How to remove Exchange log files?
These files really eat up my storage.
I've been diagnosing for the past day or so some issues with an Exchange 2019 server related to Antimalware filtering/scanning. This was disabled on our server, I enabled it, and restarted the transport service per the Microsoft docs:
- https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/antimalware-protection/antimalware-procedures?view=exchserver-2019#use-the-exchange-management-shell-to-enable-or-disable-malware-filtering-on-mailbox-servers
- https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/antimalware-protection/download-antimalware-updates?view=exchserver-2019
In Event Viewer, however, we're getting some logs that indicate this isn't working:
Event 6031, FIPFS: MS Filtering Engine Update process has successfully downloaded updates for Microsoft.
Event 6034, FIPFS: MS Filtering Engine Update process is testing the Microsoft scan engine update
Event 6035, FIPFS: MS Filtering Engine Update process was unsuccessful in testing an engine update.
Engine: Microsoft
It looks like it fails for some reason and logs "MS Filtering Engine Update process was unsuccessful in testing an engine update."
Then the process repeats and we can see it trying again:
Event 7003, FIPFS: MS Filtering Engine Update process has successfully scheduled all update jobs.
Event 6024, FIPFS: MS Filtering Engine Update process is checking for new engine updates.
Scan Engine: Microsoft
Update Path: http://amupdatedl.microsoft.com/server/amupdate
Event 6030, FIPFS: MS Filtering Engine Update process is attempting to download a scan engine update.
Scan Engine: Microsoft
Update Path: http://amupdatedl.microsoft.com/server/amupdate.
Event 6031, FIPFS: MS Filtering Engine Update process has successfully downloaded updates for Microsoft.
Event 6034, FIPFS: MS Filtering Engine Update process is testing the Microsoft scan engine update
Event 6035, FIPFS: MS Filtering Engine Update process was unsuccessful in testing an engine update.
Engine: Microsoft
The configuration settings look fine and we've allowed both amupdatedl.microsoft.com and forefrontdl.microsoft.com through the firewall. (It appears that's working because it says downloaded successfully in the Event Viewer logs.)
Any ideas / help would be much appreciated! Thank you!
Edit: One other note, it does seem to be trying to download and use some of the scan engine updates as evidenced by this staging folder here with recent timestamps.
I also found some other resources that suggested a permissions issue, but I checked and Network Service has full permissions to E:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Data
Things I've looked at:
- https://social.technet.microsoft.com/Forums/en-US/832e155e-054a-4e1c-8ce0-41a778abe8ff/exchange-2016-cu11-antimalware-automatic-update-fails?forum=Exch2016MFSM
- http://www.networksteve.com/exchange/topic.php/Error_of_Get-EngineUpdateInformation_in_Exchange_2013/?TopicId=56872&Posts=3
- https://martijnwestera.blogspot.com/2015/08/exchange-2013-built-in-anti-malware-ms.html
- https://www.reddit.com/r/exchangeserver/comments/2kvxj5/updating_antimalware_engine_in_ex2013cu6/
- https://docs.microsoft.com/en-us/archive/blogs/ehlro/exchange-2013-malware-engine-updates-troubleshooting
- https://social.technet.microsoft.com/Forums/lync/en-US/09b9b26e-5898-42de-958d-ab967398bab8/error-id-6027-ms-filtering-engine-update-process-was-unsuccessful-in-contacting-the-primary-update?forum=exchangesvrgeneral
- https://docs.microsoft.com/en-us/exchange/download-engine-and-definition-updates-exchange-2013-help?redirectedfrom=MSDN
Overview:
We have a demo environment where we have installed Exchange 2019. The Exchange 2019 server is set up in Classic Hybrid mode with centralised mail transport enabled. Inbound emails are successfully flowing through Office 365 to our on-premise Exchange mailboxes. However, outbound messages (sent from on an on-premise mailbox) is not received by external recipients.
Steps to reproduce:
- An external user sends an email to [email protected] (i.e. EOP mailbox).
- Mia replies to the email.
- The external recipient never receives the email.
Troubleshooting done so far:
- In OWA there is no indication that the email was not sent, or will not be delivered. The outbound email is sitting in the Sent folder.
- Within EXO Exchange Admin Center Mail Trace reports do not show any outbound messages leaving Mia's mailbox.
Question(s):
- Exchange hybrid was configured by following this YouTube video thread. Are there any steps the trainer has missed?
- Where can I go to begin troubleshooting why the outbound email from EOP is not sending?
I have just deployed a new instance of Exchange 2019. Active Sync works fine (outlook and owa) and mail is processed ingress/egress fine. After enabling the IMAP services and associating the self signed certificate with the IMAP service, I fail to sync successfully from outlook client on MacOS.
[Configuration Info]
InternalConnectionSettings : {myMailServer.fqdn:993:SSL, myMailServer.fqdn:143:TLS}
Status Name DisplayName
Running MSExchangeIMAP4 Microsoft Exchange IMAP4 Running MSExchangeIMAP4BE Microsoft Exchange IMAP4 Backend
[Mail Client Settings] Incoming server: myMailServer.fqdn:993 (Use SSL to connect) Outgoing server: myMailServer.fqdn:587 (Use SSL to connect)
[ECP Receive Connector Configuration] Client Frontend Authentication Settings
- Transport Layer Security - enabled
- Basic Authentication - enabled
- Integrated Windows authentication - enabled
- Exchange Server authentication Permission Groups
- Exchange users - enabled
- Anonymous users - enabled
Scope
- both IPv4 and IPv6 - left defaults unchanged
- port 587 - default unchanged for IPv4 and IPv6
Not quiet sure why the client can connect to the exchange server with the IMAP settings but not sync inbound email or send an email (sitting in outbox). I could not see anything obvious in the event logs or logs in the exchange installation path. Any suggestions you could offer in troubleshooting this would be appreciated.
Best regards - Les
Due to a software dependency, I have an odd requirement in my environment, while trying to clean up stale accounts. I want to remove all the stale AD Users and Exchange mailboxes from the environment, however, I need to somehow reserve the SMTP Address for the stale account, so that the address cannot be assigned to another mailbox later (maybe a new user with the same name). I'm looking for the best strategy. technical details are not my concern.
I've ended up with the below two strategies (I think still there must be a better way, please advise):
convert each mailbox to a contact. Steps:
- remove mailbox (this will also delete the AD user)
- create a contact with the email address of the deleted mailbox Cons: not much cleanup! because each object is actually replaced by another object.
preserve all email addresses by adding each as a proxy address for a dummy user. Steps:
- remove mailbox (this will also delete the AD user)
- add the email address of the deleted mailbox as a proxy (additional) address into a dummy mailbox Cons: I have more than 6000 stale mailboxes. in exchange 2019 you can have ~1000 addresses per object.
another approach might be a "Disable-and-then-Enable-mailbox" strategy, which will remove all the old mailbox contents, preserves the address, and also preserve the user account. like the <1> method mentioned earlier, it actually does not clean up much.
What do you think is the best way to preserve a lot of email addresses in the Exchange Server (or Active Directory), and avoid those addresses from being assigned to new users after the original mailbox is deleted?