SharePoint diagnostic logging is very important, and extremely helpful when we encounter problems with our SharePoint environment. However, diagnostic logging can be ineffective at times, and can even cause SharePoint performance to slow down if it's not managed properly. In this post, I will demonstrate how to configure SharePoint 2010 diagnostic logging, following Microsoft's best practices, in just a few PowerShell commands. After all, it always pays to be prepared for a rainy day.
How can I quickly configure diagnostic logging to make the best use of it?
First, verify that you possess the following permissions:
- SharePoint Farm Administrator
- Local Server Administrator on all Web servers.
Next, open the SharePoint 2010 Management Shell. From the Start menu, select All Programs > Microsoft SharePoint 2010 Products > SharePoint 2010 Management Shell.
Here are the five best practices to configure SharePoint 2010 diagnostic logging:
1. Change the drive that logging writes to. By default, diagnostic logging is written to "%CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\Logs" which is in the same disk drive and partition that SharePoint 2010 was installed on. This could cause a performance problem if the logs continue to grow, and more logs are being written to the same drive. Therefore, we should configure logging to write to a different drive by using the following PowerShell command. Note: The location that you specify must be a valid location on all servers in the server farm:
Set-SPDiagnosticConfig -LogLocation <PathToNewLocation>
2. Restrict log disk space usage. By default, the amount of disk space that is available for diagnostic logging is unlimited. We should limit the log disk space usage to prevent the disk from filling up. Enter the follwoing two commands in the SharePoint 2010 Management Shell (the usage value is between 1 and 1,000 gigabytes):
Set-SPDiagnosticConfig -LogDiskSpaceUsageGB <UsageInGB>
3. Use the Verbose setting sparingly. Sometimes, you might want to configure diagnostic logging to the Verbose level when you are making critical changes. At this level, the system will log every action that SharePoint takes. This can be easily done using the PowerShell command below. Keep in mind, however, that you should change back to higher-level logging afterwards because Verbose logs can consume a lot of space and affect performance.
Set-SPLogLevel -TraceSeverity Verbose
4. Regularly backup logs. The diagnostic logs are very important and could come in especially handy when you least expect it. We should backup logs regularly, especially if we are restricting log disk space usage, because old logs will be deleted without notification. For this article, I have written a PowerShell script to backup SharePoint logs so you can schedule it to run automatically. This script does the following:
- Check whether any log file exists in the backup location.
- If there's no log file, merge the last hour of SharePoint log data from all servers and save to the local backup location.
- If a backup log already exists, merge SharePoint logs from the time the last backup was run until the current date/time.
# PowerShell script to backup SharePoint 2010 diagnostic logs
Start-SPAssignment -Global # This cmdlet takes care of the disposable objects to prevent memory leak.
$backupLocation = "C:\Backup\ULSLog" # Replace with your backup location
$today = Get-Date # Get current date
$todayEdited = Get-Date -format "MM-dd-yyyy HH.mm.ss" # Get current date and format it to avoid invalid characters such as "/", ":"
# Get the latest backup log file by sorting the file list at the backup location, then select the last item
$lastLogFile= Get-ChildItem $backupLocation\*.* | Sort-Object name | Select-Object -last 1
# If no log file exists at the backup location, merge the last hour of SharePoint log data from all servers.
# In this example, I only get the logs that have level High or above to prevent overload.
# Available levels are: Unexpected, Monitorable, High, Medium, Verbose, VerboseEx
if ($lastLogFile -eq $null)
write-Host Merging logs from all servers in the last hour
Merge-SPLogFile –Path "$backupLocation\$todayEdited.log" –Overwrite -Level High
else # If a log file already exists, merge SharePoint logs from last backup run until now
# Format the log file name and convert it to DateTime object
$lastRunTime = Get-Date $lastLogFile.Name.TrimEnd(".log").Replace(".",":")
write-Host Merging logs from $lastRunTime until now
Merge-SPLogFile –Path "$backupLocation\$todayEdited.log" –StartTime $lastRunTime –EndTime $today –Overwrite -Level High
write-Host "Finished script."
For your convenience, I have attached both the script and the batch file to run it at the end of this post.
5. Enable event log flooding protection. When this option is enabled, the system will detect repeating events in the Windows Event log and suppress them until conditions return to a typical state.
- The commands and script in this article work with both SharePoint 2010 Foundation and Server.
- When the Backup runs, it could consume a lot of time and affect server performance. Therefore, it's strongly recommended that you run this script during off-peak hours.
Jan 12 2011, 01:00 PM