These log paths are located at:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\logfile

C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces

Typically, you will see the format of the logs as “DocumentProcessingTrace_XX.etl”

Can this be disabled?

No, you cannot disable this functionality.

Can I reduce the amount of log files?

Yes, you can change the MaxTraceFileCount key located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing to a value no less than 10. The default value of log files Exchange generates is 100.

 Remember to restart the search services after to accept the new settings.

Can I change the path?

Yes and no, you can change the path in the registry but we have a process in place that changes it back to the original location.  This is because the service has a dependency on writing these log files so in order to protect functionality, this check was put in place.

There have been many requests for the full trouble shooting steps for Exchange 2010 search and at what point should you add more servers to your environment to help deal with the search load.  Here are the steps that we typically do when we receive a support call.

Please note that with OWA, Outlook online mode and E-discovery that there is a 180 second timeout and this value cannot be modified. 

1. Make sure the Internet proxy is disabled on the mailbox server

   1. Check to see if the proxy is running on the server

      1. From an administrative privileged command line run: netsh winhttp show proxy

   2. Disable the proxy if present

      1. From an administrative privileged command prompt run netsh winhttp reset proxy

2. If The Test-ExchangeSearch cmdlet fails; modify the MSFTEFD.EXE.CONFIG file as described in:  https://support.microsoft.com/kb/2837276

3. If you see any 9877 events in the application log; or  a QUERY_E_TOCOMPLEX in the ExTra trace apply the fix rom the following KB:  https://support.microsoft.com/kb/2616127

   1. Ignore steps 4-10

   2. Navigate to HKEY_Local_Machine\Software\Microsoft\ExchangeServer\v14\ExSearch

   3. Right click and select New\DWORD (32-bit) value

   4. The name should be MaxRestrictionNodes

   5. Value should be 1500000 (Decimal) (Up this to 2000000; theoretically this can be increased more but it can cause performance issues so never set it higher than two million)

4. Disable and re-enable the content indexes for each database, one at a time

   1. Get-MailboxDatabase | FL *index*

   2. Verify -IndexEnabled was set to true

   3. Run the below command to set it to false

      1. Set-Mailboxdatabase DBName -IndexEnabled $false

   4. Rename catalog for the DB

   5. start the Search service

   6. Run the below command with True switch

      1. Set-Mailboxdatabase DBName -IndexEnabled $True

   7. Restart the Search service.

5. Install Filter pack 2.0 and the latest updates and register them

   1. Filter Pack 2.0: https://www.microsoft.com/en-us/download/details.aspx?id=17062

   2. SP2 for Filter Pack 2.0: https://support.microsoft.com/kb/2687447

   3. Register Filter Pack: https://technet.microsoft.com/en-us/library/ff354976(v=exchg.80).aspx

6. Make sure all third-party filters such as the Adobe pdf filter are up to date

7. Move an affected mailbox to another database

8. Enable Outlook cache mode for all users especially high item/large mailbox users.

9. Rebuild your content indexes.  One at a time.  If this is completed after the steps above, we should have maximized performance with search and patched it to the newest updates.

If you are still experiencing search issues at this point, there are some extra steps that support will have you run.

There is a good chance that the timeouts are because of store throttling with search queries and performance issues from the server.  Here is how we determine from the support side.

1. Turn up diagnostic logging

   1. set-eventloglevel "msexchange search Indexer\General" -level expert

   2. set-eventloglevel "msexchange search indexer\configuration" -level expert

2. Remove all third-party tools from the MB server

3. Check high-item counts in mailboxes

4. Check for resource constraints on the MB server such as processor, memory, disk latency, etc., using ExPerfWiz

5. Monitor the following counters in perfmon

   1. \MSExchange Search Indices(*)\Average Time to Process Batches

   2. \MSExchange Search Indices(*)\Document Indexing Rate

   3. \MSExchange Search Indices(*)\Indexing Slow

   4. \MSExchange Search Indices(*)\Number of Documents Successfully Indexed

   5. \MSExchange Search Indices(*)\Number of Documents That Failed During Indexing

   6. \MSExchange Search Indices(*)\Number of Failed Mailboxes

   7. \MSExchange Search Indices\Number of Mailboxes Left to Crawl

6. Collect ExTra trace using with following components and tags

   1. Exchange 2010

      1. ExchangeSearch/*

      2. Store/tagCIPSBrief

      3. Store/tagCIPSConditions

      4. Store/tagCIPSParams

      5. Store/tagCIPSVerbose

      6. Store/tagCIStateMachine

      7. Store/tagQnode

      8. Store/tagQroot

      9. Store/tagQueryCi

      10. Store/tagQueryCiDump

      11. Store/tagRestrict

      12. Store/tagSearch

      13. Store/tagViewCleanup

      14. InfoWorker.Common/Search

7. Disable the signature verification with DIP.exe

   1. Make sure you STOP and DISABLE the following service on all their mailbox servers: WinHTTP Web Proxy Auto-Discovery

   2. Use the dip.exe tool on all the mailbox servers with a search problem.

   3. Place a copy of dip.exe in the Exchange V14 subdirectory (Exchange 2010)

   4. Open an elevated command prompt in the V14 subdirectory (Exchange 2010)

   5. Run the following command: dip /ADMIN_SETBOOL g FTE_VerifySignature 0

   6. Restart the Microsoft Search Indexer Service and Microsoft Search (Exchange) services

   7. https://blogs.msdn.com/b/roopeshpattan/archive/2009/11/14/search-index-fails-for-all-users-in-a-particular-database-in-exchange-2007.aspx

8. Capture a procdump of store while reproducing the issue

    

   If we are seeing that batches are not processing after 30 minutes do to server performance issues, we may add in these keys.

1. Modify the registry to increase the indexing time out

   1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v14\ExSearch

   2. Create two DWORD, decimal values

   3. DatabaseCacheTtlInSeconds.  Default is 30 minutes, increase to an hour: 1800

   4. BatchTimeoutInSeconds, default is 1 hour, 1.5 hourr, : 5400

       

       

       

       

      AT this point after following all these additional steps, it is time to build out the environment to add more servers to disperse the load. We always build out and environment and not up.  It is more efficient having a few smaller servers than one large server when it comes to server load.

Tony Geraghty

SR Support Escalation Engineer

Terrance Brennan

Support Escalation Engineer

A good rule of thumb is to stay under 256 characters when you write you complex search query and whenever possible, keep the query simple! 

A good example of what not to do would be to create ten different search queries and concatenate the queries together into one long string.

If you are looking for the more complex queries, I would highly suggest moving to Exchange 2013 and SharePoint 2013 to get the full benefits of the FAST search capabilities.

Tony Geraghty, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

For Windows 2003:

1. 
   Check to see if you have a proxy configured on
   the server.
   1. 
      From command line, run proxycfg

If you don’t have a proxy, it will look like this. No proxy server listed.

 2. If you have a proxy listed, you will need to
remove it by using the following command.

a. From command line, run proxycfg –d

For Windows 2008

1. 
   Check to see if you have a proxy configured on
   the server.
   1. 
      From command line, run Netsh winhttp show proxy

If you don’t have a proxy, it will look like this. No proxy server listed

2. If you have a proxy listed, you will need to
remove it by using the following command.

a. From command line, run Net winhttp reset proxy

*** After you have removed the proxy from the server, you will need to rebuild the indexes on the server. You can use the ResetSearchIndex.ps1 script or perform the manual recreation of the indexes. ***

 ***Make sure to not rebuild all of them at the same time.  If you have large databases, this will take several days to complete ***

Create a New Configuration file for Search.

If the Server is a Windows 2008 R2 + server Follow the steps listed in KB 2837276. 

Written by Tony Geraghty, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

Technically Reviewed by Rob Whaley, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

There are a few different ways to rebuild a search index in
Exchange 2013.

1. Reseed the Search Catalog from another DAG member.
    If the server is part of a DAG, you can reseed the index (Catalog) by running the Update-MailboxDatabaseCopy
   using the –CatalogOnly switch (https://technet.microsoft.com/en-us/library/dd335201(v=exchg.150).aspx)

Example: Update-MailboxDatabaseCopy -Identity DB1\MBX1  -CatalogOnly

In the example above, the Database name is DB1 and the mailbox server is MBX1.

1. Manual rebuild kickoff
1. Stop the “Microsoft Exchange Search service” as
   well as the “Microsoft Exchange Host Controller.”
2. Delete the Existing CI catalog folder or move it
   to a new location.
3. Start the “Microsoft Exchange Search service” as
   well as the “Microsoft Exchange Host Controller” services.

https://blogs.office.com/b/sharepoint/archive/2012/11/08/intro-to-ediscovery-in-sharepoint-exchange-and-lync-2013.aspx

We also have an eDiscovery FAQ that comes in handy if you
are looking for information about Microsoft office 365, SharePoint, Exchange
and Lync.

https://social.technet.microsoft.com/wiki/contents/articles/19485.ediscovery-faq.aspx

https://blogs.technet.com/b/johnbai/archive/2013/07/16/exchange-2013-high-availability-fast-search-and-the-windows-registry.aspx

How are SMTP addresses such as @company.com searched and indexed for Exchange 2010 Discovery Search, Outlook Online Mode Search, and OWA Search?

If you search for 5 SMTP addresses such as (@company1.com OR @company2.com OR @company3.com OR @company4.com OR @company5.com), you get unexpected results such as fewer results than expected.

If you search for 5 SMTP addresses surch (@company1.com OR @company2.com OR @company3.com OR @company4.com OR @company5.com), and combine those results with 5 words such as (settle* OR double OR bond OR depos* OR appeal*) - you get unexpected results such as fewer or more results than expected.

In other words, if you perform a Discovery Search or an Outlook Online Mode Search or an OWA Search and combine 5 SMTP addresses with 5 terms -such as (@company1.com OR @company2.com OR @company3.com OR @company4.com OR @company5.com) AND (settle* OR double OR bond OR depos* OR appeal*), you get unexpected results such as fewer or more results than expected.

Cause

1. You must use correct Advanced Query Syntax (AQS Syntax) to construct queries with more than one logical operator (such as OR or AND or NOT) in them. For further information, see this Blog:

How to Use AQS to Construct Complex Discovery Queries
https://blogs.technet.com/b/exchangesearch/archive/2012/03/10/how-to-use-aqs-to-construct-complex-discovery-queries.aspx

2. If an email has an attachment, there must be a corresponding iFilter to be able to index the attachment. For example, if you wish to index Microsoft Office 2010 and Microsoft 2007 Office attachments, you must have Microsoft Office 2010 Filter Pack installed on the Exchange 2010 Mailbox and Hub servers. You must do this manually in Exchange 2010 RTM. This is done for you automatically beginning in Exchange 2010 SP1.

3. If an attachment has an extension of a file which is covered by an IFilter such as .doc or .docx but the file is really another type of file such as .rtf, the attachment will not be indexed.

4. Attachments such as .jpg and .gif image files that have SMTP addresses or words relevant to the search will not be indexed because there is no IFilter for image files.

4. If email has an attachment that is encrypted or created with a pasword, the attachment will not be processed for indexing even if an IFilter exists for the attachment.

Resolution

1. Searching for @company.com is the same as searching for to:@company.com OR from:@company.com OR @company.com in the body or subject of an email. Entering a search for @company.com will retrieve @company.com in the To: field and in the From: field and the body of the message and the subject of a message.

2. Use correct AQS Syntax from the following Blog:

How to Use AQS to Construct Complex Discovery Queries
https://blogs.technet.com/b/exchangesearch/archive/2012/03/10/how-to-use-aqs-to-construct-complex-discovery-queries.aspx

3. Instead of searching for (@company1.com OR @company2.com OR @company3.com OR @company4.com OR @company5.com) - enter this instead:

((((company1.com OR company2.com) OR company3.com) OR company4.com) OR company5.com)

4. Instead of searching for (settle* OR double OR bond OR depos* OR appeal*) - enter this instead:

((((settle* OR double) OR bond) OR depos*) OR appeal*)

5. Combine the two expressions in 3. and 35. above by using the AND operator:

((((company1.com OR company2.com) OR company3.com) OR company4.com) OR company5.com) AND ((((settle* OR double) OR bond) OR depos*) OR appeal*)

6. Use the rule to add another set of matching parentheses every time you add a logical operator like this to get the finished, correct way using AQS Syntax to enter this search:

( ((((company1.com OR company2.com) OR company3.com) OR company4.com) OR company5.com) AND ((((settle* OR double) OR bond) OR depos*) OR appeal*) )

7. Another strategy in Discovery Search is to include Unsearchable Items in your Discovery Search, and examine those items for search hits:

Understanding Multi-Mailbox Search
https://technet.microsoft.com/en-us/library/dd335072.aspx

Unsearchable items Unsearchable items are mailbox items that can't be indexed by Exchange Search. Reasons include lack of an installed search filter for an attached file, a filter error, and encrypted messages. When creating a discovery search, you can include unsearchable items in search results.

Conclusion and Summary

Entering a search for @company.com will retrieve @company.com in the To: field and in the From: field and the body of the message and the subject of a message. Use correct AQS Syntax from the following Blog:

How to Use AQS to Construct Complex Discovery Queries
https://blogs.technet.com/b/exchangesearch/archive/2012/03/10/how-to-use-aqs-to-construct-complex-discovery-queries.aspx

Add IFilters for any 3rd party programs to be able to search for additional attachment types such as Adobe .pdf files. Another strategy in Discovery Search is to include Unsearchable Items in your Discovery Search, and examine those items for search hits.

Written by Bob Want, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

Technically Reviewed by Marco Manzato, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

How is the Apostrophe Symbol ['] indexed and searched for Exchange 2010 Discovery Search and Exchange 2010 and Exchange 2007 Outlook Online Mode Search and Exchange 2010 and Exchange 2007 OWA Search?

Another way of putting this is, how is the Apostrophe symbol ['] is indexed and searched when an Apostrophe is embedded in a word and when an Apostrophe is not embedded in a word.

Testing Results

Testing shows the following results:

"O ' Brien"

This is a search using the Apostrophe that is not embedded in the middle of a word.
A search for "O ' Brien" ignores the Apostrophe symbol.
A search for "O ' Brien" gives the same results as a search for "O Brien"

"O 'Brien"

This is a search using the Apostrophe that is not embedded in the middle of a word.
A search for "O 'Brien" ignores the Apostrophe symbol.
A search for "O 'Brien" gives the same results as a search for "O Brien"

"O'Brien"

This is a search using the Apostrophe that is embedded in the middle of a word.
A search for "O'Brien" finds results for this search for the Apostrophe symbol embedded in the middle of the word.

Summary and Conclusion

When using Exchange 2010 Discovery Search and Exchange 2010 and Exchange 2007 Outlook Online Mode Search and Exchange 2010 and Exchange 2007 OWA Search, an Apostrophe is ignored when it is not embedded in the middle of a word and an Apostrophe is found as a part of search results when it is embedded in the middle of a word such as O’Brien.

Written by Bob Want, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

Technical Reviewer, Rafael Mercado, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft