Exchange 2013 Logging and Space Requirements
There are a lot of changes that were incorporated into Exchange 2013 both from an Architecture and Operational standpoint. One of these changes is something that can be overlooked very easily so I wanted to point out the reasoning behind this change and what to expect. If you look at the disk space requirements for Exchange 2013 (see below) you will notice we now require 30GB free on the Exchange Install drive. This is a drastic increase from 2010 which only required 1.2GB (which I think was a little on the small side). Although 30GB nowadays isn’t much if you don’t plan for this space increase you could get caught off guard and possibly run into space issues very quickly.
So why do we require all of this extra space? It’s because we now have logging of various Exchange components turned on by default. If you open the logging folder (<Install Drive>\Microsoft\Exchange Server\V15\Logging) on a Mailbox Server check out the amount of folders compared to Exchange 2010.
In all of these folders you will find the corresponding logs for each component. Also if you look in <Exchange Install Drive>\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs you will find Perfmon files (see below) will all of the counters pertaining to Exchange and the Server role (think ExPerfWiz).
Although these log files and Perf data will take up a decent amount of disk space the reasoning behind turning these things on be default was to help customers. If you have had to call into support to troubleshoot an issue you could almost expect the same response every time. After gathering more info on your problem the Engineer would say let’s turn on logging\performance monitor and reproduce the problem. For various reasons customers might not have been able to do this right away. So the Engineer would give the customer an action plan and the customer would call back when they gathered the data. This could be very time consuming and delay getting the problem resolved.
After seeing what kinds of delays this caused the Exchange team decided to collect these logs and performance data by default so it can be used for historical troubleshooting. Instead of having to turn logging on and repro the problem these logs already contain the data we might need. I think this is a great improvement for Exchange 2013 and a welcomed change. I bet most companies are willing to sacrifice a little disk space for hours of support this will save in troubleshooting issues.
Comments
Anonymous
January 01, 2003
@Chris - Unfortunately there is no way to change this currently. If the logs are taking up more space than you think they should you might want to open a case with CSS to see why they are not purging. How much space is it taking up? More than 30GB?Anonymous
January 01, 2003
thanksAnonymous
January 01, 2003
thanksAnonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
The comment has been removedAnonymous
January 01, 2003
Great article.Anonymous
April 13, 2013
Thanks for the post but in the mean time our disks are running full on our servers. Is there a way to enable/disable them or at least say to keep the records for about 5 days ?Anonymous
May 06, 2013
Just crashed an exchange server because of this. Once again, a perceived convenience from MS is actually a mission critical hassle for consumers. This is an EXCESSIVE amount of logs to be running at all times with no way to turn it off. On top of filling up the drive in literally 4 days, my event logs are near unreadable due to loads of informational events.Anonymous
June 17, 2013
How about giving us a way to redirect to a different drive. Like we do with the Exchange Stores and Transaction Logs?Anonymous
July 15, 2013
You bet wrong. While I understand the reasoning, I fault the logic of the implementation. This should be made an OPTION not a requirement. I've also discovered that using the various workarounds developed by other disgruntled admins isn't a permanent solution. For example, each time the server is rebooted/upgraded the Data Manager settings for the Perf Mon Data Collector Sets are RESET to the MS imposed defaults. Microsoft needs to learn that making things easier for its own technicians usually equates to a major PITA for those of us in the field.Anonymous
July 15, 2013
As a workaround that actually seems to work, I employed the Junction utility from SysInternals (technet.microsoft.com/.../bb896768.aspx). I stopped the Exchange Diagnostics service and the data collector sets, then created junctions to replace the default logging folders to folders on a separate volume that had more free space. So far it's working perfectly and my C: drive free space has stopped dropping like a rock. Somehow, using Microsoft's own technology to circumvent its own shortsitedness is supremely gratifying.Anonymous
July 16, 2013
So, we have a change that save MS support time, but brings down servers. So the new System requirements for Exchange 2013 are; System Drive - 300GBs +, but you will still need to cleanup once in a while.Anonymous
July 24, 2013
There is a proper way to change the logfile location: www.spr33.com/exchange-2013-data-collector-setsAnonymous
November 26, 2013
Use CCleaner and add custom folder for the cleaning as : C:Program FilesMicrosoftExchange ServerV15Logging Select file types : *.log; *.blg select Include files and subfolders. It will not delete log in use. here it is ;)Anonymous
December 11, 2013
So What is the Default?, Should it purge at a size limit? or # of days?? thanksAnonymous
December 12, 2013
Would this new feature now be creating Outlook Log files on my users C: drives?? We are get lots of txt files created under %temp%Outlook Logging and it seemed to happen when we brought our 1st Exchange 2013 server up - even for staff not on Exchange 2007. If so, how do we disable?Anonymous
January 04, 2014
Pingback from Exchange 2013 Disk CleaningAnonymous
January 04, 2014
Pingback from Exchange 2013 Disk CleaningAnonymous
January 04, 2014
Pingback from Exchange 2013 Disk CleaningAnonymous
March 05, 2014
I put a Wiki on Technet about moving the log files using powershell. Check it out: http://social.technet.microsoft.com/wiki/contents/articles/22479.move-logging-in-exchange-2013-via-powershell.aspxAnonymous
May 27, 2014
Pingback from Exchange Server 2013 – ???????????? ?????????? | ILYA Sazonov: ITProAnonymous
July 07, 2014
There are a lot of changes that were incorporated into Exchange 2013 both from an Architecture and Operational standpoint. One of these changes is something that can be overlooked very easily so I wanted to point out the reasoning behind this change andAnonymous
August 07, 2014
Is there a way to get Exchange auditing logs as events in event viewer in Exchange 2013?Anonymous
September 18, 2014
Agree with other comments. Someone explain the mechanism Exchange uses to purge these files.Anonymous
September 19, 2014
Day late, dollar short on this one. For 2k3 and it's abundance of performance issues this would have been a slick feature. However, for 2k10/2k13 I almost never see performance issue come across my plate.
This should be optional, should allow alternate locations for storage.Anonymous
September 23, 2014
This is an issue. I huge issue for me. I have 30GB of performance log files and no obvious way to curtail their creation.Anonymous
November 23, 2014
I wanted to post a comment here, but in attempting to be clear and specific, it became too long to post here, so if you are interested, please read my post at this link:
https://social.technet.microsoft.com/Forums/en-US/24d3c7ff-6378-4086-a035-dfa9ecea46bb/exchange-2013-issues-new-send-email-stuck-in-drafts-not-send?forum=exchangesvrsecuremessaging
LThibxAnonymous
December 02, 2014
I know a few have suggested here that the commands such as:
logman -stop ExchangeDiagnosticsPerformanceLogExchangeDiagnosticsPerformanceLog
logman -update ExchangeDiagnosticsPerformanceLogExchangeDiagnosticsPerformanceLog -o "$logdrive$Diagnosticlogroot"
would rectify this issue, and it will do so ONLY until the restart of service MSExchangeDiagnostics which will reset the locations back to the program install folder.
The only real options for this I have seen so far is to install Exchange on a separate volume, mount a another volume under the exchange install directory or create a hardlink to another location and log there.
very very frustrating!Anonymous
December 17, 2014
Time to find another Mail Server. Exchange has gone bananas! :)Anonymous
January 16, 2015
SImply disable both Health Manager and Diagnostics services on all exchange servers involved to stop the accumulation of logging. Then delete abundance of logging. For a test-environment this works just fine. Just be aware that doing so also disables Exchange's new automatic "health" and remediation abillities, meaning it cannot automatically correct lots of issues that can arise (especially in a test-environment where people tend to play around alot)... You essentially disable Exchange's abillity to respond to occuring issues, be it a bad disk, necessary database-failover, server-failover, etc., etc. which would otherwise occur automagically...Anonymous
March 10, 2015
Can this Logging folder be compressed safely?Anonymous
March 30, 2015
It can be compressed, just did. Saves about 60% of space (which means it still uses a lot)Anonymous
April 03, 2015
@ Florian, How do you compress it?Anonymous
April 08, 2015
Go to C:Program FilesMicrosoftExchange ServerV15. Right click the folder "Logging" and chose "Properties". Click "Advanced". Chose "Compress contents to save disk space". Click OK two times. Mine got compressed from 15 GB to 5 GB. It will no compress active logs, but just chose to ignore all (or something similar, can't remember the text) and it will compress the ones it can, which is almost 100%.Anonymous
June 03, 2015
The comment has been removedAnonymous
June 18, 2015
"think this is a great improvement for Exchange 2013 and a welcomed change. I bet most companies are willing to sacrifice a little disk space for hours of support this will save in troubleshooting issues."
You would be WRONG! I have had an Exchange 2007 environment for over 5 years and I have NEVER had to call MS Support ever until we upgraded to Exchange 2013 (on a new server with the recommended disk space) and now the server is having problems every few days with disk space issues!
This was a terrible idea I agree with the comments that this should have been an OPTION not a default. MS FIX THIS ISSUE ASAP!Anonymous
July 08, 2015
What isn't mentioned here is that since everything happens via HTTPS, IIS logs are a major contributor to disk space usage.
What I found is that the average medium business with 6-700 mailboxes will generate approx. 5Gb of IIS logs daily. In a month, it will gobble up 150Gb.
By default IIS logs are stored on C:, so move them onto a really big drive other than C:.
Neither Exchange, not IIS has a way to log-rotate IIS logs and to cater for the explosion of space requirements - a major overlook and long overdue feature that Unix/Linux had from day 1 since the last century.Anonymous
July 31, 2015
Go to Performance Monitor > Data Collector Sets > User Defined and stop the Exchange Diagnostics Entries. You could probably delete them altogether, but I'd be more comfortable just stopping them.Anonymous
July 31, 2015
Also, if you right-click and look at Data Manager Properties, it'll let you set options for disk space and age.Anonymous
July 31, 2015
The comment has been removedAnonymous
November 26, 2015
I've been written a small script which will start as a computer logon script to move the diagnostic logging to a different path:
Start-Sleep -s 300
$ServiceName = "MSExchangeDiagnostics"
$arrService = Get-Service -Name $ServiceName
if ($arrService.Status -ne "Running"){
Start-Service $ServiceName
Write-Host "Starting " $ServiceName " Service"
" ---------------------- "
" Service is now started"
Start-Sleep -s 10
# move the path for the PERFMON logs from the C: drive to the L: drive
logman -stop ExchangeDiagnosticsDailyPerformanceLog
logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
logman -start ExchangeDiagnosticsDailyPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"
write-host 'DailyPerformanceLogs has been moved'
logman -stop ExchangeDiagnosticsPerformanceLog
logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
logman -start ExchangeDiagnosticsPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"
write-host 'PerformanceLogsToBeProcessed has been moved'
}
if ($arrService.Status -eq "running"){
Write-Host "$ServiceName Service is already started"
# move the path for the PERFMON logs from the C: drive to the L: drive
logman -stop ExchangeDiagnosticsDailyPerformanceLog
logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
logman -start ExchangeDiagnosticsDailyPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"
write-host 'DailyPerformanceLogs has been moved'
logman -stop ExchangeDiagnosticsPerformanceLog
logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
logman -start ExchangeDiagnosticsPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"
write-host 'PerformanceLogsToBeProcessed has been moved'
}Anonymous
November 26, 2015
I've been written a small script which will start as a computer logon script to move the diagnostic logging to a different path:
Start-Sleep -s 300
$ServiceName = "MSExchangeDiagnostics"
$arrService = Get-Service -Name $ServiceName
if ($arrService.Status -ne "Running"){
Start-Service $ServiceName
Write-Host "Starting " $ServiceName " Service"
" ---------------------- "
" Service is now started"
Start-Sleep -s 10
# move the path for the PERFMON logs from the C: drive to the L: drive
logman -stop ExchangeDiagnosticsDailyPerformanceLog
logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
logman -start ExchangeDiagnosticsDailyPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"
write-host 'DailyPerformanceLogs has been moved'
logman -stop ExchangeDiagnosticsPerformanceLog
logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
logman -start ExchangeDiagnosticsPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"
write-host 'PerformanceLogsToBeProcessed has been moved'
}
if ($arrService.Status -eq "running"){
Write-Host "$ServiceName Service is already started"
# move the path for the PERFMON logs from the C: drive to the L: drive
logman -stop ExchangeDiagnosticsDailyPerformanceLog
logman -update ExchangeDiagnosticsDailyPerformanceLog -o "D:Exchange_LogsDiagnosticsDailyPerformanceLogsExchangeDiagnosticsDailyPerformanceLog"
logman -start ExchangeDiagnosticsDailyPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsDailyPerformanceLogs*.blg"
write-host 'DailyPerformanceLogs has been moved'
logman -stop ExchangeDiagnosticsPerformanceLog
logman -update ExchangeDiagnosticsPerformanceLog -o "D:Exchange_LogsDiagnosticsPerformanceLogsToBeProcessedExchangeDiagnosticsPerformanceLog"
logman -start ExchangeDiagnosticsPerformanceLog
del "C:Program FilesMicrosoftExchange ServerV15LoggingDiagnosticsPerformanceLogsToBeProcessed*.blg"
write-host 'PerformanceLogsToBeProcessed has been moved'
}Anonymous
December 17, 2015
Just had our C: drive fill up, seems that permissions on C:WindowsTemp didn't allow delete by default. 1Tb System drive filled up in no time due to this issue.