Tips and tricks for DSC:Purge logfiles

Starting with Exchange 2013 an Exchange server is logging a vast amount of data. As not every installation has enough space or there is a compliance rule, which forces you not to keep log files older than x days, you might need something to delete these files.

There are several methods to achieve this. One for example is the script from fellow MCM/MCSM Thomas Stensitzki Purge-LogFiles.ps1 (read more about it on his post here).

You can run the script manually or create a scheduled task.

But when you are using Desired State Configuration (DSC), why not add the task to purge those files to your MOFs?

In order to purge unneeded log files you can use the built-in Script resource. In this example I’m deleting only the IIS logs older than 7 days.

Script CleanLogfiles
{
    GetScript = {
        @{
            TestScript = $TestScript
            SetScript  = $SetScript
            GetScript  = $GetScript
        }
    }

    SetScript = {
        $LogFolders=@("C:\inetpub\logs\LogFiles\W3SVC1","C:\inetpub\logs\LogFiles\W3SVC2","C:\Windows\System32\LogFiles\HTTPERR")
        [int]$DaysToKeep = '7'
        $TypeFilter = @("*.log")
        ForEach ($Folder in $LogFolders) {
            [array]$temp = $null
            $temp=Get-ChildItem $Folder -Filter "*.log" | ? LastWriteTime -lT (Get-Date).AddDays(-$DaysToKeep)
            if(($temp | measure).Count -gt 0) {
                Write-Verbose "Folder $($Folder) contains $(($temp | measure).Count) files, which will be deleted!"
                $temp | Remove-Item -Include $TypeFilter -Force
            }
        }
    }

    TestScript = {
        $LogFolders=@("C:\inetpub\logs\LogFiles\W3SVC1","C:\inetpub\logs\LogFiles\W3SVC2","C:\Windows\System32\LogFiles\HTTPERR")
        [int]$DaysToKeep = '7'
        $ReturnValue = $true
        ForEach ($Folder in $LogFolders) {
            [array]$temp = $null
            $temp=Get-ChildItem $Folder -Filter "*.log" | ? LastWriteTime -lT (Get-Date).AddDays(-$DaysToKeep)
            if(($temp | measure).Count -gt 0) {
                Write-Verbose "Folder $($Folder) contains $(($temp | measure).Count) files, which will be deleted!"
                $ReturnValue = $false
                break;
            }
        }
        return $ReturnValue
    }

}

When enforcing the new MOF it looks like this

CleanLogs01.PNG

As you can see there were a lot of files to be purged.

You might have noticed that in this example the folders where hardcoded. A better way is to have the location automatically detected and you might also want to purge Exchange related logs from beneath the directory %ExchangeInstallPath%\Logging.

For this use the following code

Script CleanLogfiles
{
    GetScript = {
        @{
            TestScript = $TestScript
            SetScript  = $SetScript
            GetScript  = $GetScript
        }
    }

    SetScript = {
        $IISLogs = ((Get-WebConfigurationProperty 'system.applicationHost/sites/siteDefaults' -Name logFile).directory).Replace('%SystemDrive%',$env:SystemDrive)
        $EXLogs  = ($env:ExchangeInstallPath)+"Logging"
        $LogFolders=@($EXLogs,$IIsLogs,"C:\Windows\System32\LogFiles\HTTPERR")
        [int]$DaysToKeep = '7'
        $TypeFilter = @("*.log")
        ForEach ($Folder in $LogFolders) {
            [array]$temp = $null
            $temp=Get-ChildItem $Folder -Recurse -Include $TypeFilter | ? LastWriteTime -lT (Get-Date).AddDays(-$DaysToKeep)
            if(($temp | measure).Count -gt 0) {
                Write-Verbose "Folder $($Folder) contains $(($temp | measure).Count) files, which will be deleted!"
                $temp | Remove-Item -Include $TypeFilter -Force
            }
        }
    }

    TestScript = {
        $IISLogs = ((Get-WebConfigurationProperty 'system.applicationHost/sites/siteDefaults' -Name logFile).directory).Replace('%SystemDrive%',$env:SystemDrive)
        $EXLogs  = ($env:ExchangeInstallPath)+"Logging"
        $LogFolders=@($EXLogs,$IIsLogs,"C:\Windows\System32\LogFiles\HTTPERR")
        [int]$DaysToKeep = '7'
        $TypeFilter = @("*.log")
        $ReturnValue = $true
        ForEach ($Folder in $LogFolders) {
            [array]$temp = $null
            $temp=Get-ChildItem $Folder -Recurse -Include $TypeFilter | ? LastWriteTime -lT (Get-Date).AddDays(-$DaysToKeep) #| Remove-Item -Filter {*.log} -Force
            if(($temp | measure).Count -gt 0) {
                Write-Verbose "Folder $($Folder) contains $(($temp | measure).Count) files, which will be deleted!"
                $ReturnValue = $false
                break;
            }
        }
        return $ReturnValue
    }

}

Before using this in production: Test, test, test…

I hope this helps to stay on top of all the log files.

Leave a comment