• Facebook
  • RSS Feed
  • Instagram
  • LinkedIn
  • Twitter
Apr 212010
In Exchange 2007 a strange issue was noticed by a customer a few weeks ago. After some deep research, and testing the strange behaviour became explainable. Let me explain it to you :
The customer created a brand new Exchange database, with a single user. They inserted 10,000 messages (using a random message generator), they archived them with Enterprise Vault, and then they deleted the shortcuts.
Following this they took the database offline, and did an offline defrag of the database.
Afterwards, their database was still 47 Mb, versus the 4 Mb when it was created. The question is why

In the screenshot you can see that one table stands out as taking up space still.  This is the MDB Event History table.

After some digging (see the references below), it was discovered that this table keeps track of changes that are “interesting” from a content indexing point of view.  By default they are kept for 7 days.  You can change this, and after a run of nightly maintenance then the space will be reclaimed.  An offline defrag would THEN get all the space back.

If for example, you set the retention period to 15 hours, the next time online maintenance runs (normally nightly in Exchange 2007, and instantly in Exchange 2010, provided Background Database Maintenance is enabled) when the the whitespace is collected together to give “bigger chunks” (reported in the 1221 event) the Event History table is also trimmed down.

An offline defrag won’t affect this table.

Turning off content indexing for the information store won’t affect this.

The only thing that you can do is reduce the retention period and/or live with the situation, because it is a natural part of Exchange 2007, and Exchange 2010.

References :

If you enjoyed this post, please consider leaving a comment or subscribing to the RSS feed to have future articles delivered to your feed reader.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>