• Check SMTP logs in system32\logfiles\smtpsvc1
  • Where do I configure this??
• Check transaction logs in exchsrvr\mdbdata
  • Check the last backup was successfull, and is configured to flush the logs on completion. Don't manually delete them!
• Check message tracking logs in exchsrvr\\server_name.log
  • You can delete these safely, and keep them under control with the "delete after x days" option, under properties of the server in ESM.
• Check IMF under exchsrvr\mailroot\vsi 1\ucearchive
  • These can be deleted safely. How do I keep them in check??

Those are probably the main possibilities. Others might include MTA logs (under exchsrvr\mtadata - may not be anything, depending on your configuration), SMTP logs if you've configured your server to log SMTP (live under Windows\system32\logfiles, with names of SMPTSVC1, and are just regular log files that can be safely deleted if you don't need them, and maybe others, depending.