SharePoint 2013: Move the Trace, Usage and IIS Logs to a Log Farm
By default, SharePoint 2013 writes logs to the same drive and partition on which it was installed. Because diagnostic logging can use a large amount of drive space and compromise drive performance, you should configure SharePoint 2013 to write to another drive on which SharePoint 2013 is not installed. You should also consider the connection speed to the drive on which SharePoint 2013 writes the logs. If verbose-level logging is configured, the server records a large amount of data. Therefore, a slow connection might result in poor log performance.http://technet.microsoft.com/en-us/library/ee748656(v=office.15).aspx
Why should you move the SharePoint Logs or IIS Logs from their default directory?
- You’ll definitely win space on the root drive (80GB is sometimes not enough).
- You can’t read any local log file if your Web Front End or Application Server is down due to Network related issues, due to Windows Server related issues, …
- …
Why this blog post? We recently saw something that we never saw in my life. A customer created a dedicated Log Farm. The customer was legally forced to keep their log files at least for seven years. So they decided to create a single point of server for all SharePoint and IIS Related logs.
How did they proceed? For each SharePoint Environment, a Shared SharePoint folder was created on a Dedicated Server where logs were available.
SharePoint Logs
SharePoint has two different logs. The Trace and Usage Logs. To move the Trace Logs Under Central Administration navigate to Monitoring and select Configure diagnostic logging (/_admin/metrics.aspx).
In the Trace Log section, in the Path box, type the path of the folder to which you want logs to be written.
You can also do this for the Usage Data Collection Settings and forward these logs to another server or to another drive.
If you are not very underpad with the Central Administration, you still can use PowerShell to manage the logs.
The Set-SPDiagnosticConfig and Set-SPUsageService cmdlets are the two that you need to configure the new paths for SharePoint Logs. The user needs to be Farm Administrator to run following cmdlets.
- Set-SPDiagnosticConfig –LogLocation “…”
- Set-SPUsageService – UsageLogLocation “…”
IIS Logs
The IIS Server logs are a little bit more complicated but after using only once you’ll be able to understand the way of work. The IIS Logs are located under the root => Inetpub => Logs => LogsFiles
Strange isn’t it? You’ll see some guid’s maybe never saw in your Farm. Actually, they are the IDs of your IIS Websites. Open IIS Server and under Sites, you’ll see the ID of each site.
May be in some of the Farms you will not see these Logs files because it might not have enabled. If you check IIS Server longing tab you will get to know that its got enabled/not and the location where its getting stored...
The IIS logs files are also located in the root and it isn’t a bad idea to move them also to the dedicated log farm.
Navigate to the SharePoint Site and open **Logging in the right pane.The by default **logging Directory is %SystemDrive% =>Inetpub => Logs => LogFiles.
If you want to apply the same settings as we did for SharePoint – meaning move the logs – well we have to specify the local or shared Log Directory in the Directory Case.
When we surf to the Central Administration, you’ll see that a new entry will be done in the local or shared Log Farm. Again another way of governance.
