Start-ExchangeLogMaintenance.ps1

########################################
#                                      #
#   Start-ExchangeLogMaintenance.ps1   #
#                                      #
########################################

# Delete Exchange diagnostics logfiles and IIS logfiles
# Modify the $DaysToRetain variable to modify the amount of logs to keep

$DaystoRetain="2"

# This will delete log files from the system, ensure you have a backup prior to running

# Deletes the *.blg files from performance monitoring - Default C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\
# Deletes the *.evt files from Office search - Default C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces\
# Deletes the *.log files from IIS - Default C:\inetpub\logs\LogFiles\
# Deletes the *.log files from %ExchangeInstallDir%\Logging\
# Deletes the *.log files from %ExchangeInstallDir%\TransportRoles\Logs

# if $env:ExchangeInstallPath is blank the script will abort

# Get Exchange install location
if (!$env:ExchangeInstallPath)
{
    write-error "ExchangeInstallPath is blank"
    exit
}

# References:
#
# https://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx
# https://gallery.technet.microsoft.com/Clear-Exchange-2013-Log-71abba44#content
# https://stackoverflow.com/questions/26784883/get-iis-log-location-via-powershell
# https://blogs.technet.microsoft.com/exchange/2015/04/20/a-better-way-to-collect-logs-from-your-exchange-servers/

Import-Module WebAdministration

# Stop and Disable the Exchange Health Management and Diagnostics Services
$ServiceList="MSExchangeHM","MSExchangeDiagnostics"
foreach ($Service in $ServiceList)
{
    stop-service $Service
    set-service $Service -StartupType Disabled
}

# Stop and disable the Scheduled Tasks for the performance monitoring
$ScheduledTaskList="ExchangeDiagnosticsDailyPerformanceLog","ExchangeDiagnosticsPerformanceLog"
foreach ($ScheduledTask in $ScheduledTaskList)
{
    $ScheduledTaskPath=(get-scheduledtask $scheduledtask).taskpath
    Stop-ScheduledTask -taskname $ScheduledTask -taskpath $ScheduledTaskPath
    Disable-ScheduledTask -taskname $ScheduledTask -taskpath $ScheduledTaskPath
}

# Get the diagnostic log file location
# uses logman to query the performance monitors
# remove the left 22 characters as a sample would be:
# Root Path:            C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs
# This leaves us with just the path C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs
# use logman without arguements to get list of performance logs
$DailyPerformanceLogPath=logman query ExchangeDiagnosticsDailyPerformanceLog | find "Root Path:"
$DailyPerformanceLogPath=$DailyPerformanceLogPath.substring(22)
$PerformanceLogPath=logman query ExchangeDiagnosticsPerformanceLog | find "Root Path:"
$PerformanceLogPath=$PerformanceLogPath.substring(22)

# Remove the performance monitoring logs
Get-ChildItem $DailyPerformanceLogPath -recurse -Include *.blg | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item
Get-ChildItem $PerformanceLogPath -recurse -Include *.blg | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item

# ETL file location is stored at HKLM\software\microsoft\office server\16.0\search\diagnostics\tracing
# get the path locaton and remove the files
$regpath=get-itemproperty -path "registry::HKEY_LOCAL_MACHINE\software\microsoft\office server\16.0\search\diagnostics\tracing\" -name tracingpath
Get-ChildItem $regpath.tracingpath -recurse -Include *.etl | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item

# get IIS log file locations
foreach($WebSite in $(get-website))
{
    $IISLogPath="$($Website.logFile.directory)\w3svc$($website.id)".replace("%SystemDrive%",$env:SystemDrive)

    # Delete the log files
    Get-ChildItem $IISLogPath -recurse -Include *.log | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item
}

# Remomve the %ExchangeInstallDir%\logging\*.log and %ExchangeInstallDir%\TransportRoles\Logs\*.log
Get-ChildItem $env:ExchangeInstallPath\Logging\ -recurse -Include *.log | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item
Get-ChildItem $env:ExchangeInstallPath\TransportRoles\Logs -recurse -Include *.log | Where-Object lastwritetime -lt (Get-Date).AddDays(-$DaysToRetain) | remove-item


# Enable the Scheduled Tasks for the performance monitoring
foreach ($ScheduledTask in $ScheduledTaskList)
{
    $ScheduledTaskPath=(get-scheduledtask $scheduledtask).taskpath
    Enable-ScheduledTask -taskname $ScheduledTask -taskpath $ScheduledTaskPath
}

# Enable and start the Exchange Health Management and Diagnostics Services
foreach ($Service in $ServiceList)
{
    set-service $Service -StartupType Auto
    start-service $Service
}