ETL Files in C:\Users\%user%\AppData\Local\Temp\Outlook Logging

Woodbury, Angus 41 Reputation points
2022-06-01T16:45:15.783+00:00

Problem: We are having problems with some of our devices smaller SSDs filling up thanks to 51,200 KB Outlook ETL files building up in C:\Users\%user%\AppData\Local\Temp\Outlook Logging. I have written a Powershell script to clear them out, but that is a band aid to the solution and I'd like to figure out why we are having this problem.

Background info: We started seeing a build up starting in January, so we believe something was changed since then. I have read that Outlook files should be deleted after 5 days, but that is not what we're seeing. I have poured over our group policy settings and do not see anything relevant to Outlook or Office applications logging enabled.

What we have tried:

Any info or point in the right direction would be greatly appreciated!

Outlook Management
Outlook Management
Outlook: A family of Microsoft email and calendar products.Management: The act or process of organizing, handling, directing or controlling something.
5,267 questions
{count} votes

5 answers

Sort by: Most helpful
  1. ITFixit 10 Reputation points
    2023-09-21T11:53:00.9766667+00:00

    This is what fixed it for us I really had to push Microsoft for an answer as this was crippling our terminal servers.

    It’s not blindingly obvious but because each user logged in to the TS and creating these .etl files it was hogging the HDD throughput and slowing down each users TS session.

    Stop Outlook\Excel\Word creating etl log files

     

    All office 365 apps seem to create .etl file logs as they are running and this can cause performance problems which mainly causes disk I/O to run high, this is mainly an issue with Outlook.

     

    Outlook The .etl log files for Outlook can be found at:-

    C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named, OUTLOOK_16_0_14729_20260-20220201T1030490409-17924.etl

    Add the following registry key to stop the logging for Outlook

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging]

    "DisableDefaultLogging"=dword:00000001

     

     

    Excel The .etl log files for Excel can be found at:-

    C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

    EXCEL_16_0_14827_20158-20220203T1219150325-20004.etl

    Add the following registry key to stop the logging for Excel

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Excel\Logging]

    "DisableDefaultLogging"=dword:00000001

     

     

    Word The .etl log files for Word can be found at:-

    C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

    WINWORD_16_0_14827_20158-20220203T1220570600-11304.etl

    Add the following registry key to stop the logging for Word

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Word\Logging]

    "DisableDefaultLogging"=dword:00000001

     

     

    Powerpoint The .etl log files for Word can be found at:-

    C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

    POWERPNT_16_0_14827_20158-20220203T1222450550-18028.etl

    Add the following registry key to stop the logging for Powerpoint

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\PowerPoint\Logging]

    "DisableDefaultLogging"=dword:00000001

     

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging

    You may find that Microsoft key exists but nothing beyond that please create new keys with the above names.

    Then in the Logging key create the registry key DWORD (32-bit) value and name it DisableDefaultLogging and set the value to 1

    With File explorer navigate to C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and delete all the OUTLOOKxxxx.etl files

    Close and reopen Outlook in the users profile and the .etl files are now not created.

     

     

    You could also do this for Powerpoint and any other 365 applications, I referred to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0 to find the correct names for the programs.

     

     

     

     

    Registry keys

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Access\Logging]

    "DisableDefaultLogging"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Excel\Logging]

    "DisableDefaultLogging"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging]

    "DisableDefaultLogging"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\PowerPoint\Logging]

    "DisableDefaultLogging"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Publisher\Logging]

    "DisableDefaultLogging"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Word\Logging]

    "DisableDefaultLogging"=dword:00000001

    2 people found this answer helpful.
    0 comments No comments

  2. TRÖSTER Joachim 6 Reputation points
    2023-01-19T10:48:13.07+00:00

    Same problem here and workaround with deleting the folder "%localappdata%\Temp\Outlook Logging" and replacing it with a file with the same name works:

    Run this as logon script with a GPO:

    rmdir "%localappdata%\Temp\Outlook Logging" /S /Q

    robocopy "\ats\netlogon\Outlook\Outlook Logging" %localappdata%\temp /IS

    I also delete the folder and copy the File with Preferences in the same GPO. Using only the Preferences or only the script did not always work.

    1 person found this answer helpful.
    0 comments No comments

  3. ChristyZhang-MSFT 23,726 Reputation points Microsoft Vendor
    2022-06-02T02:51:35.463+00:00

    Hi @Woodbury, Angus ,

    Welcome to our forum!

    Sorry that I don't fully understand your issue. Is the file size growth in this path generated automatically by outlook or after you have performed some operations? And is it still growing?
    And does this issue occur with all users in your organization or specific users?

    Based on my research, when you enable ETW logging, an event trace log (.etl) file is generated.
    207686-6.png

    It's suggested that you could unselect the Enable troubleshooting logging (requires restarting Outlook) option via File>Options>Advanced>Other to check if there're any differences.
    207717-7.png

    For more information, please refer to: How to enable global and advanced logging for Microsoft Outlook.

    Hope the above help!


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


    0 comments No comments

  4. Woodbury, Angus 41 Reputation points
    2022-06-02T12:17:51.597+00:00

    Hi Christy,

    Yes we already have logging disabled, please see "What we have tried".

    Outlook is creating a new ETL file every single time it opens and is never deleting them, creating several 51,200 KB files (I assume thats the maximum log size). We have logging disabled everywhere that we have found any documentation. To my knowledge, nothing has changed but the issue started randomly in Janurary. We are talking thousands of user and devices, and its the same across the board. Every single one has that checkbox unchecked, at least 6 different registry keys tried for disabling logging and we still get ETL files that don't delete themselves.

    Hope this cleared up any confusion.


  5. Woodbury, Angus 41 Reputation points
    2022-06-09T12:23:13.2+00:00

    Thanks for the info Christy. Do you have any idea why they are building up? I had read somehwere that even if logging was enabled the logs should delete after 5 days. Thats not what we are seeing right now. I appreciate you looking into this for us.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.