How to Clean Up Exchange Server Logs Using PowerShell
Create and schedule PowerShell scripts to automatically clean up IIS, ETL, and Exchange protocol logs on Exchange 2016/2019, freeing disk space without affecting database transaction logs.
- Difficulty
- Intermediate
- Time required
- 20-30 minutes
- Steps
- 6
- Platform
- Exchange Server
Table of contents
Quick Answer
Go to the stepsTarget IIS, Exchange Logging, and ETL directories. Delete .log, .blg, .etl files older than 7 days. Schedule at 2 AM daily.
- Audit current log sizes.
- Create a cleanup script for IIS, Logging, and ETL paths.
- Dry run to verify targets.
- Execute and verify disk space recovery.
- Schedule daily via Task Scheduler.
Get-ChildItem "$env:ExchangeInstallPath\Logging" -Recurse -File | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-7)} | Remove-Item -ForceExpected result: Disk space recovered. Exchange services unaffected.
Key takeaways
- How to identify which Exchange log directories consume the most space, create a PowerShell cleanup script, and schedule automated daily cleanup via Task Scheduler.
- Without cleanup, Exchange diagnostic logs can fill the system drive, causing services to stop and databases to dismount.
- Automate cleanup with a scheduled task daily at 2 AM. Keep at least 7 days of logs. Never delete database transaction logs.
Introduction
Exchange Server generates massive amounts of diagnostic log data during normal operation. IIS logs track every web request to Exchange Web Services, OWA, and ActiveSync. ETL files capture diagnostic traces from the search indexer. Protocol logs record SMTP, MAPI, and EWS connections.
The standard cleanup targets four directories: IIS logs, Exchange component logs, and two Ceres diagnostics paths for ETL traces and search logs. These are safe to delete after a retention period.
This tutorial does NOT touch database transaction logs. Transaction logs are truncated by successful backups, not by manual deletion. Deleting them breaks your recovery chain.
Who this is for: Exchange administrators and MSPs managing on-premises Exchange Server 2016 or 2019.
Before you start
- Access
- Local administrator access on the Exchange server.
- Required roles
- Local administrator
- Required licenses
- Exchange Server 2016 or 2019
- Environment
- Windows Server 2016/2019/2022 running Exchange Server 2016 or 2019.
- Vendor
- Microsoft
- Administrator permissions required
Script creation takes 15-20 minutes. Scheduling adds 5-10 minutes.
Critical: Never delete database transaction logs manually
Database transaction logs are managed by Exchange and truncated by backups. Deleting them manually breaks the recovery chain and can cause data loss. This tutorial targets only diagnostic logs.
Warning: Create a backup of your cleanup configuration
Run the script in dry-run mode first to verify it targets only the intended files.
1Audit current log directory sizes
Identify which log directories consume the most space.
Open PowerShell as Administrator. Measure each log directory: IIS logs, Exchange Logging, and two Ceres diagnostics paths. Use Get-ChildItem with Measure-Object to calculate sizes. On unmaintained servers these can total 10-50+ GB.
Expected result: Each directory shows its size in GB.
Note
The Exchange install path is typically C:\Program Files\Microsoft\Exchange Server\V15. Use the %ExchangeInstallPath% environment variable.
2Create the cleanup script
Build a cleanup script targeting all four log directories.
Create C:\Scripts and save a cleanup script that targets .log, .blg, and .etl files older than a configurable retention period across IIS, Exchange Logging, and two Ceres paths. The community scripts by Ali Tajran, SammyKrosoft, and Franky's Web all follow this pattern.
New-Item -Path 'C:\Scripts' -ItemType Directory -ForceExpected result: Script file exists at C:\Scripts\CleanupExchangeLogs.ps1.
Note
Adjust the $Days variable based on compliance requirements. 7-14 days is standard.
3Run a dry run to preview deletions
Verify the script targets only intended files.
Count files using Get-ChildItem with Measure-Object before deleting anything. This shows exactly what the cleanup will remove and how much space it recovers.
Expected result: File count and size per directory. No files deleted.
Note
If unexpected files appear, check paths and retention period.
4Execute the initial cleanup
Delete old diagnostic logs and reclaim disk space.
Run the cleanup script as Administrator. It removes .log, .blg, and .etl files older than the retention period. Locked files are skipped automatically with -ErrorAction SilentlyContinue.
Check disk space before and after with Get-Volume.
Get-Volume C | Select-Object DriveLetter, @{N='FreeGB';E={[math]::Round($_.SizeRemaining/1GB,2)}}Expected result: Disk space increases. No Exchange service disruptions.
Note
Some files will be skipped because they're locked. They'll be cleaned on the next run.
5Schedule daily automated cleanup
Automate daily off-hours cleanup.
Create a scheduled task with Register-ScheduledTask. Run as SYSTEM at 2 AM daily with -ExecutionPolicy Bypass.
Expected result: Scheduled task runs daily at 2 AM.
Note
Schedule during off-peak hours to minimize I/O impact.
6Verify the scheduled task works
Confirm the scheduled task runs correctly.
Test manually with Start-ScheduledTask. Check results with Get-ScheduledTaskInfo. LastTaskResult 0 means success.
Start-ScheduledTask -TaskName 'Exchange Log Cleanup'Expected result: LastTaskResult shows 0 (success). Disk space stable.
Note
If the task fails with access denied, verify the run-as account has permissions on all log directories.
How to Confirm Cleanup Is Working
Verify fix
Monitor disk space over the following week. A healthy server with daily cleanup should show IIS logs under 2 GB, Exchange Logging under 5 GB, and ETL under 500 MB.
Verify services: Get-Service MSExchange* | Where-Object {$_.Status -ne 'Running'}.
Normal result: Log directories stay within expected sizes. Services run without interruption.
Abnormal result: If disk space keeps dropping, check database transaction log growth (a backup issue).
Successful
IIS <2GB, Logging <5GB, ETL <500MB
Daily cleanup maintaining expected sizes.
Transaction log growth
Database log directory growing
Fix your backup schedule.
Locked files
Some files remain in use
Normal. Cleaned on next run.
Troubleshooting
Script fails with access denied
Warning
Cause: Account lacks NTFS permissions on log directories.
Run as Administrator or SYSTEM. For scheduled tasks, use SYSTEM.
Disk space still filling up
Critical
Cause: Database transaction logs growing due to failed backups. Cleanup script doesn't touch them.
Check backups with Get-MailboxDatabase -Status | Select Name, LastFullBackup. Fix the backup to truncate transaction logs.
Exchange services stopped after cleanup
Warning
Cause: Extremely unlikely. System drive was probably already critically full.
Restart services: Get-Service MSExchange* | Start-Service. Check Event Viewer for the actual cause.
Scheduled task shows error 0x1
Note
Cause: Execution policy blocking script or wrong path.
Verify -ExecutionPolicy Bypass is in the task action. Check the script path.
Frequently asked questions
Is it safe to delete files from the Exchange Logging directory?
Yes. The Exchange Logging directory contains diagnostic logs, not database data. These are safe to delete after your retention period.
What's the difference between diagnostic and transaction logs?
Diagnostic logs record service activity and can be safely deleted. Transaction logs contain database changes, are critical for recovery, and are truncated by backups.
How much disk space can log cleanup free?
Varies by environment. Servers without maintenance typically have 10-50+ GB of accumulated logs.
Should I set retention to 1 day?
Not recommended. Keep at least 7 days for troubleshooting. 7-14 days is the standard recommendation.
Does this work on Exchange Server SE?
Yes. Exchange Server SE uses the same directory structure and logging paths as Exchange 2019.
Conclusion
Target the four standard log directories, delete files older than your retention period, and schedule daily. Never touch database transaction logs.
Automate cleanup with a scheduled task daily at 2 AM. Keep at least 7 days of logs. Never delete database transaction logs.
C:\Scripts\CleanupExchangeLogs.ps1 scheduled daily at 2 AMSources3
