SharePoint 2016 Central Admin - Monitoring - Configure Diagnostic Logging

When you click on the "Configure Diagnostic Logging" link, you will land on the diagnostic logging page. This page will let you configure the diagnostic loggings (AKA ULS logs) for SharePoint farm.

Configure diagnostic logging page’s direct link - /_admin/metrics.aspx

Logging is the key component of any application. A strong logging system helps both developers and administrators to troubleshoot the issues and fix them. Like other products from Microsoft, SharePoint also has strong logging system called Unified Logging Service. In SharePoint, every event written into the Logs has an associated ID called Correlation ID. Many times, this correlation id is displayed in the error which makes administrator's life easy to trace the error details in the ULS log.

Microsoft improves the logging systems with every new release of SharePoint. In SharePoint, ULS is centralized logging location for system administrators and developers to look for detail about the issue. Regularly monitoring of the ULS logs provides the overall health of SharePoint, potential errors, and performance issues. ULS logs exist on every server in the SharePoint farm and record all the activity related to SharePoint.

After the SharePoint installation, Diagnostic logging is configured with default settings which include the logging level, logs location, and a number of days of storage. It is highly recommended to change the default settings of the ULS logs after the initial configuration. There are a couple of settings which you have to configure.

Event Throttling

Events reports are registered at two places - in standard Windows Event Logs and in trace logs which are also called ULS. The administrator can control the severity level of an event report into the Event Log and trace log, for a specific category or for all categories. We should be careful when deciding the logging level to report. If I verbose is logging set, then it will consume the disk space quickly.

Default setting gives you enough information to troubleshoot the issue but If you are in a situation where you need to enable the extra logging level, then you can configure; and once you identify the issue or fix it, then reset it to default.

The default settings for all categories are as follows,

Event Log - Information
Trace Log - Medium Level

The following levels are available to select from.

Event Logs - None, Critical, Error, Warning, Information, Verbose
Trace Log - None, Unexpected, Monitorable, High, Medium, Verbose, VerboseEx

Logs Driver Location

It is very important to change the default location of ULS logs. The default location of the ULS logs is "C:\program file\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS", which is system drive. In case verbose logging level is enabled, then it can quickly use all the storage on the drive which puts the OS on risk and impact the performance of SharePoint. It is highly recommended to move the logs file to other than system drives. It is also recommended to use the high-speed connection to log drives, otherwise you may see some performance issue.

Event Log Flood Protection

If this option is enabled, then it will prevent writing many repetitive events in the logs. If an event occurs 5 times in 2 minutes, then it will surpass the same event for next 2 minutes. It logs the summary of the event along with a number of times it repeats. It is highly recommended to enable this option.

Retention Period

This option will give you control over the number of days to store log files. By default, it is set to 14 days but you can change it as per your requirement. When logs file reaches its number of days restriction, then it will remove old log files from the drive.

Restrict Disk Space

Disk space usage is set to unlimited. Log files quickly consume the space on the disk, so sometimes it is better to restrict the overall size of the log file. When disk reaches its restriction, then it will remove the old logs file. By default, this option is disabled to provide an extra layer of protection.

Configure Diagnostic Logging

In this section, we will configure the diagnostic logging for Access Service category (Critical for Event Log and Unexpected for trace log), also change the trace path logs to D:\logs and restriction for trace log disk usage.

Log into Central Admin with account member of farm administrator group.
In the Event Throttling, check the Access Service category.

From Event, select
1. Critical for Event Log
2. Unexpected for trace log
Make sure that the Event Log Flood Protection check box is checked.

In Trace log section -
1. Path: enter D:\logs
2. Number of Days to Store Log Files: Enter 10
3. Enable the Trace log disk space usage
4. enter the 1000 GB for maximum storage space for trace logs
Click OK.

Wait for configuration. This shouldn’t take long.

This will configure the diagnostic logging settings.

If you enable the higher logging level after troubleshooting, you have to set it back to default.

You have to select the "Reset to Default" option for both, Event and Trace log.

Leave all other settings as is and click OK.

Note: To view the ULS logs in easily readable format, use the free ULS viewer tool which is available for free from Microsoft. Download it from here - https://www.microsoft.com/en-us/download/details.aspx?id=44020