Forum Discussion

PetrHanz's avatar
PetrHanz
Level 4
3 years ago

Large log for SharePoint ULS

  • plaudone1's avatar
    plaudone1
    3 years ago

    Hi PetrHanz,

    The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

    You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

    SharePointFeatureSetup.exe /install /all 

    Usage:

    SharePointFeatureSetup.exe <action> <targets> [options]

    Action:

    /install :: install the target component(s)
    /uninstall :: un-install the target component(s)
    /spcheck :: is SharePoint functional

    Targets:

    /feature :: feature component
    /webparts :: web parts component
    /versionhistory :: version history customization
    /httpmodule :: httpmodule configuration
    /all :: all components

    Options:

    /log:filename :: writes (appends) to the specified log file
    /q :: suppress output to the console (quiet mode)

    Regards,

    Patrick 

    • PetrHanz's avatar
      PetrHanz
      Level 4
      3 years ago

      Hi Gertjan, many thanks for warning  :)

      Problem is that on SharePoint server I have 4-6GB logs - 10 per daily with still repeating record, see italic.  There are ULS logs. EV logs are in other directory and it is small.

      Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-29ca-10d1-b810-4fceaf806c7f

      with some requests.

      dtrace is disabled, web.config ( IIS setting of logs ) have none influence on this logs ( I hope) . I am look up for decreasing  of the size logging (suppress the occurence of the record)  but I need to leave the setting of  ULS logging for recording of other messages. 

       

      TID Area Category EventID Level Message Correlation
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Claims Authentication 00000 Medium STS setting for SuppressModernAuthForOfficeClients:'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Application Authentication bjkut Medium IsClaimsTrustedAuthenticationOnly: 'False', IsOfficeClientIDCRLRequest: 'False', HasSPTrustedSecurityTokenIssuer: 'True', ForceIdcrlForOfficeClients: 'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database ahjqp High [Forced due to logging gap, cached @ 04/08/2022 02:30:05.38, Original Level: Verbose] SQL connection time: 0.0243047649910813 for Data Source=SPSQL;Initial Catalog=SP2016_Content_SpvCorporate;Integrated Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool Size=100;Connect Timeout=60;Packet Size=8000;Application Name=SharePoint[w3wp][2][SP2016_Content_SpvCorporate] ConnectionId: 92df62ab-322c-4d91-ad93-eeadf867c89f 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database asutt High [Forced due to logging gap, Original Level: Verbose] Query Duration: query {0}, connection {1} for procedure {2} in database {3} on server {4} 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High Leaving Monitored Scope: (VqueryEngine) Execution Time=69.542567560961; CPU Milliseconds=4; SQL Query Count=3; Parent=SPRequest.GetListItemDataWithCallback2 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____Execution Time=69.542567560961 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____CPU Milliseconds=4 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High ____SQL Query Count=3 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation General f6l7 High Leaving Monitored Scope: (SPRequest.GetListItemDataWithCallback2) Execution Time=79.7370894904241; CPU Milliseconds=11; SQL Query Count=4; Parent=EnsureListItemsData 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope: (EnsureListItemsData) Execution Time=79.807908547036; CPU Milliseconds=12; SQL Query Count=4; Parent=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,4 aytib,0 bjkuz,0 a7r51,0 a1n25,0 a9fy7,0 a9fy6,0 bjvyg,0 avwh6,0 az4z8,0 agb9s,0 ajd6k,0 ajd6l,0 0,0 avwh7,0 avwh8,0 avwh0,0 avwh1,0 aj1kn,0 avwh2,0 avwh3,0 avwhu,0 avwhv,0 ayswq,0 anvuv,0 a0t92,0 a08yd,0 a0t94,0 a0t97,0 a0t98,0 ayswq,3 az4z8,15 adhpr,69 adhpr,0 adhpr,0 adhpr,0 adhpr,0 f6l7,0 b4ly,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 200 for HTTP request POST to https://documents.domain.cz/_vti_bin/EVCustom.asmx 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=98.9214411328814; CPU Milliseconds=20; SQL Query Count=6; Parent=None 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwid Medium SPRequestModule.EndRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhy Medium SPRequestModule.BeginRequestHandler Begin
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring nasq Medium Entering Monitored Scope (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")). Parent=None
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory.
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Logging Correlation Data xmnv Medium Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhz Medium SPRequestModule.BeginRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 Web Content Management Publishing aytib Medium ObjectCachePerRequest Global:True, Enabled:False 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 401 for HTTP request POST to https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx 0d8c31a0-39c8-10d1-b810-4da9fdba5646
      04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=0.886635033223496; CPU Milliseconds=0; SQL Query Count=0; Parent=None 0d8c31a0-39c8-10d1-b810-4da9fdba5646

      • plaudone1's avatar
        plaudone1
        Level 6
        3 years ago

        Hi PetrHanz,

        The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

        You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

        SharePointFeatureSetup.exe /install /all 

        Usage:

        SharePointFeatureSetup.exe <action> <targets> [options]

        Action:

        /install :: install the target component(s)
        /uninstall :: un-install the target component(s)
        /spcheck :: is SharePoint functional

        Targets:

        /feature :: feature component
        /webparts :: web parts component
        /versionhistory :: version history customization
        /httpmodule :: httpmodule configuration
        /all :: all components

        Options:

        /log:filename :: writes (appends) to the specified log file
        /q :: suppress output to the console (quiet mode)

        Regards,

        Patrick 

  • PetrHanz's avatar
    PetrHanz
    Level 4
    3 years ago

    Hi Patrick

    So, I will prepare script where ULS logs < 2 days of modification date will compress and deleted. Many thanks for your help. I will close this like accept. 

    So  I 'd like ask you for following idea I have NTFS store ( enable dedupe + compression). The type of stores  are SHP, SMTP journaling, Filesystem. I need move the store to the new dedupe storage  NFS. 

    1. Move store from EV console doesn"t support for these types of store.

    2. Manual moving of data or migration to second store has serious limit: Moved data are in compress and  with SIS deduplication. Therefore this process in not suitable because dedupe ratio (on block dedupe storage ) is very low.   

    Any idea ?  Many thanks Patrick

     

    • plaudone1's avatar
      plaudone1
      Level 6
      3 years ago

      Hi PetrHanz,

      Thank you for the update on this thread. 

      May want to open a new thread for the moving data question.  Typically, we could copy the partition data, if new storage is same type, then update that PartitionRootPath in SQL.  Otherwise, it would be a migration tool such as Migrate to copy the data to the new store.  

      Regards,

      Patrick