The Hidden Logs That Could Crash Your Lync Servers!

How’s that for the title of a blog article! Apparently I’ve been reading too much Huffington Post or something. For the record, I never read that website. I have standards, as low as they may be.

So back to the title and the point of this post. Are there actually hidden log files that could cause some unintended problems with your Lync 2013 environment? Absolutely. I am assuming you are already aware that IIS logs could fill up your local hard drive. It is also a good idea to keep an eye on the trace files created by OCS Logger and Snooper.

However, there are some hidden logfiles that are created by Windows Fabric that could very much fill up your hard drive and it would be a decent challenge to find them. If you are unaware, Lync 2013 sits on top of a technology called Windows Fabric. For a nice overview, check out this Technet blog article as well as this article on masteringlync.com.

By default, Windows Fabric is set to create log files in this hidden system directory:

C:\ProgramData\Windows Fabric\Log\Traces

Once a log file reaches 128MB, it creates a brand new log file. Over time, all of these 128MB log files will fill up your hard drive. When the hard drive gets full it’s very likely that you will see some issues with Lync – yes, even including the potential of one of your Lync servers crashing.

Here is a screenshot of one of my lab servers where I have done nothing to address this potential issue.

According to Windows Explorer, that is 810MB of disk space taken up in my Lab by Windows Fabric log files. Note that these are binary log files so it’s not as if I could read these log files to see what is happening. As such, these log files are only useful to Microsoft when troubleshooting a potential issue. You know, an issue like your hard drive has filled up! I don’t think there is a point in keeping a years worth of Windows Fabric log files.

So how do we keep these log files from eating up our drive space?

For the paranoid, create a scheduled task on all of your Front End Servers (and Directors and SBAs/SBSes) to move the logs to some other server that has disk space you want to waste.

For the rest of us looking for an easy, one time fix, run this command from an elevated command prompt (this is not a PowerShell command):

Logman update trace FabricLeaseLayerTraces -f bincirc --cnf

This will change the logging to circular. According to this Technet article, –cnf is used to “create a new file when the log size has been exceeded”. I imagine this is added as a parameter so that logging doesn’t stop once the initial 128MB file size has been reached. Rather, it will go back to the beginning of the same file and continue logging.

So there you go. Either keep an eye on this directory or run the Microsoft-recommended command to make sure these hidden log files don’t cause you unnecessary heartache.

12 comments

5 pings

Skip to comment form

  1. Hi there. It seems that these log files are created by 2x ‘User Defined’ Perfmon counters created once Lync / Fabric is installed. Do we know if it is safe to just stop these running counters rather than run the circular logging command you mentioned above ?

  2. Hi there. It seems that these log files are created by 2x ‘User Defined’ Perfmon counters created once Lync / Fabric is installed. Do we know if it is safe to just stop these running counters rather than run the circular logging command you mentioned above ?

  3. You certainly could totally disable it. However, the logs would be very useful to have should you end up having a Windows Fabric issue. You could then quickly provide them the logs as opposed to re-enabling logging and then possibly having to recreate the issue. Since a single log is only 128MB of disk space I’d recommend enabling the circular logging instead of disabling it entirely.

  4. OK, but I guess Standard Edition admins will treat “Fabric” as an Enterprise Edition issue and not pay too much attention to the fact their own logs are filling up at a rate of knots.

  5. OK, but I guess Standard Edition admins will treat “Fabric” as an Enterprise Edition issue and not pay too much attention to the fact their own logs are filling up at a rate of knots.

    • Abdullah Afaq Ali on 2014/05/20 at 23:51
    • Reply

    Thanks a lot!. You saved my day

    • Abdullah Afaq Ali on 2014/05/20 at 23:51
    • Reply

    Thanks a lot!. You saved my day

    • Craig Neeld on 2016/04/18 at 10:24
    • Reply

    Circular logging enabled. How do we increase the file size to a more respectable 1024MB. Fabric traces can fill up very quickly and im worried we’ll miss some vital logging. Is it the Buffer Size under the Trace Buffers tab of the Fabric properties?
    C

    • Matt on 2017/01/28 at 04:06
    • Reply

    Hello,

    Is it possible to toggle the “–cnf” off/on? I am fairly new to Lync/SFB management and currently am working on a server that is constantly filling up with these logs, as opposed to an identical server in another pool that is not currently filling up.

    I want to enable this now so that we can troubleshoot the issue without the server crashing due to lack of disk space. Once resolved though, I want to take this off and then point the logs to be sent elsewhere(either another drive or another server altogether)

    Thanks, and I apologize in advance if this is a dumb question.

    1. The full set of options can be found at this article – https://technet.microsoft.com/en-us/library/cc788128(v=ws.11).aspx

      So you can disable the bincirc potion with something like bin to disable the circular logging.

    • John on 2017/07/14 at 12:22
    • Reply

    Correct directory is C:\ProgramData\Windows Fabric\Fabric\log\Traces

    1. Are you running Windows Server 2016? On Windows 2012 R2 it’s in the same directory as in the article. It’s very possible it moved in a different OS.

  1. […] The Hidden Logs That Could Crash Your Lync Servers! – […]

  2. […] Lync 2013 Servers generate Windows Fabric logs, Flinchbot has already done a great write up. […]

  3. […] Lync 2013 Servers generate Windows Fabric logs, Flinchbot has already done a great write up. […]

  4. […] According to this article – http://flinchbot.com/2014/02/28/the-hidden-logs-that-could-crash-your-lync-servers/ – you can turn on circular logging by running this command (from an elevated command […]

Leave a Reply to flinchbot Cancel reply

Your email address will not be published.