Configure Diagnostic Logging in SharePoint 2010 – Best Practices, FAQs

What is Diagnostic Logging in SharePoint, By the way?
Simple! Diagnostic logging is where SharePoint logs its own actions. There are two log file locations where SharePoint Diagnostic logging keeps its logs:

1. Windows Event Log – You can view it with “Event Viewer” – The one comes with Windows!
2. ULS or “Trace Log” – Text-based log format that is specific to SharePoint Server and is stored on the file system. The default location is  C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS

ULS logs are following the naming convention of “ServerName-YYYYMMDD-HHMM” and each subsequent file is created in 30 minutes intervals by default. Look at the below screenshot.

Where to Configure Diagnostic Logging?
Go to Share 2010 Central Administration >> Monitoring >> Click “Configure diagnostic logging” (Under Reporting)

From here, you can select the Category,  Least critical event to report to the event log,  Least critical event to report to the trace log.

SharePoint 2010 configure diagnostic logging settings – best practices

No doubts! Enabling SharePoint diagnostic logging is very important and helpful. However, it could cause performance issues and slows down SharePoint if not managed properly!! Follow best practices on SharePoint 2010 PowerShell diagnostic logging:

1. Change the Log file Path – For performance reasons, Don’t keep the log files on the same drive where SharePoint installed. By default SharePoint diagnostic logging path is set to %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\LOGS\  (which is: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS). Change it to some other drive! This can be done with  PowerShell cmdlet:
Set-SPDiagnosticConfig -LogLocation <PathToNewLocation>

2. Ensure you Restrict Trace Log disk space usage  – You don’t want SharePoint to fill your c:\ with logs, isn’t it? so be watchful. These two cmdlets can be used to configure disk space usage.

Set-SPDiagnosticConfig -LogMaxDiskSpaceUsageEnabled
Set-SPDiagnosticConfig -LogDiskSpaceUsageGB <UsageInGB>

3. Do not Use the Verbose – Or use it only when required, then revert it back. Why? because SharePoint will log every action and consume  lot of disk space. so setting SharePoint diagnostic logging level to verbose will fill the disk space so quick!
Set-SPLogLevel -TraceSeverity Verbose . You can revert it to default: Clear-SPLogLevel

4. Take backups and delete them. Restrict the logs by setting either size or number of days. 
I would go for restricting the log space. If you specify the number of days for which logs are to be maintained by SharePoint, the oldest files are deleted by SharePoint to maintain those many days log files. By default, diagnostic logging will keep on growing on the disk. So ideally you should restrict the disk space to be used for logging.

5. Event log flooding protection? Yes, Of course! This will avoid repeating events in the Windows Event log.
Set-SPDiagnosticConfig -EventLogFloodProtectionEnabled

All of the above PowerShell cmdlets can be combined into one as:

Set-SPDiagnosticConfig -EventLogFloodProtectionEnabled -DaysToKeepLogs 5 -LogLocation "E:\Logs\SharePointULS\" -LogMaxDiskSpaceUsageEnabled -LogDiskSpaceUsageGB 1

Frequently Asked Questions on SharePoint 2010 Diagnostic Logging  

Event Throttling
SharePoint diagnostic logging event throttling controls the types of event logs, based on the level of severity.

SharePoint diagnostic logging default
The default settings for all categories are as follows:

•     Event Log: Information
•     Trace Log: Medium Level

You can select the category and choose “Reset” to reset diagnostic logging. Technet Reference: http://technet.microsoft.com/en-us/library/ee748619.aspx 

Correlation Id
When SharePoint encounters with an error, Correlation Id {GUID} is presented to the end user! ULS Viewer tools will parse the ULS logs for you, and allow the viewing of live ULS logs too!

SharePoint Logging Database (Named WSS_Logging – By Default)
Starting from SharePoint 2010, SharePoint Logging database is introduced to keep all logging information for all servers in the farm. By default this feature is disabled! Once these jobs are enabled, SharePoint will insert diagnostic logging data into a new SQL Server database. Follow these steps to get ULS tracelogs to WSS_Logging Database.

1. Open the SharePoint Central Administration
2. Navigate to the Monitoring section
3. Select Review Job Definitions
4. Click on the job Diagnostic Data Provider: Trace Log
5. Click on the Enable button to enable it
6. Click on Run Now, to start it immediately

So you can write queries like:

SELECT * FROM [ULSTraceLog] WHERE
       [CorrelationId] ='8C6031F8-A04F-4ADD-A1A7-1317AC5FD073'

Tools to analyze ULS Logs:

1. You can use your favorite Notepad tool to open trace files for analysis (which would be painful!) or use the tool: ULS Viewer
2. To analyze ULS Log you can use ULS log viewer tool: https://www.microsoft.com/en-us/download/details.aspx?id=44020

SharePoint 2010 diagnostic logging category
You can write custom messages for diagnostic logging using the SPDiagnosticsService class. You can even control the diagnostic logging behavior programmatically using this class. (Not available in Sandboxed solutions)

SharePoint Diagnostic logging not working?
SharePoint logging features depending on the windows Service ‘SharePoint 2010 Tracing’.  If diagnostic logging SharePoint not working, check this service status. Also Make sure your AppPool account is in the group performance log users.

Disable/Turn-off diagnostic logging SharePoint 2010
Select All categories and set them to “None”!