Request assistance in Exchange Log file review on ever increasing C drive on Win 2012r2 Exchange 2013 multi-role server.

Data -
C:\...\V15 folder size - 47 GB
Of this:
Logging folder =25.6 GB
TransportRoles folder = 13 GB
FrontEnd folder = 8 GB

Mail DB and transport logs are located on Mount points and not on C drive
Pagging file is managed by server and is equal to just over RAM size.

Questions -
Are these \V15 folder sizes normal?
What logs can I trim down with Minimal risk if I need to get some space?
What logs (and command) can I easily move to another drive?
How long are these logs saved? Can I safely shorten this time?

Thank you,
Who is Participating?
hecgomrecConnect With a Mentor Commented:
Yes there is a way to do it.

You can do this:

Lets do the fast ones first

Get-TransportServer | foreach {

Set-TransportServer -MessageTrackingLogPath “D:\Exchange\Logs\MessageTracking”
Set-TransportServer -ConnectivityLogPath “D:\Exchange\Logs\Connectivity”
Set-TransportServer -IrmLogPath “D:\Exchange\Logs\IRMLogs”
Set-TransportServer -ReceiveProtocolLogPath “D:\Exchange\Logs\ProtocolLog\SmtpReceive”
Set-TransportServer -RoutingTableLogPath “D:\Exchange\Logs\Routing”
Set-TransportServer -ActiveUserStatisticsLogPath “D:\Exchange\Logs\ActiveUserStats”
Set-TransportServer -ServerStatisticsLogPath “D:\Exchange\Logs\ServerStats”
Set-TransportServer -SendProtocolLogPath “D:\Exchange\Logs\ProtocolLog\SmtpSend”


This will move those logs for all the transport servers in your Exchange organization to a specific drive (D:\), so if you have only one server, or you want different target log paths per server, you'll have to type the command in the format:

Get-TransportServer – %servername% {

Set-TransportServer -MessageTrackingLogPath “D:\Exchange\Logs\%servername%\MessageTracking”  .....


Where %servername% is your exchange server.

Now for the rest, you'll need to stop Exchange services to release the lock on the logging directory and log files, this mean time down so plan ahead.

Open an elevated administrator command prompt, type:

cd C:\Program Files\Microsoft\Exchange Server\V15

rename logging logging.old

mklink /D C:\Program Files\Microsoft\Exchange Server\V15\Logging > D:\Exchange\Logs

xcopy /E /I logging.old D:\Exchange\logs

This will rename the log directory,  create a link to your new path and copy subdirectories and log files to the new location.

mklink allows Exchange to continue logging to its default directory, but it is really linked to your new path.

Start exchange services and make sure logs are getting updated on the new location; When ready you can delete the “logging.old” directory to reclaim the drive space.

Here is a link to Microsoft TechNet with another way:

Here is the script (L:\ is where your files will be placed, replace as needed):

# ------------------------
# MoveEX2013logs.ps1
# ------------------------
# Version 1.0 by KSB
# This script will move all of the configurable logs for  Exchange 2013 from the C: drive
# to the L: drive.  The folder sub tree and  paths on L: will stay the same as they were on C:
# Get the name of the local computer and  set it to a variable for use later on.

$exchangeservername = $env:computername

# Move the standard log files for  the TransportService to the same path on the L: drive that they were on C:  

Set-TransportService -Identity $exchangeservername  `
-ConnectivityLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\Connectivity" `
-MessageTrackingLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking" `
-IrmLogPath "L:\Program Files\Microsoft\Exchange Server\V15\Logging\IRMLogs" `
-ActiveUserStatisticsLogPath "L:\Program Files\Microsoft\Exchange\Server\V15TransportRoles\Logs\Hub\ActiveUsersStats" `

-ServerStatisticsLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ServerStats" `

-ReceiveProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive" `

-RoutingTableLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\Routing" `

-SendProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend" `

-QueueLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\QueueViewer" `

-WlmLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\WLM" `

-PipelineTracingPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\PipelineTracing" `

-AgentLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\AgentLog"

# move the path for  the PERFMON logs from the C: drive to the L: drive

logman -stop ExchangeDiagnosticsDailyPerformanceLog

logman -update ExchangeDiagnosticsDailyPerformanceLog -o "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs\ExchangeDiagnosticsDailyPerformanceLog"

logman -start ExchangeDiagnosticsDailyPerformanceLog

logman -stop ExchangeDiagnosticsPerformanceLog

logman -update ExchangeDiagnosticsPerformanceLog -o "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\PerformanceLogsToBeProcessed\ExchangeDiagnosticsPerformanceLog"

logman -start ExchangeDiagnosticsPerformanceLog

# Get the details on the EdgeSyncServiceConfig and  store them in a variable for use in setting the path


# Move the Log Path using the variable we got

Set-EdgeSyncServiceConfig -Identity $EdgeSyncServiceConfigVAR.Identity -LogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\EdgeSync"

# Move the standard log files for  the FrontEndTransportService to the same path on the L: drive that they were on C:

Set-FrontendTransportService  -Identity $exchangeservername  `

-AgentLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\AgentLog" `

-ConnectivityLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\Connectivity" `

-ReceiveProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive" `

-SendProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend"

# MOve the log path for  the IMAP server

Set-ImapSettings -LogFileLocation "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Imap4"

# Move the logs for  the MailBoxServer

Set-MailboxServer -Identity $exchangeservername  `

-CalendarRepairLogPath "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Calendar Repair Assistant" `

-MigrationLogFilePath  "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Managed Folder Assistant"

# Move the standard log files for  the MailboxTransportService to the same path on the L: drive that they were on C:

Set-MailboxTransportService -Identity $exchangeservername  `

-ConnectivityLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\Connectivity" `

-MailboxDeliveryAgentLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\AgentLog\Delivery" `

-MailboxSubmissionAgentLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\AgentLog\Submission" `

-ReceiveProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpReceive" `

-SendProtocolLogPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend" `

-PipelineTracingPath "L:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\PipelineTracing"

# MOve the log path for  the POP3 server

Set-PopSettings -LogFileLocation "L:\Program Files\Microsoft\Exchange Server\V15\Logging\Pop3"


Good Luck!!!
Neil RussellTechnical Development LeadCommented:
Exchange logs are truncated by using an Exchange aware backup application.  A full backup will truncate the logs.
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
That is Exchange transaction logs. These aren't transaction logs.
They would appear to be regular logs, logs of activity. Therefore you can delete those whenever you like. You should probably review them first though, particularly the dates.
For example if the logs are only a couple of days old that could indicate the server is being abused.

As for how long the logs are retained for, that is usually set within Exchange.
get-transportservice | select *protocollog* will show you the protocol logs, including the maximum time (30 days is the default).

Whether the logs are bad, depends on many factors. If you have two users sending 10 emails a day, then maybe not. If you have 1000 users send 100 emails a day, then maybe it is fine.
You can move the paths if you wish, however that simply moves new logs, the old ones will stay where they are.


Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

I just went and check my size for those folders and in total I have about 15GB.

This is for an organization with only 1 CAS and 2 mailbox servers, 85 users and is being running exchange 2013 for the past 8 months.

So depending on your settings this might be normal.  I guess your virtual is running low on hard disk.

As Simon stated you can delete most of the old ones or just move them out of the way or back them up and delete everything to regain your space.
swfwmd2Author Commented:
Thank you for your input.
What is the procedure/script to move the location of the future logs? There are several different logs, can they all be moved to a new location?
Simon Butler (Sembee)ConsultantCommented:
No single script. Just change the paths that you can see. I usually follow the same kind of folder structure as they have by default, so they are separated out.
All of the logs can be moved. Not all of the changes take effect immediately, some require service restarts.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.