** Have created a small script for Exchange 2010 to help clean out the IIS Log files, you can find the link to the gallery at the end of the article**
**Update** Tested the script on Exchange Server 2019 Public Preview and it clears the logs without any error.
In your Exchange 2013/2016 and now Exchange 2019 Environment you may be wondering why the space on your C:\ drive where Exchange is installed is filling up so quickly.
This is due to the amount of logging Exchange 2013/2016/2019 does by default. Microsoft turned this on to assist them with more rapid assistance with customers instead of waiting for logs.
From CU6 for Exchange 2013, .etl files were created. With the current build Exchange 2013 creates 50mb files at a time with a maximum of 100 files. For smaller business this is not ideal.
The other feature that logs weekly and daily files is the Diagnostic logs (Health explorer). This will generate files up to 5GB over a week/month. Some of you might want that space because you are limited with the current hardware you have.
The other player here is IIS logs. These can generate quite a bit and at 500MB+ a log file you can run out of space rather quickly.
Lastly, another set of logs that could be filling up is the Http Proxy log. This log will fill up in most cases when you have issues and will create an hourly file from 4MB onwards.
In this article I will go through each of the following logs below and explain how you can maintain them or turn them off:
- Diagnostic logs (Health Manager)
- ETL Files
- IIS Logs
Lastly, A PowerShell script is available to run to clean up this without having to go into each folder.
Diagnostic Logs
Health Manager runs and collects information about the health of the system. If you have ample space this is fine but if you have an 80GB C:\ drive your drive is going to fill up in less than a few days. If you need to disable this feature you can do so as follows:
Open up Services.msc,
- Locate the Microsoft Exchange Health Manager Service.
- Double click the service and change the startup to disabled.
- Stop the service if it is running.
- The next service to locate is the Microsoft Exchange Diagnostics Service.
- Follow the same steps as above to stop and disable the service.
The next thing to stop/disable is the Task that runs. Open up Task Scheduler.
- In Task Scheduler, expand Microsoft -> Windows and then click on PLA.
- You will see 2 tasks, first stop them if they running and then disable them.
The next step is to clear out the logs created by Diagnostics. Open up Explorer.
Navigate to C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostic.
- In there you will have to folders, one called DailyPerformanceLogs and the other PerformanceLogsToBeProcessed.
- You can delete all the log files located in these 2. The logs to be processed will contain 20MB files while the daily logs will be +- 1GB.
ETL Files
These files are generated almost every hour and are about 50MB in size. The default registry entry for this is to keep 100 files. I will show you how to adjust this value further down.
To locate these files go to the following location:
- C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces
- As shown above, there are alot of files logged. You can highlight all of them and delete them without a problem. this will free up a few GB.
Within the Diagnostics folder there is another folder that is logging. Here is the location:
- C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs
- As you can see above, alot of log files, you can delete these text files.
Registry Change
You can change the default value of 100 files to a number you want by changing the following registry key:
- Key: MaxTraceFileCount
- Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing
IIS Log Files
IIS Log files write to the C:\inetpub directory by default, you can change this to another drive etc. These files can be 200mb+ and overtime will use up space on the drive. To delete them open up the following location:
- C:\inetpub\logs\LogFiles
- Inside this folder you will have 2 other folders namely W3SVC1 and W3SVC2. Inside these are log files you can delete as well.
You can also look in the following folder for the same set of folders: C:\Program Files\Microsoft\Exchange Server\V15\Logging\RpcHttp
- Here you can also delete these files.
HTTP Proxy Logs
The last place you can look as well for log files is in this location:
- C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy
Located in each of the folders some files can be 10MB in size and generate quite a few. These logs will tell you if you have errors in your environment especially the RpcHttp folder.
Conclusion
You should be able to free up a few GB’s of space.
PowerShell Script
I created a script which you can use in conjunction with Task Scheduler to clear files when you need to, you can find the script here:
Set-Executionpolicy RemoteSigned
$days=0
$IISLogPath=”C:\inetpub\logs\LogFiles\”
$ExchangeLoggingPath=”C:\Program Files\Microsoft\Exchange Server\V15\Logging\”
$ETLLoggingPath=”C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces\”
$ETLLoggingPath2=”C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs”
Function CleanLogfiles($TargetFolder)
{
write-host -debug -ForegroundColor Yellow -BackgroundColor Cyan $TargetFolder
if (Test-Path $TargetFolder) {
$Now = Get-Date
$LastWrite = $Now.AddDays(-$days)
# $Files = Get-ChildItem $TargetFolder -Include *.log,*.blg, *.etl -Recurse | Where {$_.LastWriteTime -le “$LastWrite”}
$Files = Get-ChildItem “C:\Program Files\Microsoft\Exchange Server\V15\Logging\” -Recurse | Where-Object {$_.Name -like “*.log” -or $_.Name -like “*.blg” -or $_.Name -like “*.etl”} | where {$_.lastWriteTime -le “$lastwrite”} | Select-Object FullName
foreach ($File in $Files)
{
$FullFileName = $File.FullName
Write-Host “Deleting file $FullFileName” -ForegroundColor “yellow”;
Remove-Item $FullFileName -ErrorAction SilentlyContinue | out-null
}
}
Else {
Write-Host “The folder $TargetFolder doesn’t exist! Check the folder path!” -ForegroundColor “red”
}
}
CleanLogfiles($IISLogPath)
CleanLogfiles($ExchangeLoggingPath)
CleanLogfiles($ETLLoggingPath)
CleanLogfiles($ETLLoggingPath2)
Exchange 2010 Log File PowerShell Script:
For those that would like to see how to do the Task Scheduler I have put together some screenshots as there have been a number of requests for it:
Open up Task Schedular and Select New Task. The above window will show. Enter the following:
- Name
- You can change the User to one that has full Exchange access or leave it with the user currently logged in if it has rights.
- Run whether the user is logged on or not
- Run with the highest privileges (tick the box)
- Configure for :- Windows Server 2012 R2
Next step, click on the Triggers Tab as show above and then click New…
The above window will show, choose your schedule and then click OK.
Once you have created the Trigger, it will show as above.
Next step is to click on the Actions Tab and then on the New… Button.
The window above will show, here you will configure the following:
- Action – Start a program
- Program/script :- You can paste the below in or browse to the directory listed and choose Powershell.exe:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- In the Add arguments (Optional) section, enter in the following:
-NonInteractive -WindowStyle Hidden -command “& ‘C:\Program Files\Microsoft\Exchange\V15\Scripts\Clearlogs.ps1′”
I put the script in the Scripts folder where Exchange is installed, if you have it in another location then just change the path.
When you done, click the OK button.
Once complete you will see the action as shown above. Click the OK button to finish.
A window will popup confirming the Task, enter in the credentials of the user specified in the beginning.
Hope it helps.
Hello Edward,
let me say BIIIIIIIIIIIIIIIIIIG thanks for you.
This is amazing, thank you for publishing.
Similar to above, do you have a method for reducing database logs? I have had Exchange 2016 installed for ~6 weeks, so still finding my way around.
In my database folder I have 308,000 1mb log files, do you know where the set limit properties are for this? example file name: E010000A000.log
Thanks
Actually this was an issue with backup jobs not clearing logs.
Thanks again.
Hi, yes you backups are not truncating the logs.
Get this man a medal, admin of the year or something!
Thank you!
Thank you VERY much. This solved a problem I had with Outlook clients being able to use Autodiscover to setup their profiles. The error was the server was offline.
MAN, does that thing log or what :-). Went from 0 to 2.6GB in about 15 minutes.
Its a pleasure, glad it helped you. Yeah it does create alot of log files, i would advise if you can increase your drive where you have Exchange installed and then let the script run as a scheduled task daily.
Its a pleasure, glad it helped you. Yeah it does create alot of log files, i would advise if you can increase your drive where you have Exchange installed and then let the script run as a scheduled task daily.
This was very specific and immediately solved my issue. Many thanks
Extremely helpful, thanks!
Hi,
I’m trying to setup a batch file to remove the .etl files however when i run via Task Scheduler or the batch file itself it doesn’t clear these files.
forfiles -p “C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces” -m *.etl /D /C “cmd /c del @path”
Thanks
Good Article but an update is needed for Exchange 2016
I found that the Health Manager Service was re-enabled and restarted each time i disabled and stopped it.
Exchange 2016 has an Exchange Health Manager Recovery service, which also needs to be stopped and disabled to prevent this.
Great script, thanks so much. I did have a bit of trouble with the scheduled task though. What I ended up getting to work was just “PowerShell” in the program to start; “.\Clearlogs.ps1” in the arguments field and my path “C:\Scripts\” in the Start in field.
Thanks!
This works for me too.
thank you very much. helped me to reclaim 16GB on my exchange 2016 demoserver.
thumbs up 🙂
Hi,
the script isn’t working correctly, because on line 15 you’ve included a full path and not $TargetFolder.
The TechNet Gallery no longer exists and the script is not available.
Set-Executionpolicy RemoteSigned
$days=0
$IISLogPath=”C:\inetpub\logs\LogFiles\”
$ExchangeLoggingPath=”C:\Program Files\Microsoft\Exchange Server\V15\Logging\”
$ETLLoggingPath=”C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces\”
$ETLLoggingPath2=”C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs”
Function CleanLogfiles($TargetFolder)
{
write-host -debug -ForegroundColor Yellow -BackgroundColor Cyan $TargetFolder
if (Test-Path $TargetFolder) {
$Now = Get-Date
$LastWrite = $Now.AddDays(-$days)
# $Files = Get-ChildItem $TargetFolder -Include *.log,*.blg, *.etl -Recurse | Where {$_.LastWriteTime -le “$LastWrite”}
$Files = Get-ChildItem “C:\Program Files\Microsoft\Exchange Server\V15\Logging\” -Recurse | Where-Object {$_.Name -like “*.log” -or $_.Name -like “*.blg” -or $_.Name -like “*.etl”} | where {$_.lastWriteTime -le “$lastwrite”} | Select-Object FullName
foreach ($File in $Files)
{
$FullFileName = $File.FullName
Write-Host “Deleting file $FullFileName” -ForegroundColor “yellow”;
Remove-Item $FullFileName -ErrorAction SilentlyContinue | out-null
}
}
Else {
Write-Host “The folder $TargetFolder doesn’t exist! Check the folder path!” -ForegroundColor “red”
}
}
CleanLogfiles($IISLogPath)
CleanLogfiles($ExchangeLoggingPath)
CleanLogfiles($ETLLoggingPath)
CleanLogfiles($ETLLoggingPath2)
I pasted in the script, just copy it to notepad and save as a PS1 file and run it and you should be good