IIS logs are huge

Question

_{Thursday, November 29, 2018 7:49 PM}

I'm migrating from 2010 to 2016. Both servers are online in co-existence, and I've started the process to migrate mailboxes.

So far things have been going well. I've currently migrated about 170 mailboxes out of 550. My Outlook and mobile clients (both internal and external) hit a KEMP load balancer which forwards the traffic to the 2016 server. All clients are connecting via HTTPS.

Prior to migrating users, my IIS logs on the 2010 servers would grow to about 140-150MB per day. After migration however they were hitting 800-900MB per day. Looking at them on the 2010 servers I saw a number of errors indicating "MisconfiguredDevice_Mbx:EXCHANGE2016-1.domain.local" for various users who I'd migrated off (so they shouldn't have been hitting the 2010 servers).

After doing some searching I saw that I needed to restart the MSExchangeSyncAppPool on the 2010 servers. Doing so has brought them under control.

However, I noticed that my logs on the 2016 server were crazy insane. I'm getting logfiles up to 2GB per day. Looking at them I don't see errors, just miles and miles of things like this:

2018-11-29 08:24:45 10.1.6.38 POST /mapi/emsmdb/ [email protected] 444 Anonymous 10.1.6.38 Microsoft+Office/15.0+(Windows+NT+6.3;+Microsoft+Outlook+15.0.5075;+Pro) - 200 0 0 4

They're not all from the same mailbox ID, or even the same 2 or 3 IDs. There are so many of them. Do I have some logging cranked up to high or something? I've restarted the MSExchangeSyncAppPool on the 2016 server as well, but it hasn't made a change in the logs.

I also have two IIS log folders, one for W3SVC1 and one for W3SVC2. They look like they're logging the same things, though W3SVC1 appears to actually show usernames (autodiscover logs). Both folders have ~2GB per day logfiles.

All replies (4)

_{Wednesday, December 5, 2018 10:17 AM ✅Answered}

Hi,

As far as I know, IIS log is enabled for virtual directories including Autodiscover, OWA, mapi, OAB, etc. The increment could not be caused by the situation that some logging is not turned off, because it is turned up by default. 

After migrating mailboxes, Exchange 2016 server will process more client behaviors than a proxy server including Autodiscover, ActiveSync and so on. You can use LogParser and analyze what action is most recorded. Moreover, if you concern about the large log size, you can delete the log using the following script.

https://gallery.technet.microsoft.com/office/Clear-Exchange-2013-Log-71abba44

Regards,

Dawn Zhou

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

_{Wednesday, December 12, 2018 4:24 PM ✅Answered}

Thanks. I just disabled IIS logging entirely for the time being.

_{Friday, November 30, 2018 8:53 AM}

Hi,

After migrating mailboxes, Active Directory replication delays and Autodiscover caching might cause a delay before the users can access their mailbox. Recycling the Autodiscover app pool in IIS can solve the Autodiscover caching issue. 

As there is no error in the IIS log, you need to identify what processes could lead to the growing log. You can use LogParser for troubleshooting IIS performance issues. Please refer to following article to download LogParser and see how to use it.
Troubleshooting IIS Performance Issues or Application Errors using LogParser

Regards,

Dawn Zhou

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

_{Friday, November 30, 2018 1:54 PM}

From what I'm seeing there aren't many errors. Out of almost 7 million elements processed there were 111 401 statuses and 200 500 statuses.

It seems that it's just logging EVERYTHING (autodiscover, client connections) constantly. Is there a way I can dial back how much is getting logged? I didn't have this issue when the 2016 server was proxying connections, and the 2010 IIS logs don't show this much logging.

I did have a support incident with Microsoft and they were trying to determine the cause of some Autodiscover issues. I'm wondering if they turned up some logging and didn't turn it off, but I don't know where that'd be configured.