SharePoint Logging and Reporting

 

Logging

To monitor SP servers and services, you can directly access various logs such as event viewer logs, ULS logs or usage data logs that are stored separately. You can also view various reports.

 

To increase monitoring efficiency, configure usage/logging database to monitor from one place.

 

Usage and Health data: Central Administration > Monitoring > Configure usage and health……

Have separate service application (Central Admin > manage service and application) specified with SQL usage database. You can see all the below logs stored in the SQL dbase in logical partitions by going into SQL mgmt. studio > expand databases > select the logging dbase; right click; select Reports > Standard reports > disk usage by top 10 tables

 

Microsoft SharePoint Foundation Usage Data Import – import usage data logs into dbase

Microsoft SharePoint Foundation Usage Data Processing – deletes expired data from the logging dbase that are older than 30 days.                                                                                                          

 

              Health related timer jobs:

Diagnostic Data Provider: App Usage                                                                                 

Diagnostic Data Provider: Event Log                           – stores event viewer logs                             

Diagnostic Data Provider: IO Intensive SQL Queries                                                     

Diagnostic Data Provider: Per-database IO                                                                      

Diagnostic Data Provider: Performance Counters - Database Servers                  

Diagnostic Data Provider: Performance Counters - Web Front Ends                     

Diagnostic Data Provider: Site Size                                                                                      

Diagnostic Data Provider: SQL Blocking Queries                                                             

Diagnostic Data Provider: SQL Blocking Reports                                                             

Diagnostic Data Provider: SQL Deadlocks                                                                          

Diagnostic Data Provider: SQL DMV                                                                                    

Diagnostic Data Provider: SQL Memory DMV                                                                 

Diagnostic Data Provider: Trace Log                           – stores ULS logs into database                    

 

 

Diagnostic logging: Central Admin > Monitoring > Configure diagnostic logging…

Logs related to SharePoint farm

Event Throttling Logs – logs Windows Event Viewer. Verbose/warning…….

Trace Logs/ULS logs – show detailed line by line saved under D:\logs\ULS

 

Audit Logs: Site Collection > Settings > site collection audit settings….

Saved in associated content dbase tables. Can view by going into  

SQL mgmt. studio > expand databases > select the logging dbase; right click; select Reports > Standard reports > disk usage by top 10 tables

 

Search\Query Logs – saved in associated SSP database but can be viewed at SSP level via the Web Browser and in site collection level by going to settings.

 

Information Management Logs – Stored in associated content dbase and can be viewed at site collection level.

 

Content and Structure Logs –only available after publication feature enabled. Saved in the content dbase associated with site collection by going to the settings page.

 

 

 

Reporting

 

Administrative report: Central Admin > Monitoring > View administrative reports

 

Health report: Central Admin > Monitoring > View health reports (only work if usage data collection is enabled and two timer jobs enabled)

 

Web analytics Report: In SharePoint 2013, (unlike SP2010 with separate service application) it’s part of search service; can be accessed by going into Site settings > popularity trends or site collection settings > popularity and search reports.

Same analytics can be accessed for a particular SP page by going into page ribbon > popularity trends or for a particular library by going into library ribbon > most popular items.

 

Audit Log report: need to be enabled at site collection level. In SP2013, they get deleted / trimmed monthly by default via timer job Audit log trimming.

 

 

Related Powershell commands:

To check retention days for Usage database:

Get-SPUsageDefinition                

 

To bring down all usage retention days to 1:

Get-SPUsageDefinition | ForEach-Object {Set-SPUsageDefinition -Identity $_.name -DaysRetained 1}                  

 

To bring down usage retention days individually:

Set-SPUsageDefinition -Identity "Sandboxed Requests" -DaysRetained 3

 

To recreate usage database:

$def=Get-SPUsageDefinition -Identity "page requests"

$def.MaxTotalSizeInBytes=12400000000

$def.update()

Get-spusageapplication | Set-SPUsageApplication -DatabaseServer <DBServer> -DatabaseName <New_DBName>

 

 When you recreate usage database, it will only contain the default set of stored procedures.

In this case the Search Service Application Usage Provider has not created the necessary Stored Procedures in the database. This is done by a timer job called “Search Health Monitoring – Trace Events”. Once this timer job has executed successfully the required stored procedures should be created.

Related error: “Could not find Stored Procedure ‘Search_GetRepositoryTimePerCrawl’”