How to Move and Truncate Logs in Exchange 2013

After Exchange deployment, it turns out that in spite all requirements to the amount of free space for Exchange Server have been met, it is inevitably reducing… When trying to deal with it, we realize that different logs grow faster than we could expect. What can we do with them? Below you can find some ways to truncate/move these logs, i.e. everything that helps to cope with the problem. Please note, that all the info can be obtained from technet and it is only listed in this article to become a reference on the means of dealing with space issues due to log growth.

Transaction logs

The transaction log is the most important Exchange element. For instance: when sending a email message, firstly, it is  recorded in the transaction log. Before the transaction is transferred to the Exchange database, these data exist only in the system memory and transaction logs. In case of a failure, the system memory is lost, and all you have is the transaction logs. These logs are important for recovery of the damaged database. The same is true for the other transactions: received messages, deleted elements and messages moved to other folders. So these logs grow very fast. How to reduce them?

1. Backup

One of the functions performed after full or incremented backup has been successful is the truncation of transaction logs that are no longer necessary to database recovery. Exchange 2013 supports only Exchange backups based on Volume Shadow Copy (VSC).

A good article on backup setting with Windows Server Backup is here.

2. Enabled Circular Logging

When circular logging is enabled, the transaction log is cleared right after the transactions have been moved to the database.

Circular Logging is enabled in the EAC as follows:

When the circular logging of the Extensible Storage Engine is enabled, the additional log files are not created. If necessary, the current log file is renewed. However, in the continuous replication environment (DAG) the log files are necessary for logs deliver and replay. As a result, if the circular logging of the continuous replication is enabled, the current log file is not overwritten, and the closed log files are created to deliver and replay the logs, i. e. log continuity is provided and the logs are not removed until they are necessary for the replication. Microsoft Exchange Replication Service and Microsoft Exchange Information Store service interact over Remote Procedure Call (RPC), that deals with which log files can be removed.

3. Moving Transaction Logs

Finally we can move the logs along with the database to another location/drive.

To do it, there is a suitable cmdlet Move-DatabasePath. Here is an example of moving the database MDB01 and transaction logs to the corresponding directories on the disk M:\:

Move-Databasepath “MDB1” –EdbFilepath “M:\DB\MDB1\databases\mdb1.edb” –LogFolderpath “M:\DB\MDB1\logs\”

Queue Database

This is certainly not the logs, but if you need to free up some space, moving this database can help you. Queue Database is a temporary storage of messages awaiting for the next processing stage. Each queue is a logical set of messages that are processed by a transport server in a certain order. All queues are stored in a single database ESE. The queues are located only on the mailbox or the edge transport servers. The location of the queue database and its transaction logs is managed by the keys in the XML configuration file %ExchangeInstallPath%Bin\EdgeTransport.exe.config.

All you can do with it is to move it to another location. For a pretty detailed information on moving, see Change the Location of the Queue Database section.

Transport Logs

Transport logs provide information on what is going on the transport pipeline. For a detailed information on how to enable/disable or move the logs, see Transport Logs section on technet.

The following transport logs are available in Microsoft Exchange Server 2013:

• Agent logs
• Connectivity logs
• Message tracking and delivery reports
• Pipeline tracing
• Protocol logs
• Routing table logs

This is now you can change the path to Protocollogs using EAC: servers\servers\select_a_server\transport logs\protocol log

To change the path to Message Tracking using EAC: servers\servers\select_a_server\transport logs\message tracking log.

Please, note that you can move it only to the local folder. The issue with the location on the network resource can be solved using the command mklink and making a link to the network resource. For example, make the link

mklink /d "D:\HubReceiveSMTPLogs" \\Servername\HubReceiveSMTPLog

Now using Set-TransportService cmdlet and –ReceiveProtocolLogPath parameter “D:\HubReceiveSMTPLosg”, you can store ReceiveSMTP logs on the network resource. This method is suitable for other logs.

IIS log files

For example, your IIS log contains information on connecting your iPad over activesync. IIS logs can become too large in size, if uncontrolled. How to delete or move them to another drive automatically?

1. Automatic Log Removal

Run daily the following Powershell-script  with scheduler (change the path to the logs if necessary) and all IIS logs older than 50 days will be automatically deleted.

set-location c:\inetpub\logs\LogFiles\W3SVC1\
 
foreach ($File in get-childitem) {
 
   if ($File.LastWriteTime -lt (Get-Date).AddDays(-50)) {
 
      del $File
   }
 
}

You can run the PoSH script via the scheduler as follows:

1. Create a task in the scheduler
2. Create action: start a program
3. In the field program/script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
4. In the field add arguments(optional): -command “path-to-script\name.ps1”

2. Moving Logs to Another Location

1. Open IIS Manager from Administrative Tools and select Default Web Site.
2. Open Logging (double-click on Logging icon)
3. Change the log storage location (directory)
4. Save the changes. The next log file will be written to the new location.

The same can be done in Powershell:

Import-Module WebAdministration
Set-ItemProperty ‘IIS:\Sites\Default Web Site’ -name logfile.directory "M:\IISLogs"

Logging Folder

And finally, there is Logging folder located in C:\Program Files\Microsoft\Exchange Server\V15\Logging by default. A number of logs of different services is stored here and they can consume a significant amount of the disk space. Diagnostic and performance log files can take quite a lot of space. They are located in C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics folder

There is a simple solution of this problem: run automatic removal via the scheduler daily and all logs from these folders older than 21 days won’t disturb you any more:

gci ‘C:\Program Files\Microsoft\Exchange Server\V15\Logging’,’C:\inetpub\logs’ -Directory | gci -Include ‘*.log’,’*.blg’ -Recurse | ? LastWriteTime -lt (Get-Date).AddDays(-21) | Remove-Item

P.S.: I prefer to remove only diagnostics logs:

gci ‘C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics’ -Directory | gci -Include ‘*.log’,’*.blg’ -Recurse | ? LastWriteTime -lt (Get-Date).AddDays(-5) | Remove-Item