Configure diagnostic logging in SharePoint 2010
Logging is one of the most important functions in SharePoint for diagnosing problems. Users can
configure log settings in SharePoint 2010 Central Administration site.
To open the Diagnostic Logging page, go to CA->Monitoring->Configure diagnostic logging.
I. Event Throttling
Users can control the severity of events captured in the Windows event log and the trace logs
with these settings.
1. Expand any relevant submenus and then select one or more categories of events for which to
configure throttling. Throttling controls what events are captured in the Windows events log
according to the criticality of the events.
2. After you select the types of events to throttle, perform one of the following actions:
a. Expand the Least critical event to report to the event log menu and then select the type of
event that you consider to be least critical for the event log.
Note: Events that are equally critical to or more critical than the selected event will be recorded
in the Windows event log. The list entries are sorted in most-critical-to-least-critical order.
b. Expand the Least critical event to report to the trace log menu and then select the event type
that you consider to be the least critical for the trace log.
Note: Events that are equally critical to or more critical than the selected event will be recorded
in the trace log. The list entries are sorted in most-critical-to-least-critical order.
II. Event Log Flood Protection
Select the “Enable Event Log Flood Protection” check box, if you want to detect and suppress
repeating events.
III. Trace Logs
When tracing is enabled you may want the trace log to go to a certain location.
1. You can type the path to the folder in which trace logs will be saved.
Note: The location you specify must exist on all servers in the farm.
2. In the Number of days to store log files box, you can set the maximum number of days?that a
trace log file is saved.
3. Select the Restrict Trace Log disk space usage check box to monitor and limit the amount of
storage space used by trace logs.
Note: In the Maximum storage space for Trace Logs (GB) box, you can type the maximum
number of gigabytes (GB) allowed for storage of trace logs.
PowerShell
SharePoint diagnostic logging is very important, and extremely helpful when we encounter problems
with our SharePoint environment. However, diagnostic logging can be ineffective at times, and can
even cause SharePoint performance to slow down if it's not managed properly. In this post, I will
demonstrate how to configure SharePoint 2010 diagnostic logging, following Microsoft's best
practices, in just a few PowerShell commands. After all, it always pays to be prepared for a rainy
day.
Challenge:
How can I quickly configure diagnostic logging to make the best use of it?
Solution:
First, verify that you possess the following permissions:


SharePoint Farm Administrator
Local Server Administrator on all Web servers.
Next, open the SharePoint 2010 Management Shell. From the Start menu, select All
Programs > Microsoft SharePoint 2010 Products > SharePoint 2010 Management Shell.
Here are the five best practices to configure SharePoint 2010 diagnostic logging:
1. Change the drive that logging writes to. By default, diagnostic logging is written to
"%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\Logs" which is in the same
disk drive and partition that SharePoint 2010 was installed on. This could cause a performance
problem if the logs continue to grow, and more logs are being written to the same drive. Therefore,
we should configure logging to write to a different drive by using the following PowerShell
command. Note: The location that you specify must be a valid location on all servers in the server
farm:
Set-SPDiagnosticConfig -LogLocation <PathToNewLocation>
2. Restrict log disk space usage. By default, the amount of disk space that is available for
diagnostic logging is unlimited. We should limit the log disk space usage to prevent the disk from
filling up. Enter the follwoing two commands in the SharePoint 2010 Management Shell (the usage
value is between 1 and 1,000 gigabytes):
Set-SPDiagnosticConfig -LogMaxDiskSpaceUsageEnabled
Set-SPDiagnosticConfig -LogDiskSpaceUsageGB <UsageInGB>
3. Use the Verbose setting sparingly. Sometimes, you might want to configure diagnostic logging
to the Verbose level when you are making critical changes. At this level, the system will log every
action that SharePoint takes. This can be easily done using the PowerShell command below. Keep
in mind, however, that you should change back to higher-level logging afterwards because Verbose
logs can consume a lot of space and affect performance.
Set-SPLogLevel -TraceSeverity Verbose
4. Regularly backup logs. The diagnostic logs are very important and could come in especially
handy when you least expect it. We should backup logs regularly, especially if we are restricting log
disk space usage, because old logs will be deleted without notification. For this article, I have written
a PowerShell script to backup SharePoint logs so you can schedule it to run automatically. This
script does the following:



Check whether any log file exists in the backup location.
If there's no log file, merge the last hour of SharePoint log data from all servers and save to
the local backup location.
If a backup log already exists, merge SharePoint logs from the time the last backup was run
until the current date/time.
# PowerShell script to backup SharePoint 2010 diagnostic logs
Add-PsSnapin Microsoft.SharePoint.PowerShell
Start-SPAssignment -Global
memory leak.
# This cmdlet takes care of the disposable objects to prevent
$backupLocation = "C:\Backup\ULSLog"
# Replace with your backup location
$today = Get-Date
# Get current date
$todayEdited = Get-Date -format "MM-dd-yyyy HH.mm.ss"
# Get current date and format it to
avoid invalid characters such as "/", ":"
# Get the latest backup log file by sorting the file list at the backup location, then select the
last item
$lastLogFile= Get-ChildItem $backupLocation\*.* | Sort-Object name | Select-Object -last 1
# If no log file exists at the backup location, merge the last hour of SharePoint log data from
all servers.
# In this example, I only get the logs that have level High or above to prevent overload.
# Available levels are: Unexpected, Monitorable, High, Medium, Verbose, VerboseEx
if ($lastLogFile -eq $null)
{
write-Host Merging logs from all servers in the last hour
Merge-SPLogFile –Path "$backupLocation\$todayEdited.log" –Overwrite -Level High
}
else
# If a log file already exists, merge SharePoint logs from last backup run until now
{
# Format the log file name and convert it to DateTime object
$lastRunTime = Get-Date $lastLogFile.Name.TrimEnd(".log").Replace(".",":")
write-Host Merging logs from $lastRunTime until now
Merge-SPLogFile –Path "$backupLocation\$todayEdited.log" –StartTime $lastRunTime –EndTime
$today –Overwrite -Level High
}
Stop-SPAssignment -Global
Remove-PsSnapin Microsoft.SharePoint.PowerShell
write-Host "Finished script."
For your convenience, I have attached both the script and the batch file to run it at the end of this
post.
5. Enable event log flooding protection. When this option is enabled, the system will detect
repeating events in the Windows Event log and suppress them until conditions return to a typical
state.
Set-SPDiagnosticConfig -EventLogFloodProtectionEnabled