EXCHANGE 13/16清理IIS LOGS日志檔案（含腳本）Exchange 2013 Logging: Clear outthe log files

EXCHANGE 2013\2016清除IIS LOGS 日志檔案。

在完成安裝後，即使EXCHANGE不安裝在系統盤也會在系統盤下生成IIS日志檔案，使用RPC overHTTP或Mapi overHTTP協定，是以都是IIS提供各種服務，這些日志是每次使用者連接配接到exchange時的日志，可以用來診斷連接配接問題或者安全問題。

預設位置：C:\inetpub\logs\LogFiles（預設C為系統盤的話）

可以在IIS管理器裡面更改存儲目錄為别的盤符，并直接删掉這些目錄檔案，也可使用腳本進行清理。

IIS管理器位置截圖：

<a href="http://s3.51cto.com/wyfs02/M01/8B/CE/wKioL1hZ1B7DalcaAAC5qaSMmEw819.png-wh_500x0-wm_3-wmp_4-s_554975616.png" target="_blank"></a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#Diagnostic_Logs" target="_blank">Diagnostic Logs</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#ETL_Files" target="_blank">ETL Files</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#Registry_Change" target="_blank">Registry Change</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#IIS_Log_Files" target="_blank">IIS Log Files</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#HTTP_Proxy_Logs" target="_blank">HTTP Proxy Logs</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#Conclusion" target="_blank">Conclusion</a>

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#PowerShell_Script" target="_blank">PowerShell Script</a>

In your Exchange 2013 environment you may be wondering why the space on yourC:\ drive where Exchange is installed is filling up so quickly. 

Thisis due to the amount of logging Exchange 2013 does by default. Microsoft turnedthis on to assist them with more rapid assistance with customers instead ofwaiting for logs.

FromCU6 for Exchange 2013, .etl files were created. With the current build Exchange2013 creates 50MB files at a time with a maximum of 100 files. For smallerbusinesses this is not ideal.

Theother feature that logs weekly and daily files is the Diagnostic logs (Healthexplorer). This will generate files up to 5GB over a week/month. Some of youmight want that space because you are limited with the current hardware youhave.

Theother player here is IIS logs. These can generate quite a bit and at 500MB+ alog file you can run out of space rather quickly.

Lastly,another set of logs that could be filling up is the HTTP Proxy log. Thislog will fill up in most cases when you have issues and will create an hourlyfile from 4MB onward.

Inthis article we will go through each of the following logs below and explainhow you can maintain them or turn them off:

themoff:

<a href="http://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx#IIS_Log_Files" target="_blank">IIS Logs</a>

Lastly,a PowerShell script is available to run a clean up without having to go intoeach folder.

HealthManager runs and collects information about the health of the system. If youhave ample space this is fine but if you have an 80GB C:\ drive your drive isgoing to fill up in less than a few days. If you need to disable this featureyou can do so as follows:

Openup Services.msc,

<a href="http://s3.51cto.com/wyfs02/M02/8B/D2/wKiom1hZ1F-TiiKJAAE94rukZho392.png-wh_500x0-wm_3-wmp_4-s_2366046194.png" target="_blank"></a>

Locate     the Microsoft Exchange Health Manager Service.

Double     click the service and change the startup to disabled. 

Stop     the service if it is running.

<a href="https://collaborationpro.com/wp-content/uploads/2015/05/HM2.png" target="_blank"></a>

<a href="http://s2.51cto.com/wyfs02/M00/8B/CE/wKioL1hZ1I7D31bjAAEhKqqbGQk037.png-wh_500x0-wm_3-wmp_4-s_2295761413.png" target="_blank"></a>

The     next service to locate is the Microsoft Exchange Diagnostics Service.

Follow     the same steps as above to stop and disable the service.

Thenext thing to stop/disable is the task that runs. Open up Task Scheduler.

disable is the taskthat runs. Open up Task Scheduler.

<a href="https://collaborationpro.com/wp-content/uploads/2015/05/HM3.png" target="_blank"></a>

<a href="http://s2.51cto.com/wyfs02/M01/8B/D2/wKiom1hZ1L-wCZ3XAAB4Yop89Jg097.png-wh_500x0-wm_3-wmp_4-s_2093392295.png" target="_blank"></a>

·   In TaskScheduler, expand Microsoft -&gt; Windows and then click on PLA.

·   You will seetwo tasks, first stop them if they running and then disable them.

The next step is toclear out the logs created by Diagnostics. Open up Explorer.

<a href="https://collaborationpro.com/wp-content/uploads/2015/05/HM4.png" target="_blank"></a>

<a href="http://s5.51cto.com/wyfs02/M01/8B/CE/wKioL1hZ1OOjWT5zAACwbc45SMk757.png-wh_500x0-wm_3-wmp_4-s_3162161042.png" target="_blank"></a>

Navigate toC:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostic.

·   In there youwill have two folders, one called DailyPerformanceLogs and theother PerformanceLogsToBeProcessed.

·   You candelete all the log files located in these two. The logs to beprocessed will contain 20MB files while the daily logs will be +/- 1GB.

Thesefiles are generated almost every hour and are about 50MB in size. The defaultregistry entry for this is to keep 100 files. We will adjust this value furtherdown.

Tolocate these files go to the following location:

C:\Program     Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces    

<a href="http://s2.51cto.com/wyfs02/M00/8B/D2/wKiom1hZ1RWiG_FsAAEQE2Zvlbo942.png-wh_500x0-wm_3-wmp_4-s_83527337.png" target="_blank"></a>

·   As shownabove, there are a lot of files logged. You can highlight all of them anddelete them without a problem. This will free up a few GB.

Within theDiagnostics folder there is another folder that is logging. Here is thelocation:

·   C:\ProgramFiles\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs

As you can see above, a lot of log files are here and youcan delete these text files.

Youcan change the default value of 100 files to a number you want by changing thefollowing registry key:

Key:     MaxTraceFileCount

Registry     Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office     Server\16.0\Search\Diagnostics\Tracing

IISLog files write to the C:\inetpub directory by default. You can changethis to another drive, etc. These files can be 200MB+ and overtime will use upspace on the drive. To delete them, open up the following location:

C:\inetpub\logs\LogFiles    

<a href="https://collaborationpro.com/wp-content/uploads/2015/05/HM7.png" target="_blank"></a>

<a href="http://s1.51cto.com/wyfs02/M02/8B/D2/wKiom1hZ1WCAPegcAACC2sVokk0295.png-wh_500x0-wm_3-wmp_4-s_954370087.png" target="_blank"></a>

·   Inside thisfolder you will have two other folders namely W3SVC1 and W3SVC2.Inside these are log files you can delete as well.

You can also lookin the following folder for the same set of folders: C:\ProgramFiles\Microsoft\Exchange Server\V15\Logging\RpcHttp

<a href="https://collaborationpro.com/wp-content/uploads/2015/05/HM8.png" target="_blank"></a>

<a href="http://s3.51cto.com/wyfs02/M00/8B/CE/wKioL1hZ1Xvh6klXAAB6zhMtKGQ789.png-wh_500x0-wm_3-wmp_4-s_2520686448.png" target="_blank"></a>

Here you canalso delete these files.

Thelast place you can look as well for log files is in this location:

C:\Program     Files\Microsoft\Exchange Server\V15\Logging\HttpProxy

Locatedin each of the folders some files can be 10MB in size and generate quite a few.These logs will tell you if you have errors in your environment especially theRpcHttp folder.

Youshould be able to free up a few GBs of space.

Ascript was also created which you can use in conjunction with Task Scheduler toclear files when you need to. You can find the script here:

<a href="https://gallery.technet.microsoft.com/Clear-Exchange-2013-Log-71abba44" target="_blank">https://gallery.technet.microsoft.com/Clear-Exchange-2013-Log-71abba44</a>

以上連結可下載下傳清理腳本。

 本文轉自 煙台小崔 51CTO部落格，原文連結:http://blog.51cto.com/seawind/1884577