Menu

exchange 2013

C: Drive Full Exchange 2013/2016/2019

, , , , , 3

This article is for you if your Exchange servers are filling up their C: drive even though you configured different drives for the mailbox databases and transaction logs.

Symptoms for Exchange 2016 C: drive use

  • C: drive used space increases 20-100 GB per month
  • Exchange 2016 Server or 2019 or 2013
  • Exchange mail flow services stops around 10-15 GB free

Root cause of C: drive full (Exchange 2013 , 2016, 2019)

Out of the box, Exchange 2016 has a lot of logging enabled, including performance logs.  The performance logs can grow 2 GB per day, the inetpub logs grow about 300 MB per day, and various Exchange logs grow about 1 GB per day.

How to manually clean up the C: drive in Exchange 2016 or 2013 or 2019

Note: The logs discussed in this article are disposable.  The file extensions should always be .log or .blg.  Do not delete folders or other file types!

Remember to “permanently delete” the files by holding down SHIFT while selecting Delete. If you don’t they will just move to the recycle bin and not fix your disk space issue.

Navigate to these locations and delete older .log files

  • c:\inetpub\logs\LogFiles\
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\RpcHttp
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\MapiHttp\Mailbox
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\* — delete contents of each subfolder
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\Query
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\NotificationBroker\Client
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\ItemAssistants
  • C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs

I normally sort by date modified and leave a few days of the most recent logs.

These locations will also have log files, but they should stop generating after you follow the rest of the article:

  • C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\ServiceLogs
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs
  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\PerformanceLogsToBeProcessed

How to reduce C: drive use on Exchange 2013 2016 2019

The following steps show you how to disable some logs at the source.  Remember, you can reverse these steps to begin generating logs in case you need to diagnose an issue.

1. Modify the registry to reduce the amount of some logs kept by default.

These logs are generated in this location:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces 

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs

To reduce the number of ETL Traces kept by default, modify the registry:

Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing

Key: MaxTraceFileCount

Change value to what you want (such as 5)

2. Disable diagnostic log services

Navigate to your services manager  (services.msc)

Find the service: Microsoft Exchange Health Manager

Stop the service and change it to disabled.

Find the service Microsoft Exchange Diagnostics

Stop the service and change it to disabled.

3. Disable scheduled task performance monitoring

Open Task Scheduler (  Start > Windows Administrative Tools > Task Scheduler )

Expand Task Scheduler Library >  Microsoft > Windows

Select the subfolder PLA

You will see three tasks in the main window pane.  By default, they have these statuses:

  • ExchangeDiagnosticsDailyPerformanceLog = Running
  • ExchangeDiagnosticsPerformanceLogs = Running
  • Server Manager Perfrmance Monitor = Disabled

Right-click the two running services, select End, then right-click again and Disable them.

Want to use a script for this, rather than manually performing fixes each month?

I haven’t personally tested this script, but it has been recommended to me: https://gallery.technet.microsoft.com/Clear-Exchange-2013-Log-71abba44

Are you an Exchange Admin?

Read this article about how to fix Exchange Information Store “starting”.

Read this article about designing and lessons learned for a 2-site DAG

Exchange server very slow, services and network blank

, , , , , , , 0

Hello all,

This article is about an infrequent issue I see with Windows Exchange servers that causes a complete outage.  It is really hard to figure out what is wrong.  Normally, you will see this when you restore an Exchange server to new hardware or a new virtual platform.  But I’ve also seen it occur spontaneously with existing servers.

Symptoms for Exchange server very slow:

  • Windows 2008 R2 Server (normally).  Also applies to 2012 and 2016.
  • Exchange 2007 or Exchange 2010 or Exchange 2013
  • Exchange Information Store service is “starting”, will not start
  • Services does not display and/or blank for a long time
  • Server manager information does not display or very slow
  • Network properties , NIC settings, does not come up
  • Control Panel does not display

Additional symptoms:

  • Rebooting does not work (and the server normally will not shutdown gracefully)
  • You can ping the server and ping from it, but remote desktop does not work.
  • (Often) The server has recently been restored from backup
  • (Often) The server is running in a virtual environment
  • (Often) Task manager shows low CPU activity

NETLOGON: If your services menu is *not* blank, and you can open your network settings, you have a different problem!

How to troubleshoot other causes of Exchange Info Store “starting”:

  • Check your “netlogon” service on the exchange server. Make sure it is started (and restart it).
  • Can’t start netlogon? Check that your network is functional and DNS settings are pointing at a domain controller. Yes, still check it even if the Domain Controller is the same server as Exchange.
  • Check that your Domain Controller has Active Directory and DNS running properly. From an admin command prompt, or admin powershell, run dcdiag
  • Check that your Domain Controller doesn’t have a firewall blocking it, or other network problems.
  • Check the event log for clues on both your Exchange server and your Domain controller.

Root cause for information store “starting” and services blank: 

Exchange is trying to use a network adapter (NIC) that doesn’t exist anymore.  

This normally happens when you restore to new hardware.  For example, your server may have had one network card: “Network Connection 1”. 

When you turn on Windows with new hardware, “Network Connection 1” is hidden and you will see “Network Connection 2” (or potentially a new “Network Connection 1”).

Most Windows servers handle this just fine, but with Exchange, the Information Store service is still trying to use the hidden network card.  This locks up the Network Connections window, Control Panel, Services, and other administrative panels.  The Information store churns at “starting” during this process. 

How to fix NIC that doesn’t exist anymore:

You need to remove the hidden network adapter from your server’s Device Manager. 

  1. Click Start, click Run, type cmd.exe, and then press ENTER.
  2. Type set devmgr_show_nonpresent_devices=1  and then press ENTER.
  3. Open device manager (run devmgmt.msc or Right-click My Computer > Manage)
  4. Type Start DEVMGMT.MSC, and then press ENTER.
  5. From the top menu, click View, and then click Show Hidden Devices.
  6. Expand Network Adapters.
  7. Right-click the hidden network adapter, and then click Uninstall.  If in doubt, I’d remove everything that looks like a network adapter.  The server will re-install the live ones during reboot.
  8. Give it a reboot.
  9. You may need to re-configure your IP address on the existing NIC.
  10. At this point your information store should start properly and your server will begin responding normally.

What to do if Device Manager won’t open?

If you can’t manage your server because none of the admin windows will open, you need to get the Exchange Information Store service stopped and disabled.  Once you get the Information Store out of status “starting”, your network properties, device manager, control panel, etc, will open. This will let you fix the problem.

Here are some ideas to try.

  • If you are using a virtual server (VMWare, KVM, or HyperV), remove all virtual network adapters from the server.  Reboot the Exchange server afterward. You should be able to get to Services now. 
  • Try waiting for services to display. Give it 10 minutes.
  • Try using Computer Management from another computer to access the server (I don’t remember if this works). 
  • Try using command prompt to stop and disable the Information Store service (I don’t remember if this works).  
sc config "store" start= disabled 
sc stop "store"
  • Try booting into safe mode to stop and disable the Information Store Service.
  • If you are using a physical server, and nothing else is working, try removing the physical network adapter. 

Helpful reference material (for this and other related errors):

Migrating virtual machines causes hidden NIC

Exchange 2010 Information Store “starting” due to time sync error and Topology service

Another Exchange Information Store stuck in starting due to time error

I hope that works for you!  If it does, or does not, please leave a comment to help others!

If you need a senior escalation point for Exchange, VMware, or Netapp technologies, consider Kieri Solutions. You can find more about me and my company in the menu above.