After installing Exchange 2013 CU6, you may notice the Exchange Drive is consumed a lot than before and the size is increasing rapidly. After troubleshooting, you may find everything is running properly and there is no issues with your Exchange Server.

Then you need to check whether the files in the following location is the root cause:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\logfie

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces

(You may find log files like DocumentProcessingTrace_XX.etl )

Prior to CU6, there is not ETLTrace folder listed in this location and there are log folders however the log file has files no exceeding 7 MB size.

Post upgrade, there comes the ETLTrace folder and the files in this folder are close to 50 MB and the log files folder have log files exceeding 50 MB size.

This is a designed behavior in Exchange CU6, if you have limited hard drive space, as a workaround solution, we can safely remove or move the location of these lo files:

Before doing the changes, please firstly stop the health monitoring service. To Change the Log File Path, the Registry Key value is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Search Foundation for Exchange\Diagnostics

To Change the ETLTrace path the registry Value is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing

ETL file generation can not be disabled, but you can set the file generation from 100 to e.g. 10 files. I got the confirmation raising a premier call.

• Edited by Max Grillenberger Friday, December 19, 2014 9:13 PM Update after MS premier call

ETL file generation can not be disabled, but you can set the file generation from 100 to e.g. 10 files. I got the confirmation raising a premier call.

• Edited by Max Grillenberger Friday, December 19, 2014 9:13 PM Update after MS premier call

ETL file generation can not be disabled, but you can set the file generation from 100 to e.g. 10 files. I got the confirmation raising a premier call.

• Edited by Max Grillenberger Friday, December 19, 2014 9:13 PM Update after MS premier call

@Simon_Wu, I tried your solution. However after a couple of days the logs were moved back to the original, default location. It looks like the server has a process which checks for hacks and undoes any attempts to change the path.

Interestingly the altered Registry entries remained altered, however the files were switched back to the default location. It generates just over 1Gb of logs per day on a largely idling Exchange 2013 CU7 server with 350 mailboxes.

Go figure!

What I found to work consistently and reliably is to replace default folders with junction points to another folder on another drive.

I also found that these files are created by a process which runs under the System process (PID 4), therefore you'll need to restart the server in Safe Mode to replace the default folders with junction points.

Max, can you share where it can be changed?

Thanks.

Max,

Please let us know how we can reduce the number of these files.

Can anyone explain the value of these files?  Can they safely be excluded from our backups?

I'm sure that the programmers don't care about another 1 GB per day that eventually rolls over but in the real world, our backups are copying the files every night.  The backup doesn't know that they are not needed after x amount of time so they're kept as long as we keep the backups.

I would like to know where I can change this as well please :)

To change the number of files kept (default 100), edit the decimal value of the MaxTraceFileCount key at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing

Hope this helps!