Exchange 2013 Logging and Space Requirements


There are a lot of changes that were incorporated into Exchange 2013 both from an Architecture and Operational standpoint. One of these changes is something that can be overlooked very easily so I wanted to point out the reasoning behind this change and what to expect. If you look at the disk space requirements for Exchange 2013 (see below) you will notice we now require 30GB free on the Exchange Install drive. This is a drastic increase from 2010 which only required 1.2GB (which I think was a little on the small side).  Although 30GB nowadays isn’t much if you don’t plan for this space increase you could get caught off guard and possibly run into space issues very quickly.

So why do we require all of this extra space? It’s because we now have logging of various Exchange components turned on by default. If you open the logging folder (<Install Drive>\Microsoft\Exchange Server\V15\Logging) on a Mailbox Server check out the amount of folders compared to Exchange 2010.

In all of these folders you will find the corresponding logs for each component. Also if you look in <Exchange Install Drive>\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs you will find Perfmon files (see below) will all of the counters pertaining to Exchange and the Server role (think ExPerfWiz).

Although these log files and Perf data will take up a decent amount of disk space the reasoning behind turning these things on be default was to help customers. If you have had to call into support to troubleshoot an issue you could almost expect the same response every time. After gathering more info on your problem the Engineer would say let’s turn on logging\performance monitor and reproduce the problem. For various reasons customers might not have been able to do this right away. So the Engineer would give the customer an action plan and the customer would call back when they gathered the data. This could be very time consuming and delay getting the problem resolved.

After seeing what kinds of delays this caused the Exchange team decided to collect these logs and performance data by default so it can be used for historical troubleshooting. Instead of having to turn logging on and repro the problem these logs already contain the data we might need. I think this is a great improvement for Exchange 2013 and a welcomed change. I bet most companies are willing to sacrifice a little disk space for hours of support this will save in troubleshooting issues.

Comments (43)

  1. @Chris – Unfortunately there is no way to change this currently. If the logs are taking up more space than you think they should you might want to open a case with CSS to see why they are not purging. How much space is it taking up? More than 30GB?

  2. Ed (DareDevil57) says:

    thanks

  3. Ed (DareDevil57) says:

    thanks

  4. Recep YUKSEL says:

    Thank you Mr. Richard.

  5. Alceryes says:

    …just wanted to post back that ‘ONE IT Service’ fix for the drive space issue works perfectly. Adding only that you need to put a check in ‘Custom Files and Folders’ on the CCleaner home screen to get it to clean that folder. I’ve got a lab Exchange
    2013 doing absolutely nothing and yet it’s STILL eating up 1GB/day.
    Is MS’s recommendation of 30GB’s for Exchange their way of saying that your Exchange server will blow up after a month!?!

  6. Chris Vandaele says:

    Thanks for the post but in the mean time our disks are running full on our servers.

    Is there a way to enable/disable them or at least say to keep the records for about 5 days ?

  7. Kyle says:

    Just crashed an exchange server because of this.  Once again, a perceived convenience from MS is actually a mission critical hassle for consumers.  This is an EXCESSIVE amount of logs to be running at all times with no way to turn it off.  On top of filling up the drive in literally 4 days, my event logs are near unreadable due to loads of informational events.

  8. Rick Eveleigh says:

    How about giving us a way to redirect to a different drive. Like we do with the Exchange Stores and Transaction Logs?

  9. Chris Tracy says:

    You bet wrong.  While I understand the reasoning, I fault the logic of the implementation.  This should be made an OPTION not a requirement.  I've also discovered that using the various workarounds developed by other disgruntled admins isn't a permanent solution.  For example, each time the server is rebooted/upgraded the Data Manager settings for the Perf Mon Data Collector Sets are RESET to the MS imposed defaults.

    Microsoft needs to learn that making things easier for its own technicians usually equates to a major PITA for those of us in the field.

  10. Chris Tracy says:

    As a workaround that actually seems to work, I employed the Junction utility from SysInternals (technet.microsoft.com/…/bb896768.aspx).

    I stopped the Exchange Diagnostics service and the data collector sets, then created junctions to replace the default logging folders to folders on a separate volume that had more free space.  So far it's working perfectly and my C: drive free space has stopped dropping like a rock.

    Somehow, using Microsoft's own technology to circumvent its own shortsitedness is supremely gratifying.

  11. Tony Spencer says:

    So, we have a change that save MS support time, but brings down servers.

    So the new System requirements for Exchange 2013 are;

    System Drive – 300GBs +, but you will still need to cleanup once in a while.

  12. Alan Grainger says:

    There is a proper way to change the logfile location:

    http://www.spr33.com/exchange-2013-data-collector-sets

  13. ONE IT Service says:

    Use CCleaner and add custom folder for the cleaning as  : C:Program FilesMicrosoftExchange ServerV15Logging

    Select file types : *.log; *.blg

    select Include files and subfolders.

    It will not delete log in use.

    here it is 😉

  14. Scott says:

    So What is the Default?, Should it purge at a size limit? or # of days??

    thanks

  15. Outlook Logging folder on client C: drives? says:

    Would this new feature now be creating Outlook Log files on my users C: drives??  We are get lots of txt files created under %temp%Outlook Logging and it seemed to happen when we brought our 1st Exchange 2013 server up – even for staff not on Exchange 2007.  If so, how do we disable?

  16. Anonymous says:

    Pingback from Exchange 2013 Disk Cleaning

  17. Anonymous says:

    Pingback from Exchange 2013 Disk Cleaning

  18. Anonymous says:

    Pingback from Exchange 2013 Disk Cleaning

  19. Karl Bystrak says:

    I put a Wiki on Technet about moving the log files using powershell. Check it out: http://social.technet.microsoft.com/wiki/contents/articles/22479.move-logging-in-exchange-2013-via-powershell.aspx

  20. Anonymous says:

    Pingback from Exchange Server 2013 – ???????????? ?????????? | ILYA Sazonov: ITPro

  21. Anonymous says:

    There are a lot of changes that were incorporated into Exchange 2013 both from an Architecture and Operational standpoint. One of these changes is something that can be overlooked very easily so I wanted to point out the reasoning behind this change and

  22. sana says:

    Is there a way to get Exchange auditing logs as events in event viewer in Exchange 2013?

  23. John Law says:

    Agree with other comments. Someone explain the mechanism Exchange uses to purge these files.

  24. TL says:

    Day late, dollar short on this one. For 2k3 and it’s abundance of performance issues this would have been a slick feature. However, for 2k10/2k13 I almost never see performance issue come across my plate.

    This should be optional, should allow alternate locations for storage.

  25. John Law says:

    This is an issue. I huge issue for me. I have 30GB of performance log files and no obvious way to curtail their creation.

  26. LThibx says:

    I wanted to post a comment here, but in attempting to be clear and specific, it became too long to post here, so if you are interested, please read my post at this link:

    https://social.technet.microsoft.com/Forums/en-US/24d3c7ff-6378-4086-a035-dfa9ecea46bb/exchange-2013-issues-new-send-email-stuck-in-drafts-not-send?forum=exchangesvrsecuremessaging

    LThibx

  27. len says:

    I know a few have suggested here that the commands such as:
    logman -stop ExchangeDiagnosticsPerformanceLogExchangeDiagnosticsPerformanceLog

    logman -update ExchangeDiagnosticsPerformanceLogExchangeDiagnosticsPerformanceLog -o "$logdrive$Diagnosticlogroot"
    would rectify this issue, and it will do so ONLY until the restart of service MSExchangeDiagnostics which will reset the locations back to the program install folder.

    The only real options for this I have seen so far is to install Exchange on a separate volume, mount a another volume under the exchange install directory or create a hardlink to another location and log there.
    very very frustrating!

  28. AlBear says:

    Time to find another Mail Server. Exchange has gone bananas! 🙂

  29. wizard says:

    SImply disable both Health Manager and Diagnostics services on all exchange servers involved to stop the accumulation of logging. Then delete abundance of logging. For a test-environment this works just fine. Just be aware that doing so also disables Exchange’s
    new automatic "health" and remediation abillities, meaning it cannot automatically correct lots of issues that can arise (especially in a test-environment where people tend to play around alot)… You essentially disable Exchange’s abillity to respond to occuring
    issues, be it a bad disk, necessary database-failover, server-failover, etc., etc. which would otherwise occur automagically…

  30. Heather says:

    Can this Logging folder be compressed safely?

  31. florian says:

    It can be compressed, just did. Saves about 60% of space (which means it still uses a lot)

  32. Azeez says:

    @ Florian, How do you compress it?

  33. Ned says:

    Go to C:Program FilesMicrosoftExchange ServerV15. Right click the folder "Logging" and chose "Properties". Click "Advanced". Chose "Compress contents to save disk space". Click OK two times. Mine got compressed from 15 GB to 5 GB. It will no compress
    active logs, but just chose to ignore all (or something similar, can’t remember the text) and it will compress the ones it can, which is almost 100%.

  34. Korgua says:

    Schedule a powershell script to delete files created xx days ago (in this case -1 denotes one day)

    $limit = (Get-Date).AddDays(-1)
    $path = "E:e2k13LoggingDiagnosticsDailyPerformanceLogs"

    # Delete files older than the $limit.
    Get-ChildItem -Path $path -Force | Where-Object { !$_.PSIsContainer -and $_.CreationTime -lt $limit } | Remove-Item -Force -Recurse

  35. Bishop Of Ramsbottom says:

    "think this is a great improvement for Exchange 2013 and a welcomed change. I bet most companies are willing to sacrifice a little disk space for hours of support this will save in troubleshooting issues."

    You would be WRONG! I have had an Exchange 2007 environment for over 5 years and I have NEVER had to call MS Support ever until we upgraded to Exchange 2013 (on a new server with the recommended disk space) and now the server is having problems every few days
    with disk space issues!

    This was a terrible idea I agree with the comments that this should have been an OPTION not a default. MS FIX THIS ISSUE ASAP!

  36. Zoltan Erszenyi says:

    What isn’t mentioned here is that since everything happens via HTTPS, IIS logs are a major contributor to disk space usage.

    What I found is that the average medium business with 6-700 mailboxes will generate approx. 5Gb of IIS logs *daily*. In a month, it will gobble up 150Gb.

    By default IIS logs are stored on C:, so move them onto a really big drive other than C:.

    Neither Exchange, not IIS has a way to log-rotate IIS logs and to cater for the explosion of space requirements – a major overlook and long overdue feature that Unix/Linux had from day 1 since the last century.

  37. KenCarnivorous says:

    Go to Performance Monitor > Data Collector Sets > User Defined and stop the Exchange Diagnostics Entries. You could probably delete them altogether, but I’d be more comfortable just stopping them.

  38. KenCarnivorous says:

    Also, if you right-click and look at Data Manager Properties, it’ll let you set options for disk space and age.

  39. KenCarnivorous says:

    Nevermind… discovered that the Performance logs restart after being stopped… First comment posted here is probably the best way to go.

    http://windowsitpro.com/blog/exchange-2013-diagnostic-and-performance-log-files

    Quote:
    Pepi_1 on Aug 8, 2013
    One way to help own life is using the PowersHell:
    ——————————–
    $DateToDelete = 40
    $StartFolder = "C:LogFolder"
    $Year = (Get-Date).Year
    $Day = Get-Date
    Get-ChildItem $StartFolder -Recurse -Force -ea 0 | where{!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-$DateToDelete)} | ForEach{Add-Content -Path "Delete Log $Year.log" -Value " $_.FullName"; Remove-Item -Path $_.FullName }
    ——————————–
    And then schedule above code to be run once per day. Recommended targets are also: IIS logs.
    More and more those MS products come closer to Ikea’s products: You get something out of the box, but then you need to paint and tune them to be suitable for you 🙁

  40. RonnyGeissler says:

    I’ve been written a small script which will start as a computer logon script to move the diagnostic logging to a different path:

    Start-Sleep -s 300

    $ServiceName = "MSExchangeDiagnostics"
    $arrService = Get-Service -Name $ServiceName
    if ($arrService.Status -ne "Running"){
    Start-Service $ServiceName
    Write-Host "Starting " $ServiceName " Service"
    " ———————- "
    " Service is now started"

    Start-Sleep -s 10

    # move the path for the PERFMON logs from the C: drive to the L: drive
    logman -stop ExchangeDiagnosticsDailyPerformanceLog
    logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
    logman -start ExchangeDiagnosticsDailyPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"

    write-host ‘DailyPerformanceLogs has been moved’

    logman -stop ExchangeDiagnosticsPerformanceLog
    logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
    logman -start ExchangeDiagnosticsPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"

    write-host ‘PerformanceLogsToBeProcessed has been moved’

    }
    if ($arrService.Status -eq "running"){
    Write-Host "$ServiceName Service is already started"

    # move the path for the PERFMON logs from the C: drive to the L: drive
    logman -stop ExchangeDiagnosticsDailyPerformanceLog
    logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
    logman -start ExchangeDiagnosticsDailyPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"

    write-host ‘DailyPerformanceLogs has been moved’

    logman -stop ExchangeDiagnosticsPerformanceLog
    logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
    logman -start ExchangeDiagnosticsPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"

    write-host ‘PerformanceLogsToBeProcessed has been moved’
    }

  41. RonnyGeissler says:

    I’ve been written a small script which will start as a computer logon script to move the diagnostic logging to a different path:

    Start-Sleep -s 300

    $ServiceName = "MSExchangeDiagnostics"
    $arrService = Get-Service -Name $ServiceName
    if ($arrService.Status -ne "Running"){
    Start-Service $ServiceName
    Write-Host "Starting " $ServiceName " Service"
    " ———————- "
    " Service is now started"

    Start-Sleep -s 10

    # move the path for the PERFMON logs from the C: drive to the L: drive
    logman -stop ExchangeDiagnosticsDailyPerformanceLog
    logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
    logman -start ExchangeDiagnosticsDailyPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"

    write-host ‘DailyPerformanceLogs has been moved’

    logman -stop ExchangeDiagnosticsPerformanceLog
    logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
    logman -start ExchangeDiagnosticsPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"

    write-host ‘PerformanceLogsToBeProcessed has been moved’

    }
    if ($arrService.Status -eq "running"){
    Write-Host "$ServiceName Service is already started"

    # move the path for the PERFMON logs from the C: drive to the L: drive
    logman -stop ExchangeDiagnosticsDailyPerformanceLog
    logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
    logman -start ExchangeDiagnosticsDailyPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"

    write-host ‘DailyPerformanceLogs has been moved’

    logman -stop ExchangeDiagnosticsPerformanceLog
    logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
    logman -start ExchangeDiagnosticsPerformanceLog

    del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"

    write-host ‘PerformanceLogsToBeProcessed has been moved’
    }

  42. Neil Rawlinson says:

    Just had our C: drive fill up, seems that permissions on C:WindowsTemp didn’t allow delete by default. 1Tb System drive filled up in no time due to this issue.