Shrinking the Information Store in Exchange When ESEUTIL Doesn't Do It

I recently ran into a problem where after running ESEUTIL /d, the Information Store was still over the 75GB limit that you can expand to in Exchange 2003 Standard SP2. As a refresher, the total size of the Information Store is the EDB + STM, this is what Exchange looks at when it calculates the size of the Information Store.

I'll list a general outline that most people do to clear up "whitespace" in Exchange.

1. Increase the Information Store limit in Exchange via the registry: http://www.petri.co.il/change_store_size_limits_ex2003_sp2.htm
   
2. Archive and then Delete unneeded mailboxes in Exchange
   
3. Run an offline Defrag: Unmount Information Store and run eseutil /d infostore.edb

At this point, the information store is usually reduced and users and admins are happy. But what if the information store is still too big, or too close to the limit? What if you just want to know the size of "whitespace" on the information store before you do the defrag?


Check to see how much whitespace you have in the information store.

Whitespace is the empty space left over in the information store after data has been removed from it. I like to compare it to someone getting really fat, and then all of a sudden losing a lot of weight. Once this happens, there's a lot of loose skin. The loose skin needs to be tightened up again. Well the "space" between the loose skin is "whitespace", and we need to remove it to make the body tight again. Yes, weird analogy, but it's how I remember it. Let's get to how to check whitespace in Exchange 2003. A good article on whitespace can be found here: http://www.msexchange.org/articles/Exchange-Databases-Disk-Consumption.html

1. Navigate to where you have eseutil installed (if you haven't adjusted the path so you can type it anywhere in DOS)
2. Go into Exchange System Manager ("ESM"), and dismount the target 4store.
3. Run the following command: eseutil /ms infostore.edb > sizecheck.txt
/m = filedump mode
/s = streaming file
> = send the output to
4. Check out the file sizecheck.txt, and look a line that says "Free", note the number, and the last number at the end of the file, but before the line that says "Operation Completed in 'x' seconds", note this number too.
Free: 24093
234234

The first number is the SLV Space Dump for the STM file.
The second number is the Space Dump for the EDB file.

Take the SLV Space Dump File and multiply by 4096 bytes
Take the Space Dump for EDB and multiply by 4096 bytes

ex.
24093 x 4096 bytes = 98684928 bytes = 94.1132812 megabytes of Whitespace
234234 x 4096 bytes = 959422464 bytes = 914.976562 megabytes of Whitespace

914.976562 mb
+ 94.1132812 mb
---------------------------
1009.0898432 mb = 0.9854393 gigabytes ~ 1GB

As you can see, by running this offline defrag check, we would be able to regain about 1GB of space off of our Information Store if we ran a real offline defrag. It's important to note that the commands above do not defrag the Exchange Information Store, it's read-only and only calculating and dumping statistics. But, what happens if we still need more space? One clue to this is by adding up the EDB and STM files and comparing that to the sum of the size of all the mailboxes. If you're lucky, you'll see that the sum of all the mailbox sizes is LESS than the information store size. Hmmm....what's taking up the rest of the space then? The answer is Recoverable Items.

Recoverable Items

Recoverable Items are really deleted-deleted items. You have an email, you delete it, and it goes to the deleted items folder. You empty you're deleted items. You have just deleted-deleted items. But wait...They aren't deleted. Oh, Snap!

In Exchange 2003 Recoverable Items, aka "Deleted Items Recovery" is enabled by default. It's 7 days for deleted email, and 30 days for deleted accounts. If you do the numbers, this can be a whole lot of email that's added up. So, how do you add it all up? You don't have to, Microsoft will do it for you, in the MMC.

1. Go to Performance Monitor
2. Remove all the items there by clicking on "-"
3. Click on the "+" to add an item
4. Find MS Exchange Mail, then choose Total Size of Recoverable Items
5. Click on the paper with the lines on it to give you numbers. This will tell you the size of recoverable items in the information store in kilobytes.

Another old school way, is to open up ESM. Click on Mailboxes. Go to view, and add the "Deleted" tab. You can now see exactly what user tends to have a lot of deleted items, or add all the mailboxes up manually to get the total sum of recoverable items taking up space on the Information Store.


Removing Recoverable Deleted-Deleted Items

Now you know how to find out how much whitespace you have on the Information Store and how much Recoverable Items space is in the Information Store. How do you regain the space on the Recoverable Items? Well, just doing an offline defrag will NOT clear this up. To get this done really soon across the entire information store:
1. Open up ESM
2. Right click on the Mail Store, and go to Properties
3. Find the Limits tab, and click on it
4. Change "Keep deleted items for" and "Keep deleted mailboxes for" to "0" for both. Click Apply.
5. Find the Database tab.
6. In Maintenance Interval area, select "Custom" and change it to the soonest time you'd like.

Summary / Explanation

What will happen now is that the online maintenance will completely wipe all Recoverable Items off the face of the Earth. The place where the Recoverable Items were in the Information Store, now turns into whitespace. You'll know it's done once the online maintenance reports that it's done in Event Viewer. Once done, run an offline defrag to regain space. Hopefully your Information Store is shrank considerably. Don't forget to readjust the Recoverable Items policy back to something helpful (a balance between recovering data, and recovering space). If this happens again, or you see the Information Store growing again, you've outgrown Exchange 2003 Standard and are ready for Exchange 2003 Enterprise or greater. For kicks, while you're running the offline defrag to regain the whitespace from the Recoverable Items, you can refresh ESM while viewing the mailboxes with a viewing column of deleted, and you'll see them shrink before your eyes as you refresh your view.

BTW, if for whatever reason it's not reasonable to do this across all mailboxes, you can adjust the retention policy for individual mailboxes by going in Active Directory Users and Computers ("ADUC") and adjusting the retention policy on a per user/mailbox basis, and then run the online maintenance, rinse, wash, repeat.