safe manual database log truncation for enterprise CA storage recovery

Question

Hello,

I have a question about manual database log truncation for our company. We're using Microsoft Active Directory Certificate Services that comes with Windows Server Enterprise, which is version 2019.

I want to execute a manual database log truncate to SQL Server database so that we can restore the issuing CA service.

But when I researched and surveyed prices from our storage vendor, I saw that they all quoted using the enterprise storage expansion package or the cloud backup tier or the high availability cluster packages. I've seen some posts about execute a manual database log truncate through the checkpoint truncation option, but I don't quite understand it. The requirements seem pretty simple, for example, having database backup. I'm not sure if there's any difference in truncate from simple recovery model versus full recovery model.

We are using Microsoft SQL Server 2019 Standard Edition hosting the CA database backend.

Thanks in advance.

Answer 1

Hello @SRR Shinka

One important clarification: a standard AD CS Certification Authority does not use SQL Server 2019 as its CA database backend. The CA database is an ESE/Jet database (<CAName>.edb) with transaction log files, normally under %SystemRoot%\System32\CertLog.

Therefore, SQL Server recovery models (SIMPLE/FULL) and SQL transaction-log truncation aren't applicable to the AD CS CA database.

If the CA's transaction logs are consuming disk space, don't manually delete the .log files. Perform a supported CA database backup instead:

certutil -backupdb C:\CABackup

By default, certutil -backupdb truncates the CA database logs after a successful backup. The KeepLog option is specifically used when you don't want them truncated.

PowerShell provides the equivalent:

Backup-CARoleService -Path C:\CABackup -DatabaseOnly

Unless -KeepLog is specified, the logs are also truncated by default.

If the CA service currently won't start because the volume is completely full, I'd first free/move unrelated files or temporarily extend the volume rather than manually deleting CA transaction logs. Microsoft also supports moving the CA database/log directories to another volume if additional storage is required.

Reference: Microsoft Learn – certutil backup and restore options https://learn.microsoft.com/hi-in/windows-server/administration/windows-commands/certutil?

If SQL Server is actually involved in your environment, please clarify what component/database SQL Server is hosting, because it isn't the native AD CS CA database.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.