Hi forum,

In my Exchange 2013 environment I am monitoring the log files and noticing a growth.

The ExchangeInstallPath=D:\Program Files\Exchange\ (Normally \Program Files\Microsoft\Exchange Server\V15)

Disk Volume sizes: C: = 80GB total and D: = 50GB total

Current logging, Transport Roles and bin usage:

C:\InetPub\Logs\LogFiles\W3SVC2          10.1 GB

C:\Windows\System32\WinEvt                     04.3 GB

$ExchangeInstallPath\Logging                   18.2 GB

$ExchangeInstallPath\TransportRoles            10.1 GB

$ExchangeInstallPath\Bin\Search\Ceres\Diag..   05.3 GB

I am using the Exchange Server 2013 Cleanup Script which seems to work from our RES Automation Management server.

https://gallery.technet.microsoft.com/office/Exchange-Server-2013-dc65361b#content

What concerns me is our policy which states:

All IIS logs are disabled on all web servers and will only be enabled to troubleshoot incidents.

What is Microsofts best practices for IIS and the other log directories?

My understanding is IIS can be disabled but the others are used by exchange health and Managed Availability.

There is also a PS script to relocate the logs, Im not interested in that, just disabling..

Any ideas?

Personally, I hate disabling logging.  Before I started working with Exchange I worked support for a software vendor so I have an appreciation for having logs.  Without the logging enabled, it makes troubleshooting an issues more drawn out they need to be, since you will not have the logging from the first time the issue is noticed and you have to wait for it to reproduce itself again. I usually set the logs to be removed via a powershell script after its been around for 30 days.

Microsoft wants you to keep as much logging as possible enabled.

The "logging" directory will eventually start cleaning itself up. You'll start seeing event 1013 warnings when it's doing it's cleaning - "Potential data loss warning in RetentionAgent: RetentionAgent: Warning: Potential data loss. The size of this folder C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs has reached 95% of max size allowed - 5120 MB. Some data will be purged once it reaches the max limit."

The Transport logs should clean themselves up periodically (I think every 30 days).

The IIS log are another story. You'll need to script a cleaning for those.

Hi TimTTy,

Thank you for your question.

As above the suggestion. Because we didnt know when Exchange will go something wrong, we should enable IIS log(it should be referred to company policy), this log will be very convenient for us to troubleshoot.

The other path log was enabled for us to troubleshoot other issue, for example if message has anything wrong, we could see logging under $ExchangeInstallPath\TransportRoles for our troubleshooting.

We could create backup policy on logging in organization instead of disable them. If there are big size of logging, backup them(it is better out of production hour), then delete then after a period time.

In a general, we should enable Exchange logging and backup them.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

Microsoft wants you to keep as much logging as possible enabled.

The "logging" directory will eventually start cleaning itself up. You'll start seeing event 1013 warnings when it's doing it's cleaning - "Potential data loss warning in RetentionAgent: RetentionAgent: Warning: Potential data loss. The size of this folder C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs has reached 95% of max size allowed - 5120 MB. Some data will be purged once it reaches the max limit."

The Transport logs should clean themselves up periodically (I think every 30 days).

The IIS log are another story. You'll need to script a cleaning for those.

• Proposed as answer by Alceryes Tuesday, May 12, 2015 5:09 PM
• Marked as answer by TimTTY 20 hours 38 minutes ago

Thanks,

I will inform management and Admins on Microsoft's view on this topic and purge the logs on a more frequent basis. If they insist then only the IIS logs will be disabled.

Tnx

Tim