Exchange 2013 Logging – Part 1

In this multi-part blog series I review the various logging directories and associated files that are present in Exchange 2013 RTM CU1. With Exchange 2013, logging has gone up a another level.

Under the logging directory there are numerous folders containing these log files, which is why Microsoft recommends having a 30 GB volume for the Exchange installations. While that 30 GB might seem a bit like overkill, I have seen enough cases with clients having issues with disk space if they attempt to place the installation of Exchange on a volume with less space.

My goal will be to explore each one of these log directories and explore how they are configured, if they are configurable and what information contains.

CAS & Mailbox Server Roles combined Log Directories

  • AddressBook Service
  • ADDriver
  • AuthAdminLogs
  • Autodiscover
  • Calendar Repair Assistant
  • CasSyncLogs
  • ContactChangeLogging
  • ContactLinkingLogs
  • DCAdminActionsLog
  • Diagnostics
  • ECPServer
  • Ews
  • HttpProxy
  • IRMLogs
  • lodctr_backups
  • MailboxAssistantsLog
  • MailboxReplicationService
  • MigrationLogs
  • Monitoring
  • MonitoringLogs
  • OWA
  • PeopleRelevance
  • PhotoGarbageCollector
  • Powershell-Proxy
  • RPC Client Access
  • RpcHttp
  • Search
  • SetupLogs
  • Store
  • TraceLogs
  • Diagnostics\AnalyzerLogs
  • Diagnostics\CosmosLog
  • Diagnostics\DailyPerformanceLogs
  • Diagnostics\Dumps
  • Diagnostics\PerformanceLogsToBeProcessed
  • Diagnostics\Poison
  • Diagnostics\ServiceLogs
  • Diagnostics\Watermarks
  • HttpProxy\Autodiscover
  • HttpProxy\Eas
  • HttpProxy\Ecp
  • HttpProxy\Ews
  • HttpProxy\Oab
  • HttpProxy\Owa
  • HttpProxy\OwaCalendar
  • HttpProxy\PowerShell
  • HttpProxy\RpcHttp
  • MailboxReplicationService\BadItems
  • MailboxReplicationService\Failures
  • MailboxReplicationService\Requests
  • Monitoring\ECP
  • Monitoring\OWA
  • Monitoring\PublicFolders
  • Monitoring\Search
  • Monitoring\ECP\EacBackEndLogonProbe
  • Monitoring\ECP\EacBackEndPingProbe
  • Monitoring\ECP\EacCafeLogonProbe
  • Monitoring\OWA\ClientAccessProbe
  • Monitoring\OWA\MailboxProbe
  • Monitoring\OWA\ProtocolProbe
  • MonitoringLogs\STx
  • OWA\Client
  • OWA\ClientTrace
  • OWA\Server
  • OWA\ServerTrace
  • RpcHttp\W3SVC1
  • RpcHttp\W3SVC2

CAS Server Roles Combined Log Directories

  • ADDriver
  • AuthAdminLogs
  • Autodiscover
  • Diagnostics
  • Ews
  • HttpProxy
  • lodctr_backups
  • MailboxAssistantsLog
  • MailboxReplicationService
  • MigrationLogs
  • Monitoring
  • MonitoringLogs
  • OWA
  • PhotoGarbageCollector
  • Powershell-Proxy
  • RPC Client Access
  • RpcHttp
  • Search
  • SetupLogs
  • TraceLogs
  • Diagnostics\AnalyzerLogs
  • Diagnostics\CosmosLog
  • Diagnostics\DailyPerformanceLogs
  • Diagnostics\Dumps
  • Diagnostics\PerformanceLogsToBeProcessed
  • Diagnostics\Poison
  • Diagnostics\ServiceLogs
  • Diagnostics\Watermarks
  • HttpProxy\Autodiscover
  • HttpProxy\Eas
  • HttpProxy\Ecp
  • HttpProxy\Ews
  • HttpProxy\Oab
  • HttpProxy\Owa
  • HttpProxy\OwaCalendar
  • HttpProxy\PowerShell
  • HttpProxy\RpcHttp
  • Monitoring\OWA
  • Monitoring\PublicFolders
  • Monitoring\Search
  • Monitoring\OWA\ClientAccessProbe
  • Monitoring\OWA\MailboxProbe
  • Monitoring\OWA\ProtocolProbe
  • MonitoringLogs\STx
  • OWA\ServerTrace
  • RpcHttp\W3SVC1
  • RpcHttp\W3SVC2

Some sample logs files are listed below:

ADDriver

  • edgetransport.exe_Transport_2013051519-1.LOG
  • ForefrontActiveDirectoryConnector.exe__2013051520-1.LOG
  • Microsoft.Exchange.Directory.TopologyService.exe__2013051520-1.LOG
  • Microsoft.Exchange.EdgeSyncSvc.exe__2013051520-1.LOG
  • Microsoft.Exchange.Imap4.exe_PopImap_2013051518-1.LOG
  • Microsoft.Exchange.Imap4Service.exe__2013051520-1.LOG
  • Microsoft.Exchange.Pop3.exe_PopImap_2013041620-1.LOG
  • Microsoft.Exchange.Pop3Service.exe__2013051608-1.LOG
  • Microsoft.Exchange.RpcClientAccess.Service.exe__2013051608-1.LOG
  • Microsoft.Exchange.Search.Service.exe__2013051609-1.LOG
  • Microsoft.Exchange.ServiceHost.exe_EMS_2013051609-1.LOG
  • Microsoft.Exchange.Store.Service.exe__2013050718-1.LOG
  • MSExchangeDelivery.exe__2013051611-1.LOG
  • MSExchangeFrontendTransport.exe__2013051611-1.LOG
  • MSExchangeHMHost.exe_MSExchangeHM_2013051611-1.LOG
  • MSExchangeMailboxAssistants.exe__2013051613-1.LOG
  • MSExchangeMailboxReplication.exe_MSExchMbxRepl_2013051613-1.LOG
  • msexchangerepl.exe__2013051613-1.LOG
  • MSExchangeSubmission.exe__2013051613-1.LOG
  • MSExchangeThrottling.exe__2013041620-1.LOG
  • MSExchangeTransportLogSearch.exe_LogSearchSvc_2013051613-1.LOG
  • NodeRunner.exe_noderunner_2013051613-1.LOG
  • umservice.exe__2013051613-1.LOG
  • umservice.exe__2013051613-1.LOG
  • UMworkerprocess.exe_UM_2013050721-1.LOG
  • w3wp.exe__2013051613-1.LOG
  • w3wp.exe_AirSync_2013051613-1.LOG
  • w3wp.exe_AutoDisc_2013051613-1.LOG
  • w3wp.exe_ECP_2013051613-1.LOG_
  • w3wp.exe_EWS_2013051613-1.LOG
  • w3wp.exe_OWA_2013051613-1.LOG
  • w3wp.exe_RemotePS_2013051614-1.LOG
  • w3wp.exe_UNKNOWN_2013041620-2.LOG



In the next article I’ll explore some of the various log files that are out there. Please note the above are based on Exchange 2013 CU1 which was released in 2013.

*** UPDATE ***
As I was finishing this article to publish it, CU2 for Exchange Server 2013 was released. I double-checked the directory structure and it looks like this has changed as well between CU1 and CU2. Here are the changes:

CU1

CU2

AddressBook Service
ADDriver
AuthAdminLogs
Autodiscover
Calendar Repair Assistant
CasSyncLogs
ConfigurationEngine.tmf
ContactChangeLogging
ContactLinkingLogs
DCAdminActionsLog
Diagnostics
ECPServer
Ews
HttpProxy
IRMLogs
lodctr_backups
MailboxAssistantsLog
MailboxReplicationService
MAPI Client Access
MigrationLogs
Monitoring
MonitoringLogs
OWA
PeopleRelevance
PhotoGarbageCollector
Powershell-Proxy
Provider.txt
RPC Client Access
RpcHttp
Search
SetupLogs
Store
TraceLogs

AddressBook Service
ADDriver
AuditingOptics
AuthAdminLogs
Autodiscover
Calendar Repair Assistant
CasSyncLogs
CmdletInfra
ConfigurationEngine.tmf
ContactLinkingLogs
DCAdminActionsLog
Diagnostics
ECP
ECPServer
Ews
HttpProxy
IRMLogs
lodctr_backups
MailboxAssistantsLog
MailboxReplicationService
MigrationLogs
MigrationMonitorLogs
MigrationReports
Monitoring
MonitoringLogs
OWA
PhotoGarbageCollector
photos
Powershell-Proxy
Provider.txt
RPC Client Access
RpcHttp
Search
SetupLogs
Store
TraceLogs



Look for further updates with the release of future parts to this series.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s