ETL Files in C:\Users\%user%\AppData\Local\Temp\Outlook Logging

Question

Problem: We are having problems with some of our devices smaller SSDs filling up thanks to 51,200 KB Outlook ETL files building up in C:\Users\%user%\AppData\Local\Temp\Outlook Logging. I have written a Powershell script to clear them out, but that is a band aid to the solution and I'd like to figure out why we are having this problem.

Background info: We started seeing a build up starting in January, so we believe something was changed since then. I have read that Outlook files should be deleted after 5 days, but that is not what we're seeing. I have poured over our group policy settings and do not see anything relevant to Outlook or Office applications logging enabled.

What we have tried:

• Disabling Logging in Outlook (it was already disabled)
• Set enable logging registry key to 0
• Added registry key under HKCU\Software\Policies\Microsoft\office\16.0\Outlook\Logging
• Disabled Outlook logging in Computer\HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Logging and HKCU\Software\Microsoft\Office\16.0\Outlook\Options\Mail
• Disabled Telemetry
• Made sure enterprise logging was not enabled (keys for logging aren't there) for office applications

Any info or point in the right direction would be greatly appreciated!

Answer 1

This is what fixed it for us I really had to push Microsoft for an answer as this was crippling our terminal servers.

It’s not blindingly obvious but because each user logged in to the TS and creating these .etl files it was hogging the HDD throughput and slowing down each users TS session.

Stop Outlook\Excel\Word creating etl log files

 

All office 365 apps seem to create .etl file logs as they are running and this can cause performance problems which mainly causes disk I/O to run high, this is mainly an issue with Outlook.

 

Outlook The .etl log files for Outlook can be found at:-

C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named, OUTLOOK_16_0_14729_20260-20220201T1030490409-17924.etl

Add the following registry key to stop the logging for Outlook

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging]

"DisableDefaultLogging"=dword:00000001

 

 

Excel The .etl log files for Excel can be found at:-

C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

EXCEL_16_0_14827_20158-20220203T1219150325-20004.etl

Add the following registry key to stop the logging for Excel

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Excel\Logging]

"DisableDefaultLogging"=dword:00000001

 

 

Word The .etl log files for Word can be found at:-

C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

WINWORD_16_0_14827_20158-20220203T1220570600-11304.etl

Add the following registry key to stop the logging for Word

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Word\Logging]

"DisableDefaultLogging"=dword:00000001

 

 

Powerpoint The .etl log files for Word can be found at:-

C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and creating a file named,

POWERPNT_16_0_14827_20158-20220203T1222450550-18028.etl

Add the following registry key to stop the logging for Powerpoint

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\PowerPoint\Logging]

"DisableDefaultLogging"=dword:00000001

 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging

You may find that Microsoft key exists but nothing beyond that please create new keys with the above names.

Then in the Logging key create the registry key DWORD (32-bit) value and name it DisableDefaultLogging and set the value to 1

With File explorer navigate to C:\Users\USERNAME\AppData\Local\Temp\Outlook Logging and delete all the OUTLOOKxxxx.etl files

Close and reopen Outlook in the users profile and the .etl files are now not created.

 

 

You could also do this for Powerpoint and any other 365 applications, I referred to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0 to find the correct names for the programs.

 

 

 

 

Registry keys

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Access\Logging]

"DisableDefaultLogging"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Excel\Logging]

"DisableDefaultLogging"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Outlook\Logging]

"DisableDefaultLogging"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\PowerPoint\Logging]

"DisableDefaultLogging"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Publisher\Logging]

"DisableDefaultLogging"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\Word\Logging]

"DisableDefaultLogging"=dword:00000001

Answer 2

Same problem here and workaround with deleting the folder "%localappdata%\Temp\Outlook Logging" and replacing it with a file with the same name works:

Run this as logon script with a GPO:

rmdir "%localappdata%\Temp\Outlook Logging" /S /Q

robocopy "\ats\netlogon\Outlook\Outlook Logging" %localappdata%\temp /IS

I also delete the folder and copy the File with Preferences in the same GPO. Using only the Preferences or only the script did not always work.

Answer 3

Hi @Woodbury, Angus ,

Welcome to our forum!

Sorry that I don't fully understand your issue. Is the file size growth in this path generated automatically by outlook or after you have performed some operations? And is it still growing?
And does this issue occur with all users in your organization or specific users?

Based on my research, when you enable ETW logging, an event trace log (.etl) file is generated.

It's suggested that you could unselect the Enable troubleshooting logging (requires restarting Outlook) option via File>Options>Advanced>Other to check if there're any differences.

For more information, please refer to: How to enable global and advanced logging for Microsoft Outlook.

Hope the above help!

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 4

Hi Christy,

Yes we already have logging disabled, please see "What we have tried".

Outlook is creating a new ETL file every single time it opens and is never deleting them, creating several 51,200 KB files (I assume thats the maximum log size). We have logging disabled everywhere that we have found any documentation. To my knowledge, nothing has changed but the issue started randomly in Janurary. We are talking thousands of user and devices, and its the same across the board. Every single one has that checkbox unchecked, at least 6 different registry keys tried for disabling logging and we still get ETL files that don't delete themselves.

Hope this cleared up any confusion.

Answer 5

Thanks for the info Christy. Do you have any idea why they are building up? I had read somehwere that even if logging was enabled the logs should delete after 5 days. Thats not what we are seeing right now. I appreciate you looking into this for us.