Large ETLTraces files after Exchange 2013 CU6

Question

After installing Exchange 2013 CU6, you may notice the Exchange Drive is consumed a lot than before and the size is increasing rapidly. After troubleshooting, you may find everything is running properly and
there is no issues with your Exchange Server.
Then you need to check whether the files in the following location is the root cause:
C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\logfie
C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces
(You may find log files like “DocumentProcessingTrace_XX.etl )
Prior to CU6, there is not ETLTrace folder listed in this location and there are log folders however the log file has files no exceeding 7 MB size.
Post upgrade, there comes the ETLTrace folder and the files in this folder are close to 50 MB and the log files folder have log files exceeding 50 MB size.
This is a designed behavior in Exchange CU6, if you have limited hard drive space, as a workaround solution, we can safely remove or move the location of these lo files:
Before doing the changes, please firstly stop the health monitoring service. To Change the Log File Path, the Registry Key value is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Search Foundation for Exchange\Diagnostics
To Change the ETLTrace path the registry Value is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\16.0\Search\Diagnostics\Tracing
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Answer 1

@Simon_Wu, I tried your solution. However after a couple of days the logs were moved back to the original, default location. It looks like the server has a process which checks for hacks and undoes any attempts to change the path.
Interestingly the altered Registry entries remained altered, however the files were switched back to the default location. It generates just over 1Gb of logs per day on a largely idling Exchange 2013 CU7 server with 350 mailboxes.
Go figure!
What I found to work consistently and reliably is to replace default folders with junction points to another folder on another drive.
I also found that these files are created by a process which runs under the System process (PID 4), therefore you'll need to restart the server in Safe Mode to replace the default folders with junction points.