database truncation is completed successfully.

Truncate Exchange logs with PowerShell check database logs

It’s looking great. Did this help you to truncate Exchange database logs without a backup?

Keep reading: Install FREE Let’s Encrypt certificate in Exchange Server »

Conclusion

You learned how to truncate Exchange database logs with PowerShell. The script is excellent if a high spike suddenly comes in, and the transaction logs are growing very fast. Or if the backup all of a sudden is not working.

Use the PowerShell script to clear Exchange database logs safely. The changes are applied immediately. There is no need to unmount and mount the database. That’s great because you will not disrupt any users.

Did you enjoy this article? You may also like Move Exchange 2016 database to another drive. Don’t forget to follow us and share this article.

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has 2 Comments

  1. Mooi en duidelijk artikel Ali!
    Ik kan me herinneren dat we dit ooit (2 jaar geleden?) handmatig moesten doen bij een klant van ons op de KG. De maildataschijven liepen vaak vol door niet getruncated exchange logs ?
    Dit had veel tijd gescheeld bij de oplossing doorvoeren (hadden we dit eerder geweten) ?
    Bij een volgende keer kunnen we de Powershell oplossing toepassen, scheelt weer tijd ?
    Groet, Cor

Leave a Reply

Your email address will not be published. Required fields are marked *

Back To Top