Exchange Message Tracking Log Retention Period & Impact on Performance

Question

Exchange Message Tracking Log Retention Period & Impact on Performance

LMS 156

Hi

We have 2 X Exchange 2016 servers with message tracking log retention period of 90 days with max Log directory size of 4 GB. We are planning to increase this to 18 months. How this change impact the performance of Exchange, also will there be a delay in searching the logs?

What about the option of keeping a backup of log files once in every 3 months and restore them to exchange log directory when ever required? If this is the optimal solution, then, after restoring the log files what are the steps that we need to take in order to search the log (Message tracking)

Thanks in advance

Accepted answer

1 additional answer

Your answer

Answer 1

KyleXu-MSFT 26,396

@LMS
Here are some detailed information about configuration on Message tracking log:

The increase of the log file will have a certain impact on log searching. It depends on the performance of your Exchange server.
About your option, it seems could working, but I don't see it from Microsoft articles. You can have a try with it. If Exchange cannot recognize these recovered logs, you can use other tool(Such as Excel, you can filter needed data from it) to read those logs directly.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

LMS 156 Reputation points

2020-09-29T08:34:23.363+00:00

Hi

I found a similar article "https://social.technet.microsoft.com/Forums/lync/en-US/2fb1dea0-4e98-47cf-ac8e-da8800175b70/restore-old-message-tracking-logs?forum=exchangesvrgenerallegacy", even though it's related to 2007 we are also looking for such an option, they failed to track messages after restoring the old logs and finally used Log Parser.

It will be great if a get an exact answer (very rarely we search for mails older than a year, so it's better to keep minimum retention period and restore the logs when ever needed)
KyleXu-MSFT 26,396 Reputation points

2020-09-29T09:29:36.8+00:00

Here is a testing in my lab:

Exchange could read data from recovered logs, but since there doesn't exist official article introduced about this way. So, we cannot sure whether it could work on all Exchange server. As I said in the first post, if this way doesn't work in your organization, you may need to use another tool to analyses those log. You can also prepare a larger hard disk to store data.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
LMS 156 Reputation points

2020-09-30T09:02:13.757+00:00

Thank You

After copying the files do we need to restart any services?
KyleXu-MSFT 26,396 Reputation points

2020-10-01T02:12:09.473+00:00

I copied logs directly without stop/restart service.
KyleXu-MSFT 26,396 Reputation points

2020-10-02T08:37:45.557+00:00

@LMS
I am writing here to confirm with you any update about this thread now?
If the above suggestion helps, please be free to mark it as an answer for helping more people.
LMS 156 Reputation points

2020-10-04T11:59:34.89+00:00

Thank You

We will keep backup of the logs and will restore when needed

Answer 2

By default max age for a log file is 30 days, and the maximum size for a single file is 10 MB.
Hence all message tracking logs in the default directory cannot exceed 1 GB.
But if you need to keep logs more than that, you can use separate dedicated volume for that minimize performance issues.

You can use Windows Powershell to analyze track data,
Please refer for more details,
https://practical365.com/exchange-server/speed-up-multi-server-message-tracking-log-searches-with-powershell-remoting/
https://learn.microsoft.com/en-us/powershell/module/exchange/get-messagetrackinglog?view=exchange-ps

Share via

Exchange Message Tracking Log Retention Period & Impact on Performance

1 additional answer

Your answer