Tech Talk Live Blog

Keeping Microsoft Exchange Logging Cleaned Up

Shawn Mellinger

This will be a short post today with a very useful PowerShell example. With the introduction of Exchange 2013, Microsoft included very detailed and powerful logging. Many of the common components write to “C:\Program Files\Microsoft\Exchange Server\V15\Logging”. This is wonderful for troubleshooting an issue, as you can dive into great depth and find the problem location. However, in an Exchange environment of even our modest size, that produces over 20 gigabytes per day in text logs alone.

Now certainly we could give our Exchange installation drive a large amount of space; however, I am the type of admin who would rather be frugal in assigning storage. Otherwise, I would find that with a few hundred virtual machines that extra space allotted will add up quickly. Also under consideration is the fact that when the install drive gets too low, the message queue will start rejecting messages. This means that the logs should be kept under control to always ensure availability to receive messages.

To do so I use the following command:

gci ‘C:\Program Files\Microsoft\Exchange Server\V15\Logging’,’C:\inetpub\logs’ -Directory |gci -Include ‘*.log’,’*.blg’ -Recurse | ? LastWriteTime -lt (Get-Date).AddDays(-7) | Remove-Item

This allows me to clean up not only the Exchange logs, but also the IIS logs that accumulate as well. I prefer to keep some logging from the transport connectors in case I need to trace an issue. You can also add more folders to clean up or file types that should be included. This shows 7 days but you should determine how much you would like to keep.

The nice thing is that you can save the command to a .ps1 and schedule it via task scheduler in Windows. Then you do not have to worry about install drive space left and keep some of those pesky SCOM drive size alerts at bay.

Tech Talk Live Blog Comment Guidelines:

One of our main goals at Tech Talk Live is to build a community. It is our hope that this blog can be a forum for discussion around our content. We see commenting as an integral part of this community. It allows everyone to participate, contribute, connect, and share relevant personal experience that adds value to the conversation. Respect counts. We believe you can disagree without being disagreeable. Please refrain from personal attacks, name calling, libel/defamation, hate speech, discriminatory or obscene/profane language, etc. Comments should keep to the topic at hand, and not be promotional or commercial in nature. Please do not link to personal blog posts, websites, or social media accounts that are irrelevant to the conversation. This is considered self-promotion. We welcome links that help further the conversation and reserve the right to delete those we deem unnecessary. The appearance of external links on this site does not constitute official endorsement on behalf of Tech Talk Live or Lancaster-Lebanon Intermediate Unit 13. You are solely responsible for the content that you post – please use your best judgment. We reserve the right to remove posts that do not follow these guidelines.

Leave a Reply

Your email address will not be published. Required fields are marked *


Tech Talk Live is the only conference of its kind in the region specifically designed for IT pros in education.

1020 New Holland Avenue, Lancaster, PA 17601

(717) 606-1770