locked
ExchangeDiagnosticsDailyPerformanceLog File size RRS feed

  • Question

  • Hello,

    I have 4 Exchange 2013 CU14 servers, one of which is logging the following error in the event log.

    Event 1012 MSExchangeDiagnostics

    Data loss occurred in RetentionAgent: RetentionAgent: Data loss occurred. The size of this folder C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs has reached the max size allowed - 5120 MB. Some files will be purged.

    All four of the servers have the same settings in the "C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Diagnostics.Service.exe.config" for Daily Performance Logs:

     <add Name="DailyPerformanceLogs" LogDataLoss="True" MaxSize="5120" MaxSizeDatacenter="2048" MaxAge="7.00:00:00" CheckInterval="08:00:00" />

    Also, on the problematic server the ExchangeDiagnosticsDailyPerformanceLog_*.blg files that are generated are only 21 MB in size, and are generated every half an hour or so.

    On the three servers that are OK, the file size is 1 GB, and there is only one file per day that is generated.

    I know I can surpress the Event 1012 message by setting the LogDataLoss="True" to LogDataLoss="False" but I want to know why this server is behaving differently than the others, and have it only generate one *.blg file per day as the other servers do.

    Can anyone advise why this issue is occurring, and if there are other settings that control this behaviour?

    Thanks



    Matt

    Tuesday, November 1, 2016 11:01 AM

Answers

  • Hi Matt,

    For Event 1039 error, we can refer to the following article to resolve :

    Exchange 2013 Event ID 1039: Failed to detect the bitlocker state for EDS log drive ‘C:\’.

    Solution:

    1.Open below file in notepad (run as admin):
    C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Diagnostics.Service.exe.config

    2.Change the parameter “DriveLockCheckEnabled” value=”True” to “DriveLockCheckEnabled” value=”False” and save the config-file.

    <!– Settings used when checking Bitlocker state of the drive where the diagnostics root directory exists –>
    < add key=”DriveLockCheckEnabled” value=”False” />
    < add key=”DriveLockCheckInterval” value=”00:00:10″/>
    < add key=”DriveLockMaxDuration” value=”00:04:00″/>

    3.Restart MicrosoftExchangeDiagnostics service, and the error message is gone.

    For the issue about *.blg files are generated per 30 mins, I recommend you try to reboot the problematic server and check if any helps.

    Best Regards, 


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Matt_Pollock Wednesday, November 9, 2016 11:06 AM
    Wednesday, November 9, 2016 2:15 AM
    Moderator

All replies

  • Hi Matt,

    As the event mentioned, it's due to the size of the DailyPerformanceLogs folder has reached the max size allowed, please delete all logs in the folder and restart "Exchange Health Manager Service (MSExchangeHMHost.exe)" service, and then check if any helps.

    Moreover, we can also have a check the following:

    In the Task Scheduler Manager, expand  "Task Scheduler \ Task Scheduler Library\ Microsoft\Windows\PLA" and compare the ExchangeDiagnosticsDailyPerformanceLog schedule with other servers, as below:

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 2, 2016 7:43 AM
    Moderator
  • Hi Niko,

    Thanks for the reply.

    I've emptied the DailyPerformanceLogs folder now, and restarted the "Microsoft Exchange Diagnostics" and "Microsoft Exchange Health Manager" services.

    The Event 1012 entries have stopped as expected, however a new error is being logged:

    Event 1039 MSExchangeDiagnostics

    Failed to detect the bitlocker state for EDS log drive 'C:\'.
    Exception
    System.Management.ManagementException: Invalid namespace 
       at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementObjectSearcher.Initialize()
       at System.Management.ManagementObjectSearcher.Get()
       at Microsoft.Exchange.Diagnostics.Service.DiagnosticsService.DriveLocked(String diagnosticsRootDrive

    In addition to this, the new *.blg files are still being generated every 30 mins or so and are 22 MB in size.

    The scheduled tasks on each server are identical also.


    Matt

    Wednesday, November 2, 2016 9:51 AM
  • Hi Matt,

    For Event 1039 error, we can refer to the following article to resolve :

    Exchange 2013 Event ID 1039: Failed to detect the bitlocker state for EDS log drive ‘C:\’.

    Solution:

    1.Open below file in notepad (run as admin):
    C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Diagnostics.Service.exe.config

    2.Change the parameter “DriveLockCheckEnabled” value=”True” to “DriveLockCheckEnabled” value=”False” and save the config-file.

    <!– Settings used when checking Bitlocker state of the drive where the diagnostics root directory exists –>
    < add key=”DriveLockCheckEnabled” value=”False” />
    < add key=”DriveLockCheckInterval” value=”00:00:10″/>
    < add key=”DriveLockMaxDuration” value=”00:04:00″/>

    3.Restart MicrosoftExchangeDiagnostics service, and the error message is gone.

    For the issue about *.blg files are generated per 30 mins, I recommend you try to reboot the problematic server and check if any helps.

    Best Regards, 


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Matt_Pollock Wednesday, November 9, 2016 11:06 AM
    Wednesday, November 9, 2016 2:15 AM
    Moderator