ACIM Personal Knowledgebase

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Exchange 2013 Logging Clear out the log files ======

In your Exchange 2013 environment you may be wondering why the space on your C:\ drive where Exchange is installed is filling up so quickly. 
This is due to the amount of logging Exchange 2013 does by default. Microsoft turned this on to assist them with more rapid assistance with customers instead of waiting for logs.

From CU6 for Exchange 2013, .etl files were created. With the current build Exchange 2013 creates 50MB files at a time with a maximum of 100 files. For smaller businesses this is not ideal.

The other feature that logs weekly and daily files is the Diagnostic logs (Health explorer). This will generate files up to 5GB over a week/month. Some of you might want that space because you are limited with the current hardware you have.

The other player here is IIS logs. These can generate quite a bit and at 500MB+ a log file you can run out of space rather quickly.

Lastly, another set of logs that could be filling up is the HTTP Proxy log. This log will fill up in most cases when you have issues and will create an hourly file from 4MB onward.

In this article we will go through each of the following logs below and explain how you can maintain them or turn them off:

  * Diagnostic Logs (Health Manager)
  * ETL Files
  * IIS Logs
  * HTTP Proxy Logs

Lastly, a PowerShell script is available to run a clean up without having to go into each folder.

===== Diagnostic Logs =====

Health Manager runs and collects information about the health of the system. If you have ample space this is fine but if you have an 80GB C:\ drive your drive is going to fill up in less than a few days. If you need to disable this feature you can do so as follows:

Open up Services.msc,

{{ :microsoft:hm1.png?nolink |}}

  * Locate the Microsoft Exchange Health Manager Service.
  * Double click the service and change the startup to disabled. 
  * Stop the service if it is running.

{{ :microsoft:hm2.png?nolink |}}

  * The next service to locate is the Microsoft Exchange Diagnostics Service.
  * Follow the same steps as above to stop and disable the service.

The next thing to stop/disable is the task that runs. Open up Task Scheduler.

{{ :microsoft:hm3.png?nolink |}}

  * In Task Scheduler, expand Microsoft -> Windows and then click on PLA.
  * You will see two tasks, first stop them if they running and then disable them.

The next step is to clear out the logs created by Diagnostics. Open up Explorer.

{{ :microsoft:hm4.png?nolink |}}

Navigate to C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostic.

  * In there you will have two folders, one called DailyPerformanceLogs and the other PerformanceLogsToBeProcessed.
  * You can delete all the log files located in these two. The logs to be processed will contain 20MB files while the daily logs will be +/- 1GB.

===== ETL Files =====

These files are generated almost every hour and are about 50MB in size. The default registry entry for this is to keep 100 files. We will adjust this value further down.

To locate these files go to the following location:

  * C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces

{{ :microsoft:hm5.png?nolink |}}

  * As shown above, there are a lot of files logged. You can highlight all of them and delete them without a problem. This will free up a few GB.

Within the Diagnostics folder there is another folder that is logging. Here is the location:
  * C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs

{{ :microsoft:hm6.png?nolink |}}

  * As you can see above, a lot of log files are here and you can delete these text files.

===== Registry Change =====


You can change the default value of 100 files to a number you want by changing the following registry key:

  * Key: MaxTraceFileCount
  * Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing

===== IIS Log Files =====

IIS Log files write to the C:\inetpub directory by default. You can change this to another drive, etc. These files can be 200MB+ and overtime will use up space on the drive. To delete them, open up the following location:

  * C:\inetpub\logs\LogFiles

{{ :microsoft:hm7.png?nolink |}}

  * Inside this folder you will have two other folders namely W3SVC1 and W3SVC2. Inside these are log files you can delete as well.


You can also look in the following folder for the same set of folders: C:\Program Files\Microsoft\Exchange Server\V15\Logging\RpcHttp

{{ :microsoft:hm8.png?nolink |}}

  * Here you can also delete these files.

===== HTTP Proxy Logs =====


The last place you can look as well for log files is in this location:

  * C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy
Located in each of the folders some files can be 10MB in size and generate quite a few. These logs will tell you if you have errors in your environment especially the RpcHttp folder.

===== Conclusion =====


You should be able to free up a few GBs of space.
ACIM Personal Knowledgebase

User Tools

Site Tools

Page Tools
