KB ID 0001619

Problem

Seen on Exchange 2013/2016

Event ID 1012

Log Name: Application
Source:  MSExchangeDiagnostics
Event ID: 1012
Task Category: General
Level: Error
Keywords: Classic
User:  N/A
Description: Data loss occurred in RetentionAgent: RetentionAgent: Data loss occurred. The size of this folder E:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs has reached the max size allowed – 5120 MB. Some files will be purged.

Event ID 1013

Log Name: Application
Source: MSExchangeDiagnostics
Event ID: 1013
Task Category: General
Level: Warning
Keywords: Classic
User: N/A
Description: Potential data loss warning in RetentionAgent: RetentionAgent: Warning: Potential data loss. The size of this folder E:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs has reached 95% of max size allowed – 5120 MB. Some data will be purged once it reaches the max limit.

Temporary Solution

I must say I don’t really like this solution, if you trawl the forums, you will see this is how you suppress the error. But you should really relocate the logs

Navigate to: {Drive Letter}:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Diagnostics.Service.exe.config

Locate the DailyPerformanceLogs section and look for the LogDataLoss entry, change it from True to False.

Then restart the Microsoft Exchange Diagnostic Service.

Proper Solution

To relocate the logs to another location, or a larger partition/disk, do the following;

First double check the log location;

logman query ExchangeDiagnosticsDailyPerformanceLog | more

Then to move the logs, stop the logging, relocate the log location, and finally start the logging again;

logman -stop ExchangeDiagnosticsDailyPerformanceLog
logman -update ExchangeDiagnosticsDailyPerformanceLog -o “H:\Exchange\PerformanceLogs”
logman -start ExchangeDiagnosticsDailyPerformanceLog

Related Articles, References, Credits, or External Links

NA