Why do I see ETL Log files showing up on my Exchange 2013 servers post CU6?

  • Article

Starting with Exchange 2013 CU6, you may notice that the search service may take some additional log file space.  This is because of some changes that Microsoft made where log files are written to the disk in the case of a search issue.

These log paths are located at:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\logfile

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces

Typically, you will see the format of the logs as “DocumentProcessingTrace_XX.etl”

 

Can this be disabled?

No, you cannot disable this functionality.

 

Can I reduce the amount of log files?

Yes, you can change the MaxTraceFileCount key located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing to a value no less than 10. The default value of log files Exchange generates is 100.

 Remember to restart the search services after to accept the new settings.

 

Can I change the path?

Yes and no, you can change the path in the registry but we have a process in place that changes it back to the original location.  This is because the service has a dependency on writing these log files so in order to protect functionality, this check was put in place.