SharePoint diagnostic logging is very important and extremely helpful when encountering problems with our SharePoint environment. However, diagnostic logging can sometimes be ineffective and cause SharePoint performance to slow down if it’s not managed correctly. This post will demonstrate how to configure SharePoint 2010 diagnostic logging, following Microsoft’s best practices, in just a few PowerShell commands. After all, it always pays to be prepared for a rainy day.

Challenge:

How can I quickly configure diagnostic logging to use it best?

Solution:

First, verify that you possess the following permissions:

• SharePoint Farm Administrator
• Local Server Administrator on all Web servers.

Next, open the SharePoint 2010 Management Shell. Select All Programs > Microsoft SharePoint 2010 Products > SharePoint 2010 Management Shell from the Start menu.

Here are the five best practices to configure SharePoint 2010 diagnostic logging:

1. Change the drive that logging writes to. By default, diagnostic logging is written to “%CommonProgramFiles%Microsoft SharedWeb Server Extensions14Logs,” in the same disk drive and partition that SharePoint 2010 was installed on. This could cause a performance problem if the logs continue to grow and more logs are being written to the same drive. Therefore, we should configure logging to write to a different drive using the PowerShell command. Note: The location that you specify must be a valid location on all servers in the server farm:

Set-SPDiagnosticConfig -LogLocation <PathToNewLocation>

2. Restrict log disk space usage. By default, the amount of disk space available for diagnostic logging is unlimited. We should limit the log disk space usage to prevent the disk from filling up. Enter the following two commands in the SharePoint 2010 Management Shell (the usage value is between 1 and 1,000 gigates):

Set-SPDiagnosticConfig -LogMaxDiskSpaceUsageEnabled

Set-SPDiagnosticConfig -LogDiskSpaceUsageGB <UsageInGB>

3. Use the Verbose setting sparingly. Sometimes, you might want to configure diagnostic logging to the Verbose level when making critical changes. At this level, the system will log every action that SharePoint takes. This can be easily done using the PowerShell command below. Remember, however, that you should change back to higher-level logging afterward because Verbose logs can consume a lot of space and affect performance.

Set-SPLogLevel -TraceSeverity Verbose

4. Regularly backup logs. The diagnostic logs are very important and could be especially handy when you least expect it. We should back up logs regularly, especially if we restrict log disk space usage because old logs will be deleted without notification. I have written a PowerShell script for this article to back up SharePoint logs so you can schedule it to run automatically. This script does the following:

• Check whether any log file exists in the backup location.
• If there’s no log file, merge the last hour of SharePoint log data from all servers and save it to the local backup location.
• If a backup log already exists, merge SharePoint logs from when the last backup was run until the current date/time.

# PowerShell script to backup SharePoint 2010 diagnostic logs

Add-PsSnapin Microsoft.SharePoint.PowerShell

Start-SPAssignment -Global    # This cmdlet takes care of the disposable objects to prevent memory leak.

$backupLocation = "C:BackupULSLog"    # Replace with your backup location

$today = Get-Date            # Get current date

$todayEdited = Get-Date -format "MM-dd-yyyy HH.mm.ss"    # Get current date and format it to avoid invalid characters such as "/", ":"

# Get the latest backup log file  sorting the file list at the backup location, then select the last item

$lastLogFile= Get-ChildItem $backupLocation*.* | Sort-Object name | Select-Object -last 1

# If no log file exists at the backup location, merge the last hour of SharePoint log data from all servers.

# In this example, I only get the logs that have level High or above to prevent overload.

# Available levels are: Unexpected, Monitorable, High, Medium, Verbose, VerboseEx

if ($lastLogFile -eq $null)

{

    write-Host Merging logs from all servers in the last hour

    Merge-SPLogFile –Path "$backupLocation$todayEdited.log" –Overwrite -Level High

}

else    # If a log file already exists, merge SharePoint logs from last backup run until now

{

    # Format the log file name and convert it to DateTime object

    $lastRunTime = Get-Date $lastLogFile.Name.TrimEnd(".log").Replace(".",":")

    write-Host Merging logs from $lastRunTime until now

    Merge-SPLogFile –Path "$backupLocation$todayEdited.log" –StartTime $lastRunTime –EndTime $today –Overwrite -Level High

}

Stop-SPAssignment -Global

Remove-PsSnapin Microsoft.SharePoint.PowerShell

write-Host "Finished script."

For your convenience, I have attached the script and the batch file to run it at the end of this post.

5. Enable event log flooding protection. When this option is enabled, the system will detect repeating events in the Windows Event log and suppress them until conditions return to a typical state.

Set-SPDiagnosticConfig -EventLogFloodProtectionEnabled

Notes:

• The commands and script in this article work with both SharePoint 2010 Foundation and Server.
• When the Backup runs, it could consume a lot of time and affect server performance. Therefore, it’s strongly recommended that you run this script during off-peak hours.

See Also:

• Configure diagnostic logging (TechNet)
• Logging and events cmdlets (TechNet)