Lync Server: Windows Fabric Logs, Disk Space Usage, and Circular Logging
Contents
Originally posted on February 15, 2017
I know there have been many articles written and available for this topic. The reason I decided to still write this is to provide more explanation to some possible questions that I also found myself asking as well about the subject.
To understand what Windows Fabric is, what it does and how it works you may refer to this link - Understanding how Windows Fabric Works (with regards to Lync)
The Data Collector Sets
There are two (2) User Defined Collector sets by default when a Lync Front-End server is deployed.
- FabricLeaseLayerTraces
- FabricTraces
You can find these in Performance Monitor
And the default location of the files generated by these data collectors are in C:\ProgramData\Windows Fabric\Fabric\log\Traces folder in each front-end server.
The screenshot above is from one of the FE Servers in my lab setup. As you can see there are multiple files with approximately 128MB size each.
What’s happening is that once the log file reached the size of 128MB, a new log file is generated with an incremental version.
1
2
fabric_traces_130374156934210426_0076**25**.etl
fabric_traces_130374156934210426_0076**26**.etl
And there is no arbitrary limit as to how many of these files are created and can eventually consume all available free space.
Why the 128MB Maximum File Size?
The ETL file size not really limited to 128MB and can be adjusted. It’s just that 128MB is the default value when the data collector was created. You can simply check this using the logman utility.
What triggers the data collector to start?
A Task is scheduled to run at system startup which calls the StartTracing.cmd batch file.
Where can I find StartTracing.cmd?
A relative path (eg. C:\Windows\etc\whatever.cmd) is not necessary because the file StartTracing.cmd is located in a path that is already defined in the Environment Variables.
To find the StartTracing.cmd location, refer to the screenshot below.
How do I stop Windows Fabric from generating multiple log trace files?
The short answer is to turn on Circular Logging. How?
According to this [article](http://flinchbot.com/2014/02/28/the-hidden-logs-that-could-crash-your-lync-servers/), you can turn on circular logging by running this command (from an elevated command prompt)
1
Logman update trace FabricLeaseLayerTraces -f bincirc --cnf
I did use that article as a guide to enable the Circular Logging for both collectors, but somehow logman still kept on generating new files. I’m not saying that it is wrong, only that some parameters were not included to achieve my intended outcome.
So why didn’t it work? That is because despite circular logging being turned on, the versioning is still enabled and the overwrite switch was not specified. In order to really turn on Circular Logging and keep the number of files to 1, this is what I did:
First, run this command an elevated command prompt:
1
Logman update trace FabricLeaseLayerTraces -f bincirc --v --cnf -owLogman update trace FabricTraces -f bincirc --v --cnf -ow
What do the switches mean?
-f bincrc = turn on circular logging
--v = turn off file versioning
--cnf = turn off creation of new files
-ow = turn on overwrite of existing log file
Next, temporarily stop the logging.
1
logman stop fabricleaselayertraceslogman stop fabrictraces
Then, delete the existing log files
1
del "C:\ProgramData\Windows Fabric\Fabric\log\Traces\*.*"
Lastly, start the logging again.
1
logman start fabricleaselayertraceslogman start fabrictraces
Notice from the screenshot below that the versioning has been removed.
The same set of log files will be overwritten every time.
Also, you may want to consider increasing the maximum file size to a much higher value (like 2GB or higher) since there will only one log file for each data collector.
1
logman update fabrictraces -max 2048logman update fabricleaselayertraces -max 2048
References
Understanding how Windows Fabric Works (with regards to Lync)