Exchange 2013 Is Filling My C: Drive

So, Exchange 2013 does a few things differently than previous versions of Exchange. If you are not careful about how you allocate your disk space, you'll end up constantly wondering why the C: drive is filling up. And if your monitoring isn't up to snuff, you'll notice C: drive is filling up because mail flow almost stops due to back pressure.

If you are using direct attached storage for your C: drive as Microsoft suggests, then you likely have a fairly large C: drive. Something like 300GB or more. If you have a C: drive that large you're likely OK and don't need to worry about it. On the other hand, if you have your Exchange server using a SAN and you tried to keep your C: drive to 80GB because that SAN space is expensive, you will have issues.

There are three common things can use up the C: drive:

• Internet Information Services (IIS) logs
• Exchange Server diagnostic logs
• Transport queues

IIS Logs
Exchange Server has a variety of web-based services such as Outlook Web App (OWA) and Exchange Web Services (EWS). IIS hosts these web-based services and generates logs for them each day. Unfortunately IIS does not have an option to delete log files after a certain number of days. This is a problem that has existed for Exchange 2010 and Exchange 2007 also.

In most cases, the issue isn't so much the size of log files generated each day. Instead, it's the fact that the log files build up over time and begin to take up and significant amount of space.

You can move the IIS logs off of the C: drive by modifying the log settings for the Default Web Site. However, that still leaves you with a constantly building collection of log files. What we have started to do is delete all log files older than 14 days by using a scheduled task. This link provides instructions:

• http://byronwright.blogspot.ca/2015/01/script-to-remove-old-iis-logs.html

Exchange Server Diagnostic Logs
Exchange Server 2013 generates significantly more diagnostic logs than Exchange Server 2010. For Exchange 2010 Microsoft suggested 1.2GB available on D: drive. Now 30GB is recommended for C: drive and a big chunk of this is diagnostic logs. The logs are automatically purged after 14 days, but they are a significant amount of space. One of our clients with about 1700 users has 20GB of diagnostic logs.

If you don't allocate enough space originally on your server, there is no method for moving the logs to an alternate drive. However, you can use a junction point in the file system (created with mklink.exe) to redirect the folder to an alternate location.  Alternatively expanding C: to support the diagnostic logs is also good.

If you can't have a large C: drive when you install your server, consider installing Exchange Server on a separate drive. The diagnostic logs are kept in the installation folder:

• [install location]\Microsoft\Exchange Server\v15\Logging

Transport Queues
In Exchange 2013 the transport queues are significantly larger than Exchange 2010. This is due mostly to the new SafetyNet feature. This feature keeps a copy of mail messages for 2 day to help when recovering from disasters. As you can guess, this can end up a significant amount of data. One of our clients had transport queues growing to about 60GB per server.

Again, you could install Exchange initially on a separate drive to allow for the size of the mail.que file. However, if Exchange is installed to the C: drive, you can do a few things to mange mail.que.

First, you can move the transport queues to an alternate location. Microsoft provides a set of directions for this:

• https://technet.microsoft.com/en-us/library/bb125177%28v=exchg.150%29.aspx

Secondly, you can manage Safety Net to reduce the amount of data that is cached to less than 2 days if you deem that appropriate for your environment. You can do this from Exchange Administrative Center (EAC) at Mail flow > Receive connectors > More options > Organization transport settings > Safety Net > Safety Net hold time. You can also use the Set-TransportConfig cmdlet with the -SafetyNetHoldTime parameter.

For more information about Safety Net, see:

• https://technet.microsoft.com/en-us/library/jj657495%28v=exchg.150%29.aspx