Why do I see ETL Log files showing up on my Exchange 2013 servers post CU6?

  • Article

Starting with Exchange 2013 CU6, you may notice that the search service may take some additional log file space.  This is because of some changes that Microsoft made where log files are written to the disk in the case of a search issue.

These log paths are located at:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\logfile

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces

Typically, you will see the format of the logs as “DocumentProcessingTrace_XX.etl”

 

Can this be disabled?

No, you cannot disable this functionality.

 

Can I reduce the amount of log files?

Yes, you can change the MaxTraceFileCount key located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing to a value no less than 10. The default value of log files Exchange generates is 100.

 Remember to restart the search services after to accept the new settings.

 

Can I change the path?

Yes and no, you can change the path in the registry but we have a process in place that changes it back to the original location.  This is because the service has a dependency on writing these log files so in order to protect functionality, this check was put in place.

Comments

  • Anonymous
    September 28, 2015
    Thanks for the post. I came across these etl files today whilst trying to determine why the C drive was rapidly funning out of available space. In addition to the usual suspects in the daily performance logs, message tracking, EAS logging etc I found these and could not figure out what they were. While it would be nice to be able to change the path permanently it is good that we can at least reduce the amount.

    Can you explain what these particular files may be used for? Troubleshooting by PSS? Would reducing the number of logs adversely affect their usefulness?