The Hidden Logs That Could Crash Your Lync Servers!

CrashHow’s that for the title of a blog article! Apparently I’ve been reading too much Huffington Post or something. For the record, I never read that website. I have standards, as low as they may be.

So back to the title and the point of this post. Are there actually hidden log files that could cause some unintended problems with your Lync 2013 environment? Absolutely. I am assuming you are already aware that IIS logs could fill up your local hard drive. It is also a good idea to keep an eye on the trace files created by OCS Logger and Snooper.

However, there are some hidden logfiles that are created by Windows Fabric that could very much fill up your hard drive and it would be a decent challenge to find them. If you are unaware, Lync 2013 sits on top of a technology called Windows Fabric. For a nice overview, check out this Technet blog article as well as this article on

By default, Windows Fabric is set to create log files in this hidden system directory:

C:\programdata\Windows Fabric\Fabric\log\Traces

Once a log file reaches 128MB, it creates a brand new log file. Over time, all of these 128MB log file will fill up your hard drive. When the hard drive gets full it’s very likely that you will see some issues with Lync – yes, even including the potential of one of your Lync servers to crash.

Here is a screenshot of one of my lab servers where I have done nothing to address this potential issue.

Windows Fabric Log Files

That is a lot of disk space used for logs I can’t even read.

According to Windows Explorer, that is 810MB of disk space taken up in my Lab by Windows Fabric log files. Note that these are binary log files so it’s not as if I could read these log files to see what is happening. As such, these log files are only useful to Microsoft when troubleshooting a potential issue. You know, an issue like your hard drive has filled up! I don’t think there is a point in keeping a years worth of Windows Fabric log files.

So how do we keep these log files from eating up our drive space? For the paranoid, create a scheduled task on all of your Front End Servers (and Directors and SBAs/SBSes) to move the logs to some other server that has disk space you want to waste. For the rest of us looking for an easy, one time fix, run this command from an elevated command prompt (this is not a PowerShell command):

Logman update trace FabricLeaseLayerTraces -f bincirc --cnf

This will change the logging to circular. According to this Technet article, –cnf is used to “create a new file when the log size has been exceeded”. I imagine this is added as a parameter so that logging doesn’t stop once the initial 128MB file size has been reached. Rather, it will go back to the beginning of the same file and continue logging.

So there you go. Either keep an eye on this directory or run the Microsoft-recommended command to make sure these hidden log files don’t cause you unnecessary heartache.

~ by flinchböt on 2014/02/28.

7 Responses to “The Hidden Logs That Could Crash Your Lync Servers!”

  1. […] The Hidden Logs That Could Crash Your Lync Servers! – […]

  2. Hi there. It seems that these log files are created by 2x ‘User Defined’ Perfmon counters created once Lync / Fabric is installed. Do we know if it is safe to just stop these running counters rather than run the circular logging command you mentioned above ?

  3. You certainly could totally disable it. However, the logs would be very useful to have should you end up having a Windows Fabric issue. You could then quickly provide them the logs as opposed to re-enabling logging and then possibly having to recreate the issue. Since a single log is only 128MB of disk space I’d recommend enabling the circular logging instead of disabling it entirely.

  4. OK, but I guess Standard Edition admins will treat “Fabric” as an Enterprise Edition issue and not pay too much attention to the fact their own logs are filling up at a rate of knots.

  5. Thanks a lot!. You saved my day

  6. […] Lync 2013 Servers generate Windows Fabric logs, Flinchbot has already done a great write up. […]

  7. […] and FlinchBot have written about this before, but I’ve never really needed to worry about it thanks to the […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: