Exchange 2010 SP2
2 hubs/cas, 2 mb
one "hub/cas/mb" server in remote location
we have this consultant whom we think is preventing people from using Exchange after office hours so that he can finish his task. the reason we're saying this is because we know he is replicating our production Exchange databases to the remote site. last night, without warning, no users can access their emails. all servers are online though. the only tell-tale sign I could see that something is weird is that in the event viewer it says database logs are full (100GB), and some other error that says unable to replicate because of too much data being generated.
I just want to know if indeed the cause of last nights outage was because of his copying work. is there something in the event viewer or in EMC that would help me identify it?