The circular logging feature for Active Directory in Windows 2000 and in Windows Server 2003

The Microsoft Windows 2000 Active Directory directory service and the Microsoft Windows Server 2003 Active Directory directory service use the circular logging feature to maintain transactions in the database file (Ntds.dit). The log files are maintained until the data that they contain is written to the database file. The circular logging feature uses these log files to recover transactions if the database file is shut down in an inconsistent state. For example, a power failure or a Stop error can cause a transaction failure. In Windows 2000 and in Windows Server 2003, there is currently no way to disable the circular logging feature or to turn off the circular logging feature.

When Windows 2000 or Windows Server 2003 performs a database write operation, the operating system records the transaction in a log file. From the log file, the operating system writes the transaction to memory. The transaction is written to the database file when the operating system has time to write the transaction or when the system is shut down.

Windows 2000 and Windows Server 2003 record the transaction in the current log file (Edb.log). Edb.log is 10 megabytes (MB). When Edb.log fills the current file, Edb.log creates a new log file. For example, Edb.log creates Edb00001.log. The log files continue to be incremented. However, the circular logging feature purges the oldest file after the transactions in the log are written to the database file. Also, there are two reserve log files. These files are named Res1.log and Res2.log. These files are used as placeholders when the system runs out of disk space. Each of these files is also 10 MB.

Windows 2000 and Windows Server 2003 also maintain a checkpoint file (Edb.chk) that records what transactions in the log have been written to the database file. If the computer stops responding, Extensible Storage Engine (ESE) can detect an improper shutdown by checking the last log record. If the last record is not a "shutdown" record, ESE replays the logs from the checkpoint. This event occurs at the first restart after the system is shut down improperly. If the checkpoint file is missing for any reason, every transaction in the log file is replayed.

Currently, we recommend that administrators turn off the circular logging feature in Microsoft Exchange. However, in Windows 2000 and in Windows Server 2003, there is no documented or supported way to disable the circular logging feature. Because Active Directory has multiple domain controllers in a given organization and domain, Windows 2000 and Windows Server 2003 are optimized to use circular logging. Administrators should be able to successfully recover a domain controller by using an effective backup strategy, and by using at least one domain controller per domain that can replicate directory partitions.

For more information about circular logging for Exchange, click the following article number to view the article in the Microsoft Knowledge Base: