Configure diagnostic logging (SharePoint Server 2010)

Applies to: SharePoint Server 2010, SharePoint Foundation 2010

This article provides information about configuring diagnostic logging in Microsoft SharePoint Server 2010.

In this article:

• Best practices

• To configure diagnostic logging by using Central Administration

• To configure diagnostic logging by using Windows PowerShell

Best practices

The SharePoint Server 2010 environment might require configuration of the diagnostic loggings settings after initial deployment or upgrade and possibly throughout the system’s life cycle. The guidelines in the following list can help you form best practices for the specific environment.

• Change the drive that logging writes to. By default, diagnostic logging is configured to write logs to the same drive and partition that SharePoint Server 2010 was installed on. Because diagnostic logging can use lots of drive space and writing to the logs can affect drive performance, you should configure logging to write to a drive that is different from the drive on whichSharePoint Server 2010 was installed. You should also consider the connection speed to the drive that logs are written to. If verbose-level logging is configured, lots of log data is recorded. Therefore, a slow connection might result in poor log performance.

• Restrict log disk space usage. By default, the amount of disk space that diagnostic logging can use is not limited. Therefore, limit the disk space that logging uses to make sure that the disk does not fill up, especially if you configure logging to write verbose-level events. When the disk restriction is used up, the oldest logs are removed and new logging data information is recorded.

• Use the Verbose setting sparingly. You can configure diagnostic logging to record verbose-level events. This means that the system will log every action that SharePoint Server 2010 takes. Verbose-level logging can quickly use drive space and affect drive and server performance. You can use verbose-level logging to record a greater level of detail when you are making critical changes and then re-configure logging to record only higher-level events after you make the change.

• Regularly back up logs. The diagnostic logs contain important data. Therefore, back them up regularly to make sure that this data is preserved. When you restrict log drive space usage, or if you keep logs for only a few days, log files are automatically deleted, starting with the oldest files first, when the threshold is met.

• Enable event log flooding protection. Enabling this setting configures the system to detect repeating events in the Windows event log. When the same event is logged repeatedly, the repeating events are detected and suppressed until conditions return to a typical state.

You can set the level of diagnostic logging for the event log and for the trace log. This will limit the types and amount of information that will be written to each log. The following tables define the levels of logging available for the event log and trace log:

Event log levels

Trace log levels

Configure diagnostic logging by using Central Administration

You can use Central Administration to configure diagnostic logging.

To configure diagnostic logging by using Central Administration

1. Verify that the user account that is performing this procedure is a member of the Farm Administrators SharePoint group.

2. In Central Administration, on the Home page, click Monitoring.

3. On the Monitoring page, in the Reporting section, click Configure diagnostic logging.

4. On the Diagnostic Logging page, in the Event Throttling section, you can configure event throttling as follows:

   To configure event throttling for all categories:

   1. Select the All Categories check box.

   2. Select the event log level from the Least critical event to report to the event log list.

   3. Select the trace log level from the Least critical event to report to the trace log list.

   To configure event throttling for one or more categories:

   1. Select the check boxes next to the categories that you want.

   2. Select the event log level from the Least critical event to report to the event log list.

   3. Select the trace log level from the Least critical event to report to the trace log list.

   To configure event throttling for one or more sub-categories (you can expand one or more categories and select any sub-category):

   1. Click (+) next to the category to expand the category.

   2. Select the check box next to the sub-category.

   3. Select the event log level from the Least critical event to report to the event log list.

   4. Select the trace log level from the Least critical event to report to the trace log list.

   To configure event throttling for all categories back to default settings:

   1. Select the All Categories check box.

   2. Select Reset to default from the Least critical event to report to the event log list.

   3. Select Reset to default from the Least critical event to report to the trace log list.

5. In the Event Log Flood Protection section, select the Enable Event Log Flood Protection check box.

6. In the Trace Log section, in the Path box, type the path of the folder to which you want logs to be written.

7. In the Number of days to store log files box, type the number of days (1-366) that you want logs to be kept. After this time, logs will automatically be deleted.

8. To restrict how much disk space the logs can use, select the Restrict Trace Log disk space usage check box, and then type the number gigabytes (GB) you want to restrict log files to. When logs reach this disk size, older logs will automatically be deleted.

9. After you have made the changes that you want on the Diagnostic Logging page, click OK.

Configure diagnostic logging by using Windows PowerShell

You can use Windows PowerShell to configure diagnostic logging.

To configure diagnostic logging by using Windows PowerShell

1. Verify that you meet the following minimum requirements: See Add-SPShellAdmin.

2. On the Start menu, click All Programs.

3. Click Microsoft SharePoint 2010 Products.

4. Click SharePoint 2010 Management Shell.

5. At the Windows PowerShell command prompt (that is, PS C:\>), type the following command, and then press ENTER:

   Set-SPLogLevel -TraceSeverity {None | Unexpected | Monitorable | Medium | High | Verbose} -EventSeverity {None | Information | Warning | Error | Critical | Verbose} [-Identity <Category name...>]  -Verbose

   You can use the Identity parameter to specify one or more categories to change — for example, Administration. If you do not specify the value for the Identity parameter, all categories are changed.

   To view the current settings, type Get-SPLogLevel, and then press ENTER.

   To set all categories back to default levels, type Clear-SPLogLevel, and then press ENTER.

For more information, see Set-SPLogLevel.

See Also

Concepts

Monitoring overview (SharePoint Server 2010)

Other Resources

Resource Center: Installation and Deployment for SharePoint Server 2010