Exchange 2010 – Working with Exmon

I ran into an issue recently where we noticed that an Exchange volume was increasing with size at an alarming rate. Digging into the matter more discovered that the log folder had, get ready for this over 700K logs. So yes do the math, with each log being 1mb in size that came to over 700GB worth of logs. So the next thing was to find out what was causing this or who was causing this.

This is where Exmon came in handy for now we could track down which mailbox (if any) was causing this. The next thing that is going to be important for you to figure out is what columns are important. Well the CPU usage which is the % of resources out of 100 that a particular user is using of the Exchange store.

The second thing that was important was the Log bytes column which tells you how many logs that particular person is generating on the Exchange server. If you find a particular user that has a out of the ordinary high count in the log bytes column you should look into it for that could be your answer.


So now that you have identified the user now what?  There are two options you can try, 1) You can try to move that user to another database and see if the issue follows the user.  2) Have the user recreate his profile.  Now why would you have the user recreate his profile?  Because a message is corrupt in his mailbox which is causing the excessive logs files in the log folder of your storage location.  Another thing you can do to confirm that you have found the problem user is have the user close out of outlook and look at Exmon again.  If you notice that the selected user drops off the CPU usage column and their Log bytes goes to O, then you might have identified your user.   What we did was look in the log folder and see if your logs stop increasing at the alarming rate once the user shuts down outlook.

Hopefully this helps you out.

Byron Spurlock


0 Responses to “Exchange 2010 – Working with Exmon”

  1. Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s


%d bloggers like this: