How to Move Exchange Server 2013 Logging Directory

Exchange Server 2013 introduces a whole slew of improvements and new features. According to a posting over on TechNet, Exchange 2013 “…has drastically increased the amount of logging that happens by default.   So much so that the suggested free space for the install of 2013 on the C: drive is now up to 30 GB.” No kidding. A two-week old installation which I was working on already had over 11GB of log files piled up.

In space constrained installations (or if you simply prefer centralizing logs in a central location) moving Exchange logs to another location may be desired.

There are a variety of scripts out there that provide guidance on relocating individual logs. Here is the way I moved the log files from the default location of “C:\Program Files\Microsoft\Exchange Server\V15\Logging” to “D:\ExchangeData\Logs”

On the Exchange 2013 server, open the Power Shell ISE and crate a script with the following:

# Obtain and set the local computer name
$exchangeservername = $env:computername

# Move the standard TransportService log files to D:\ExchangeData\Logs
Set-TransportService -Identity $exchangeservername `
-ConnectivityLogPath “D:\ExchangeData\Logs\Connectivity” `
-MessageTrackingLogPath “D:\ExchangeData\Logs\MessageTracking” `
-IrmLogPath “D:\ExchangeData\Logs\IRMLogs” `
-ActiveUserStatisticsLogPath “D:\ExchangeData\Logs\ActiveUsersStats” `
-ServerStatisticsLogPath “D:\ExchangeData\Logs\ServerStats” `
-ReceiveProtocolLogPath “D:\ExchangeData\Logs\ProtocolLog\SmtpReceive” `
-RoutingTableLogPath “D:\ExchangeData\Logs\Routing” `
-SendProtocolLogPath “D:\ExchangeData\Logs\ProtocolLog\SmtpSend” `
-QueueLogPath “D:\ExchangeData\Logs\QueueViewer” `
-WlmLogPath “D:\ExchangeData\Logs\WLM” `
-PipelineTracingPath “D:\ExchangeData\Logs\PipelineTracing” `
-AgentLogPath “D:\ExchangeData\Logs\AgentLog”

From within the Exchange Management Shell, locate and execute the PowerShell PS1 script you just created.

Next, we need to relocate all the other Exchange logs. Instead of manually moving or reconfiguring each log, I opted to use a directory symlink to “move” all the other Exchange logs to the new location. Here’s how I did it:

Stop all Exchange Server services, the World Wide Web Publishing service, as well as any other services or processes that may have file locks on the “C:\Program Files\Microsoft\Exchange Server\V15\Logging” directory.

After stopping all Exchange Server services, open an elevated command prompt and do the following:

cd C:\Program Files\Microsoft\Exchange Server\V15
rename logging logging-old

If you receive an “access denied” error, you may need to use Procmon to help identify the processes with file locks on this folder. Find / stop / kill those processes and try again.

Next, create a symbolic link to point the default Exchange logging folder to the new location:

mklink /d “C:\Program Files\Microsoft\Exchange Server\V15\Logging” D:\ExchangeData\Logs

Then, copy all of the existing log files to the new location:

xcopy /e /i logging-old D:\ExchangeData\Logs

Instead of reconfiguring the location for each individual log, the above will cause Exchange to simply redirect all logging to the symbolically linked location. NOTE: installation of major patches (like Cumulatve Update 5) will destroy the symbolic link for the “logging” folder. Use the steps above to re-configure logging if necessary.

Posted in Microsoft
Tags: ,