Microsoft Exchange
Exchange 2013 adds a substantial number of logs to help aid in diagnostics, transport troubleshooting, OWA, etc. These logs are stored by default in “C:Program FilesMicrosoftExchange ServerV15Logging”.
While this is great for day to day operations and system health, it can be a detriment to organizations with disk space budgets. Generally in this day and age of cheap storage this isn’t an issue (and Microsoft recommends at least 30GB for the drive location that Exchange is installed on partly because of this) however you may come across a need to move these logs. Some can be moved quickly and easily, but others have no fast way to move them.
To get them all moved off the system drive, first tackle the easy ones using an Exchange Management shell command:
Get-TransportServer | foreach {
Set-TransportServer -MessageTrackingLogPath “S:LogsMessageTracking”
Set-TransportServer -ConnectivityLogPath “S:LogsConnectivity”
Set-TransportServer -IrmLogPath “S:LogsIRMLogs”
Set-TransportServer -ActiveUserStatisticsLogPath “S:LogsActiveUserStats”
Set-TransportServer -ServerStatisticsLogPath “S:LogsServerStats”
Set-TransportServer -ReceiveProtocolLogPath “S:LogsProtocolLogSmtpReceive”
Set-TransportServer -RoutingTableLogPath “S:LogsRouting”
Set-TransportServer -SendProtocolLogPath “S:LogsProtocolLogSmtpSend”
}
The above command will move these eight log paths for all the transport servers in your Exchange organization, so if you plan to move only one server, or if your target log paths are different for each server, you will have to issue the command differently:
Get-TransportServer – %servername% {
Set-TransportServer -MessageTrackingLogPath “S:ExchangeLogsMessageTracking”
Set-TransportServer -ConnectivityLogPath “S:ExchangeLogsConnectivity”
Set-TransportServer -IrmLogPath “S:ExchangeLogsIRMLogs”
Set-TransportServer -ActiveUserStatisticsLogPath “S:ExchangeLogsActiveUserStats”
Set-TransportServer -ServerStatisticsLogPath “S:ExchangeLogsServerStats”
Set-TransportServer -ReceiveProtocolLogPath “S:ExchangeLogsProtocolLogSmtpReceive”
Set-TransportServer -RoutingTableLogPath “S:ExchangeLogsRouting”
Set-TransportServer -SendProtocolLogPath “S:ExchangeLogsProtocolLogSmtpSend”
}
Where %servername% is your exchange server.
Next, the more difficult to move logs. Unfortunately this method will require you to stop your Exchange services so it will release the file lock on the logging directory and log files so plan an appropriate outage window.
After you have stopped all Exchange Services, from an elevated administrator command prompt, type these commands:
cd C:Program FilesMicrosoftExchange ServerV15
rename logging logging-old
mklink /D C:Program FilesMicrosoftExchange ServerV15Logging > S:ExchangeLogs
xcopy /E /I logging-old s:Exchangelogs
This set of commands will rename the current log directory, then create a junction link to your new path, and finally copy the old subdirectories and log files to the new location.
Using the mklink command will allow Exchange to continue logging to what it believes it the default directory, but it is really linked to your new path, in this example on the dedicated S drive.
You can now start your exchange services and verify the logs are going to the new location, then delete the “logging-old” directory and reclaim your system drive space.
Joe Hanning, PEI
Great article, very informative and easy to follow.
The one thing I noted was that I was not able to rename the “Logging” directory due to an error message “access denied” even though I had launched CMD with elevated
I had to end up stopping 2 scheduled tasks as listed below
ExchangeDiagnosticsDailyPerformanceLog
ExchangeDiagnosticsPerformanceLog
They are found in
After stopping the 2 tasks, renaming the “logging” directory worked.
And in regards to the syntax for the mklink command, I noticed a “>” symbol, once I removed it the command worked.
Otherwise I received another “Access denied” message.
Needed to stop IIS before renaming logging folder