«

»

Feb 28

The Hidden Logs That Could Crash Your Lync Servers!

How’s that for the title of a blog article! Apparently I’ve been reading too much Huffington Post or something. For the record, I never read that website. I have standards, as low as they may be.

So back to the title and the point of this post. Are there actually hidden log files that could cause some unintended problems with your Lync 2013 environment? Absolutely. I am assuming you are already aware that IIS logs could fill up your local hard drive. It is also a good idea to keep an eye on the trace files created by OCS Logger and Snooper.

However, there are some hidden logfiles that are created by Windows Fabric that could very much fill up your hard drive and it would be a decent challenge to find them. If you are unaware, Lync 2013 sits on top of a technology called Windows Fabric. For a nice overview, check out this Technet blog article as well as this article on masteringlync.com.

By default, Windows Fabric is set to create log files in this hidden system directory:

C:\ProgramData\Windows Fabric\Log\Traces

Once a log file reaches 128MB, it creates a brand new log file. Over time, all of these 128MB log files will fill up your hard drive. When the hard drive gets full it’s very likely that you will see some issues with Lync – yes, even including the potential of one of your Lync servers crashing.

Here is a screenshot of one of my lab servers where I have done nothing to address this potential issue.

According to Windows Explorer, that is 810MB of disk space taken up in my Lab by Windows Fabric log files. Note that these are binary log files so it’s not as if I could read these log files to see what is happening. As such, these log files are only useful to Microsoft when troubleshooting a potential issue. You know, an issue like your hard drive has filled up! I don’t think there is a point in keeping a years worth of Windows Fabric log files.

So how do we keep these log files from eating up our drive space?

For the paranoid, create a scheduled task on all of your Front End Servers (and Directors and SBAs/SBSes) to move the logs to some other server that has disk space you want to waste.

For the rest of us looking for an easy, one time fix, run this command from an elevated command prompt (this is not a PowerShell command):

Logman update trace FabricLeaseLayerTraces -f bincirc --cnf

This will change the logging to circular. According to this Technet article, –cnf is used to “create a new file when the log size has been exceeded”. I imagine this is added as a parameter so that logging doesn’t stop once the initial 128MB file size has been reached. Rather, it will go back to the beginning of the same file and continue logging.

So there you go. Either keep an eye on this directory or run the Microsoft-recommended command to make sure these hidden log files don’t cause you unnecessary heartache.

10 comments

4 pings

Skip to comment form

  1. Andy Mac

    Hi there. It seems that these log files are created by 2x ‘User Defined’ Perfmon counters created once Lync / Fabric is installed. Do we know if it is safe to just stop these running counters rather than run the circular logging command you mentioned above ?

  2. Andy Mac

    Hi there. It seems that these log files are created by 2x ‘User Defined’ Perfmon counters created once Lync / Fabric is installed. Do we know if it is safe to just stop these running counters rather than run the circular logging command you mentioned above ?

  3. flinchböt

    You certainly could totally disable it. However, the logs would be very useful to have should you end up having a Windows Fabric issue. You could then quickly provide them the logs as opposed to re-enabling logging and then possibly having to recreate the issue. Since a single log is only 128MB of disk space I’d recommend enabling the circular logging instead of disabling it entirely.

  4. Andy Mac

    OK, but I guess Standard Edition admins will treat “Fabric” as an Enterprise Edition issue and not pay too much attention to the fact their own logs are filling up at a rate of knots.

  5. Andy Mac

    OK, but I guess Standard Edition admins will treat “Fabric” as an Enterprise Edition issue and not pay too much attention to the fact their own logs are filling up at a rate of knots.

  6. Abdullah Afaq Ali

    Thanks a lot!. You saved my day

  7. Abdullah Afaq Ali

    Thanks a lot!. You saved my day

  8. Craig Neeld

    Circular logging enabled. How do we increase the file size to a more respectable 1024MB. Fabric traces can fill up very quickly and im worried we’ll miss some vital logging. Is it the Buffer Size under the Trace Buffers tab of the Fabric properties?
    C

  9. Matt

    Hello,

    Is it possible to toggle the “–cnf” off/on? I am fairly new to Lync/SFB management and currently am working on a server that is constantly filling up with these logs, as opposed to an identical server in another pool that is not currently filling up.

    I want to enable this now so that we can troubleshoot the issue without the server crashing due to lack of disk space. Once resolved though, I want to take this off and then point the logs to be sent elsewhere(either another drive or another server altogether)

    Thanks, and I apologize in advance if this is a dumb question.

    1. flinchbot

      The full set of options can be found at this article – https://technet.microsoft.com/en-us/library/cc788128(v=ws.11).aspx

      So you can disable the bincirc potion with something like bin to disable the circular logging.

  1. NeWay Technologies – Weekly Newsletter #84 – February 27, 2014 | NeWay

    […] The Hidden Logs That Could Crash Your Lync Servers! – […]

  2. Check You Lync Server Windows Fabric Log Size with PowerShell | Tom Talks UC

    […] Lync 2013 Servers generate Windows Fabric logs, Flinchbot has already done a great write up. […]

  3. Check You Lync Server Windows Fabric Log Size with PowerShell | Tom Talks UC

    […] Lync 2013 Servers generate Windows Fabric logs, Flinchbot has already done a great write up. […]

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

%d bloggers like this: