Gathering required information
 

1.When did the problem started

2.Have we initiated created replicas for Public Folder on the problem Server

3.Was Move Mailbox operation Performed

4.Check the version of Store.exe

5.Check what third party software’s are running

6.Check for any events in the application Log related to DB

7.Are there any users using Entourage to send and receive mails

8.Are there any size limits set on the Exchange organization for the mails.

9.Are exclusion set properly

10.Is Exchange Server configured with any third party sync software such as Blackberry

11.Are there any Foreign Connectors installed on the Server

12.Along with these all the basic probing questions need to confirm

Troubleshooting steps

1.Try stopping AV or any Spam software which you have a doubt and monitor it to check is the problem still there.

2. If there is any file-level antivirus program installed on this server, please check its settings. Make sure to exclude Drive M 
   and exchange related folders on Exchange server.
 

3.Stop the SMTP Pop3 IMAP4 service and monitor is the DB or log files still growing?
 

4.If there are Multiple Stores dismount each store at a time and monitor the issue
 

5.If Public Folder replication has been initiated and if the replication Status and priority is set Always and Urgent   
   this will sometimes cause issue if the DB is huge in size. You can try stopping PF replication from the Organization
   level (Exchange 2003 SP2) this takes a lot of time to take affect.
 

6.Turn up Maximum rules diagnostics logging (ESM -> The properties of the problem server -> Diagnostics Logging tab -
    > MSExchangeIS -> Mailboxes/Public Folder ->  Rules), increase the capacity of the Application event log size, monitor
    the issue for a couple of minutes while it is occurring and see if something keeps on firing from Application event log
    such as a rule which might cause the issue

7. Add and check the value of Total Ops in ESM (Highlight the Logons folder under Mailbox Store and Public Folder Store in
   ESM, click View -> Add/Remove Columns and add the Total Ops entry to the list on the right). The Total Ops will list a
   numeric value of the total number of operations the server has processed for the each user within the last minute. This 
   value should not be "Constantly" above 200 when refreshing the screen. Sort by using the Total Ops column and try to find
   any problem mailboxes or public folders that have high Total Ops value.If you find any Mailboxes with high number of total
   Ops if possible try to move that mailbox to another store.If this is Exchange Standard where we don’t have move mailbox
   option Exmerge out the Mailbox remove Exchange attributes to the users create a mailbox for this User and then 
   import  back the pst into the Mailbox (by this time 90% of the issues are resolved relating to log file growing

8. On the problem server, please collect a few message tracking logs generated when the issue is occurring (the size is 
   increasing rapidly)

1.Get the logs from the exchsrvr/servername.log files
2.Use msgtrackloopdetect.exe, which you can get from //exutils
      a) open a command prompt
      b) command is: msgtrackloopdetect.exe "path to log track files" >"name of text file you pipe to".txt
                             example: c:\msgtrackloopdetect trackinglog.txt >loop.txt
3.Get the Deleter utility which is in the msgtrackloopdetect folder
      a) Copy the deleter.ini file to the c:\winnt dir on the server.
      b) Open it up with notepad and you will see two lines, the second of which will look like below
              r1=c=US;a=MCI;p=msft;s=alias;
Change the 'alias' to the alias that is seen in the looping mail and save the file 

      c) Copy over the deleter.dll and put it in the d:\exchsrvr\bin dir
      d) From the run box, run 'regsvr32 deleter.dll'
      e) Cycle all services to allow the changes to take effect.
      f)  Unregister the dll when messages have been deleted

At this point the messages should be removed and the log files should stop growing if not refer to some articles below for easy reference

Related Knowledge Base

287703  XFOR: Edb Log Files Grow When Calendar Connector Is Started

298551  XADM: Large Number of Transaction Logs Created
811650  Private Information Store log files grow when a user performs a search in OWA
889525  An e-mail message stays in the Outbox and the Exchange Server 2003 transaction log files grow 
            when an Entourage user tries to send a message that exceeds the size limit in Global Settings
893624  When you try to send a message in Entourage that exceeds the size limit in Global Settings, 
            the email message remains in the Outbox, and the transaction log files grow in Exchange 2000 Server
894966 Troubleshooting When the Exchange Database Grows Too Rapidly