Exchange 2003

Event ID 1221

A common posting on newsgroups and forums from new Exchange administrators is when they look the event logs on their Exchange server and find this:

They then post a message about their Exchange server running out of space, and how to increase it.
There are a number of issues here, which will be dealt with separately.

What does this message mean?

What it means is that Exchange has carried out some routine maintenance on the Exchange database. Any old data that is past the delete thresholds has been deleted from the database.
The space it has left behind has then been consolidated, in to "white space". The size of the database hasn't changed - there is just some space within the database.
This "white space" will be used by Exchange first, before expanding the database any larger.

What happens if the size is very large?

It depends what you mean by large, and how large your Exchange database is.
For example, if your Exchange database is 200gb and the message says that you have 50mb free, then that isn't a massive amount of that space.
However if your Exchange database is only 10gb and the message says that you have 500mb free, then it is taking a larger proportional amount of the database.

Can I reclaim that space?

Exchange will use that space, so if your Exchange server is used heavily, then that space could be used up very quickly.
If your server is lightly used however, then you might consider an offline defrag. This uses a tool called eseutil.exe which you can find in the \exchsrvr\bin directory on your Exchange server. 

The decision to do an offline defrag should be weighed up carefully.

• It will cause downtime of Exchange as Exchange needs to be stopped while it is running. It isn't the fastest of tools, but your downtime will depend on the size of the database.
• You need approximately 2.5 times the size of the files in free space - so if your database is 10gb you will need 25gb of free space.

Running eseutil.exe on the database should NOT be considered routine, or part of the maintenance of the server. Exchange looks after itself, and eseutil should only be used on those rare occasions where a large amount of data has been deleted and the space needs to be reclaimed.

Does the message have anything to do with the size of the database?

No, it doesn't.
However you do need to monitor the size of the database if you are using Exchange 2000 standard edition, or are on a Small Business Server. These versions only allow a database of 16gb. If you exceed that, Exchange shuts down.
At that point you can use event ID 1221 to verify if there is lots of white space, so that you can do an offline defrag to get Exchange running again.

With Exchange 2003, Service Pack 2 increased the limit to 18gb, which can be increased to 75gb with a registry change. Furthermore, the enforcement of the limit takes in to account the amount of white space in the database, meaning that the physical size of the database can go beyond 75gb, as long as the amount of white space takes the size below that number. This makes an offline defrag almost unnecessary for most people.

More information on the Exchange database can be found here.

Why does it cause confusion?

This event log ID should have been worded slightly differently - changing the word "free" to "white". This would have given a clearer indication of what has happened. The message would then read like this:

"The database "First Storage Group\Mailbox Store (SERVER)" has 1 megabytes of white space after online defragmentation has terminated. "

More Information

There is more information on the way that Exchange uses the database and the true size of the database in this Microsoft article:
http://www.microsoft.com/technet/prodtechnol/exchange/2003/insider/trueamountofspace.mspx

and more information on the database in general here.