logserverconfig.xml reference

 

Applies to: FAST Search Server 2010

Use logserverconfig.xml to configure routing and filtering of log messages sent from Microsoft FAST Search Server 2010 for SharePoint components. The logging process consists of three steps. The first step is configured in loggerconfig.xml. logserverconfig.xml contains the configuration for the last two steps, the local and main log servers.

All FAST Search Server 2010 for SharePoint nodes have a local log server. This server performs logging locally and also forwards the log messages to the main (farm) log server which runs only on the administrative node.

Both log server subsystems run within the FAST Search Server 2010 for SharePoint Monitoring service. logserverconfig.xml is loaded when the Monitoring service is started up. The file must be located in the <FASTSearchFolder>\etc\ folder, where <FASTSearchFolder> is the path of the folder where you have installed FAST Search Server 2010 for SharePoint, for example C:\FASTSearch.

The list of destinations is used to set up the logging targets where incoming messages are sent.The programs list configures log level filtering for individual log sources. A default program entry (name = default) is defined for each log server. If an incoming log message does not match any of the defined programs, the default program entry is used instead.

You can edit the installed version of logserverconfig.xml to tune the existing values and to add program elements to override filtering and routing for specific log sources. However, in most cases, the default values will be acceptable.

Customizing logserverconfig.xml

Note

To modify a configuration file, verify that you meet the following minimum requirements: You are a member of the FASTSearchAdministrators local group on the computer where FAST Search Server 2010 for SharePoint is installed.

Use a text or XML editor to change this file. Edits will not take effect until the FAST Search Server 2010 for SharePoint Monitoring service (FASTSearchMonitoring) is restarted.

Element quick reference

logserverconfig.xml uses the following elements:

Element	Description
<logserverconfig>	Top level element
<locallogserverconfig>	Configuration for the local log server
<mainlogserverconfig>	Configuration for the main log server
<flood_protect>	Filter that blocks excessive logging
<destinations>	A list of log targets: <sharepointulslog> - SharePoint Unified Logging Service (ULS) log destination for the local log server <mainlogserver> - Main log server forwarding destination for the local log server <localeventlog> - NT event log destination for the local log server <farmeventlog> - NT event log destination for the main (farm) log server <filedestination> - Log file destination for the main (farm) log server
<programs>	A list of log sources: <program> - Routing and filtering specifications for a log source <output> - Specifications for routing log messages to a particular destination, with a log level threshold filter

logserverconfig.xml file format

logserverconfig.xml is an XML file and follows all conventions and syntax rules that are defined for the XML file format.

The basic file structure is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<logserverconfig version="1.0">

  <locallogserverconfig>

    <destinations>
      ... specification of where logs can be sent
    </destinations>

    <programs>
      <program name="default">
        ... routing to destination with log level filtering
      </program>
      ... add more program elements here to override defaults
    </programs>

  </locallogserverconfig>

  <mainlogserverconfig>
    .. same basic structure as for locallogserverconfig
  </mainlogserverconfig>

</logserverconfig>

logserverconfig element

This is the top level element of logserverconfig.xml.

Attributes

Attribute	Value	Description
version	1.0	The version attribute provides future expansion of the file format. Currently only 1.0 is valid.

locallogserverconfig element

This element contains the configuration for the local log server.

mainlogserverconfig element

This element contains the configuration for the main (farm) log server.

flood_protect element

Filter that blocks log messages if flooding is detected.

Three time periods are available:

Period	Description
Measure	Blocking will be enabled if the number of log messages exceeds max_count during a single measurement period.
Block	If blocking is enabled, log messages will be filtered until the end of the current blocking period.
Trickle	Even if blocking is enabled, a single log message may still pass during each trickle period.

Log messages are filtered based on both log source and log level. For example, an active blocking of INFO messages will not affect ERROR messages from the same log source.

Attributes

Attribute	Value	Description
max_count	value	The number of log messages allowed for a single measurement period
measure_minutes	value	Length of measurement periods in minutes
block_minutes	value	Length of blocking periods in minutes
trickle_minutes	value	Length of trickle periods in minutes

Measure_minutes, block_minutes and trickle_minutes can be configured independently. However, the most logical results are achieved if the numbers are set to an integer multiple of the smallest value.

Block_minutes is usually set to a larger or equal value as measure_minutes. To disable the trickle feature, set trickle_minutes to the same value as block_minutes.

Example

In the following example, a maximum of 1000 messages is allowed for each 5 minute measurement period. If this threshold is exceeded, log messages will be blocked for the rest of the current 180 minute blocking period. However, 1 log message will be allowed to pass every 30 minutes (trickle period).

<flood_protect max_count       = "1000"
               measure_minutes = "5"
               block_minutes   = "180"
               trickle_minutes = "30" />

destinations element

This element is a container for one or more destination elements.

sharepointulslog element

This element defines a SharePoint Unified Logging Service (ULS) log destination for use with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

Attribute	Value	Description
name	string	Symbol used to reference this log destination from a program element

This destination uses the trace logs feature of the SharePoint Unified Logging Service (ULS).

mainlogserver element

This element defines a log destination which forwards logs from the local log server to the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

Attribute	Value	Description
name	string	Symbol used to reference this log destination from a program element

The forwarding of log messages uses a WCF protocol. Edit the bin\MonitoringService.exe.config .NET file to configure WCF service parameters, bindings, and behavior.

localeventlog element

This element defines an NT event log destination used with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

Attribute	Value	Description
name	string	Symbol used to reference this log destination from a program element

farmeventlog element

This element defines an NT event log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

Attribute	Value	Description
name	string	Symbol used to reference this log destination from a program element

filedestination element

This element defines a text file log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

Attribute	Value	Description
name	string	Symbol used to reference this log destination from a program element

This destination logs messages to files in the <FASTSearchFolder>\var\log\syslog\ directory.

programs element

This element is a container for one or more program elements, and contains a list of log sources.

program element

Defines routing and filtering for a log source. The element contains one or more output elements to define routing of log messages to a particular destination, with a specified log level threshold filter.

Attributes

Attribute	Value	Description
name	string	Log module name, matching the identifier that is used by the logging source. Inspect <FASTSearchFolder>\var\log\syslog\all.log on the main log server to retrieve the identifiers. Example: indexer

For the local log server, routing to the mainlogserver destination is implicit. This message forwarding cannot be disabled.

Example

In the following example, routing and filtering for log messages from the module indexer is defined. Only messages that use the log level of CRITICAL are routed to the destinations eventlog and ulslog. Log messages that use lesser log levels are discarded.

<program name="indexer">
  <output destination="eventlog" threshold="critical" />
  <output destination="ulslog"   threshold="critical" />
</program>

output element

Defines routing of log messages to a particular destination, with a specified log level threshold filter.

Attribute	Value	Description
destination	string	Symbol referencing a configured destination element
threshold	CRITICAL|ERROR|WARNING|INFO|VERBOSE|DEBUG	CRITICAL - route only CRITICAL messages. ERROR - route messages that have log level ERROR and above. WARNING - route messages that use log level WARNING and above. INFO - route messages that use log level INFO and above. VERBOSE - route messages that use log level VERBOSE and above. DEBUG - route all log messages.

Example

In the following example, all messages are routed to the destination with the name file.

<output destination="file" threshold="debug" />

See Also

Concepts

loggerconfig.xml reference