How to enable global and advanced logging for Outlook 2010 and Outlook 2013

Compared to earlier versions of Outlook, Microsoft Outlook 2010 and Microsoft Outlook 2013 provide a very simple method for enabling advanced logging through Windows Event Tracing (ETW). When you enable ETW logging, the result is an ETL (Event Trace Log) file. You will typically use this style of logging in a situation where you have a Microsoft Exchange Server mailbox and you experience one or more of the following problems/symptoms.

• Slow startup times
• Irregular delivery of email messages
• Views are slow to render
• Access to shared mailboxes is slow

Note You can experience these symptoms for an array of problems that may or may not be captured by this advanced RPC logging. For example, slow startup times can be caused by interactions with add-ins, and slow folder access can be caused by large mailboxes or folders, neither of which can be analyzed by the advanced logging discussed in this article. To help you find known performance issues caused by add-ins, large mailboxes or folders, use the Office Configuration Analyzer Tool. For more information about the Office Configuration Analyzer Tool, click the following article number to view the article in the Microsoft Knowledge Base:

2812744 Office Configuration Analyzer Tool (OffCAT) information

There may be other symptoms where advanced logging is helpful. If you are not sure, please talk to the support engineer helping you with your support case before you enable advanced logging.

The "More Information" section lists the steps that you can follow to enable global logging and advanced tracing. Additionally, it explains how to collect the log files after you have reproduced the problem while tracing is enabled.

Important To help protect customer data, the advanced trace log files are binary files that cannot be read without a conversion process. You can upload the log files to a secure location provided by Microsoft Customer Support Services. A support engineer from Microsoft can download and convert the log file for analysis.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756  How to back up and restore the registry in Windows

Note It is always best to enable logging when you are confident you can reproduce the problem in a timely manner. If you leave logging enabled for several hours/days, the problem becomes very difficult to analyze because of how much information is captured in the log file.

Enable global logging in Outlook 2010 and Outlook 2013

When you enable global logging through the Outlook interface, Outlook generates both transport and advanced trace logs. The advanced trace log contains advanced logging events. This includes RPC trace events, Sync events, and Exchange Web Services events related to AutoDiscover, Availability Services, MailTips, and OOF. The mail transport logs are text-based logs, such as OPML, IMAP, POP3, SMTP, and more are also generated.

Note In Outlook 2010, global logging changed after RTM (Release to Manufacturing). To troubleshoot a performance issue or other unexpected behavior, you must first make sure that you are using the most recent build of Outlook. For more information about the latest applicable updates for Outlook, click the following article number to view the article in the Microsoft Knowledge Base:

2625547 How to install the latest applicable updates for Microsoft Outlook (US English only)

Additionally, this is the only way to make sure that the expected logs are generated when you follow these steps.

1. On the File tab, select Options.
2. In the Outlook Options dialog box, select Advanced.
3. Scroll down the list of settings and then select the Enable troubleshooting logging (requires restarting Outlook) option.
   
   Note This option configures the following registry data:
   
   Key: HKEY_CURRENT_USER\Software\Microsoft\Office\xx.0\Outlook\Options\Mail
   DWORD: EnableLogging
   Value: 1
   
   where xx.0 is 14.0 for Outlook 2010 and 15.0 for Outlook 2013.
   
4. Click OK.
5. Exit Outlook.
6. Start Registry Editor.
7. Create the following registry value at the specified location:
   
   Note Manually create any registry keys or values if they do not exist. Also, unless otherwise specified, all registry keys are the same for 32-bit and 64-bit versions of Office. If the value already exists, note it.
   
   Key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\xx.0\Outlook\Options\Shutdown
   DWORD: FastShutdownBehavior
   Value: 2
   
   where xx.0 is 14.0 for Outlook 2010 and 15.0 for Outlook 2013.
   
8. Exit Registry Editor.
9. Restart Outlook and reproduce your issue.
10. After the issue is reproduced, exit Outlook.
    
    Note The log files are created in multiple folders. These folders differ per version.
    
    

    Outlook 2010

    Log files in the %temp% folder	File name
    Outlook advanced ETW log	Outlook-########.etl
    Outlook RPC log	OLKRPCLOG_date-time.etl
    AutoDiscover log	olkdisc.log
    Outlook/SharePoint synchronization logs	.htm and .xml files

    
    

    Log files in the %temp%\OlkAS folder	File name
    Availability Service, OOF, and Meeting Suggestion log files	date-time -AS.log
    Protection Rules log files	date-time -PB4S.log
    Unified messaging log files	date-time -UM.log
    Unified Messaging configuration log files	date-time .UMCFG.log

    
    

    Log files in the %temp%\OlkCalLogs folder	File name
    Outlook calendar log files	OlkCalLog_ date_time .etl

    
    

    Log files in the %temp%\Outlook Logging folder	File name
    MailTips log	date-time-mailtips.log
    OOF log	date-time-oof.log
    Transport log file	opmlog.log
    Outlook profile logs	Prof_OUTLOOK_PID_OutlookStart_date_time.txt Prof_OUTLOOK_PID_LoggingStart_date_time.txt
    SMTP log files	emailaddress -Outgoing-date_time.log
    POP3 log files	emailaddress -Incoming-date_time.log
    IMAP log files	IMAP- emailaddress -Incoming-date_time.log
    HTTP DAV log files	HTTP- emailaddress - date_time.log
    Outlook Hotmail Connector log files	OLC-emailaddress -date_time.log OLC-date_time.log emailaddress.txt
    Outlook Sharing Engine log files	SharingEngine date.log
    Outlook-Windows Desktop Search indexing log files	data file name.log
    Outlook first-run process log file	firstrun.log

    Outlook 2013

    Log files in the %temp% folder	File name
    Outlook/SharePoint synchronization logs	.htm and .xml files

    
    

    Log files in the %temp%\EASLogFiles	File name
    EAS logs for Outlook.com accounts	.bin and .xml folders

    
    

    Log files in the %temp%\OlkCalLogs folder	File name
    Outlook calendar log files	OlkCalLog_date_time .etl

    
    

    Log files in the %temp%\Outlook Logging folder	File name
    Advanced ETW log	Outlook-########.etl
    Transport log file	opmlog.log
    Outlook profile logs	Prof_OUTLOOK_PID_xxxxxxxx_date_time.txt Prof_OUTLOOK_PID_LoggingStart_date_time.txt
    SMTP log files	emailaddress -Outgoing-date_time.log
    POP3 log files	emailaddress -Incoming-date_time.log
    IMAP log files	IMAP-emailaddress -Incoming-date_time.log
    Outlook Sharing Engine log files	SharingEngine date.log
    Outlook-Windows Desktop Search indexing log files	data file name.log
    Outlook first-run process log file	firstrun.log

    
    Note You can sort by "Date modified" to find the files that were created most recently.
    
11. After you send the files to the Microsoft Support engineer, restore the original settings by disable the logging from step 3 and setting FastShutdownBehavior to the default value 0, unless you noted an existing value in step 7. 

Enable Outlook 2013 advanced logging only

In Outlook 2013, you can enable the advanced ETW logging without having to enable global logging. If you use the following registry setting, the mail transport logs (POP3, SMTP, and so on) are not generated. Additionally, the Outlook window title bar does not display the "Logging Enabled" string.

1. Exit Outlook.
2. Start Registry Editor.
3. Create the following registry values at the specified locations:
   
   Note Manually create any registry keys or values if they do not exist. Also, unless otherwise specified, all registry keys are the same for 32-bit and 64-bit versions of Office.
   
   Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Options\Mail
   DWORD: EnableETWLogging
   Value: 1
   
   Path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Outlook\Options\Shutdown
   DWORD: FastShutdownBehavior
   Value: 2
   
   Note If FastShutdownBehavior already exists, note the value.
   
4. Exit Registry Editor.
5. Start Outlook.
6. Reproduce the problem.
7. Exit Outlook.
8. After you send the files to the Microsoft Support engineer, restore the original settings by changing EnableETWLogging to 0 and FastShutdownBehavior to 0 (default), unless you noted an existing value for FastShutDownBehavior in step 3.

Performance Log Users group

If the .etl files are not generated as expected, you may have to add your user account to the Performance Log Users group on the workstation. To add your user account to the Performance Log Users group, follow these steps:

1. Click Start, click in the Start Search box, type compmgmt.msc, and then press ENTER.
2. Expand System Tools, expand Local Users and Groups, and then click Groups.
3. In the list of groups, right-click Performance Log Users, and then click Add to Group.
4. On the General tab, click Add.
5. Type the user name, or click Advanced to search the directory for your user account.
6. When you have finished, click OK, and then click OK again to close the Performance Log Users Properties dialog box.