SharePoint generates multiple log types. Logs in SharePoint require three basic steps like all other logs: Logging, Processing and Reporting. The logging can take place to file locations on front-end servers or to the associated content databases for each Site Collections (including SSP). Processing happens via Timer Jobs on the front end servers and the SSP server (if different) using the Timer Service at various configurable intervals. Reports are available via the web browser at Site, Site Collection, Web Application or Farm Level. MOM packs are available both for WSS 3.0 and MOSS 2007 and help administrators in maintaining the entire farm from a centrel location.
All file based logs can be read by text editors and can be parsed by using popular log parsing tools (Log Parser 2.2 from Microsoft or Funnel Web). It will also be a good idea to read the IIS Logs which are generally saved at (System Drive):\WINDOWS\system32\LogFiles
a) Diagnostics Logs
· Event Throttling Logs – These end up going to the Windows Event Log and can be viewed in the Event Viewer. They show Errors and Warnings.
· Trace Logs – These show detailed line by line tracing infomration emitted during a web request or service execution. They end up being stored at a known location on the front-end server. Default Location: (System Drive):\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\LOGS\
b) Audit Logs – They end up in the associated Content Database tables and can be viewed at Site Collection Level as well as Site Level using the web browser. WSS 3.0 and MOSS 2007 use different pages to show Audit Log Reports.
c) Usage Logs – They get stored locally on the front-end servers and get processed both locally and at farm level via SSP (this is based on the setup as I understand the results from the local processing are merged by SSP) and can be viewed at both the Site Level and Site Collection Level. Default Location: (System Drive):\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
d) Search\Query Logs – These are saved in the associated SSP database but can be viewed at SSP level via the Web Browser and in MOSS at Site Collection Level by going to the settings page.
e) Information Management Logs – Stored in the associated Content Database and can be can be viewed at the Site Collection Level.
f) Content and Structure Logs – This option is only available after one enables the publication feature. This store is saved in the Content Database associated with the Site Collection and can be viewed at Site Collection level by going to the settings page.
Hi Mate,
I am unable to see ‘audit log reports on my piblishing portal site collection. Should i turn on the reporting feature. Ok hang on .. Well, i even can’t see the site collection features link on my site settings page. Can you tell me where i can find this on my MOSS 2007 (trial) installation. Or is this feature not available on trail version?
Jag
You need to be a site collection admin to see the logs. Take a look at LOGbinder SP from http://www.logbinder.com/products/logbindersp. LOGbinder SP centrally manages audit policy for all sites, translates cryptic audit data into understandable events and send it to the Windows security log or your SIEM.
Hi this site is very useful but large font help in much better way,please change ur background also so we can read easily
I am experiencing an out of memory error when I click on the Content and Structure Logs link. My WFE CPU spikes to 100%. Ever seen this before?
aaaaaa
Is it possible to move the log files to another location on the SP server? They are on our C: drive and we want to move them to another drive with more disk space
Mike,
U definitely can…u shudnt have any issues.
Meaning of the ids that appear in the audit log reports for SharePoint.
http://dzeee.net/sharepoint/post/2010/03/29/Enums-for-Audit-Logs.aspx
Hello. I have audit loggin turned on in a moss 2007 farm. We have something like 250 site collections across 10 or so web aps. for any one site collection I can use stock uage pages to see some level activity. Any way to get reports across all site collections or across the entire farm. We’d like to know what site collections are no longer active. I;ve tried to gather this info using iis logs, but since all site collection share a iis log, I have no apparent way to distinguish sites other than path of the url. Thanks.
Take a look at LOGbinder SP from http://www.logbinder.com/products/logbindersp. LOGbinder SP centrally manages audit policy for all sites, translates cryptic audit data into understandable events and send it to the Windows security log or your SIEM.
Hi, Nice post.
I am facing a very strange issue, In the Logs directory, log folders are creating on a regular basis but sometimes within a period of 6-7 days it misses. i.e Log folders doesn’t get created within a period of 6-7 days, Can some one please throw the light that why is that happening?
Thanks in Advance,
Ravi
hi nice post
For queries, please go to the forum: