Forum Discussion

PetrHanz's avatar
PetrHanz
Level 4
3 years ago

Large log for SharePoint ULS

  • plaudone1's avatar
    plaudone1
    3 years ago

    Hi PetrHanz,

    The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

    You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

    SharePointFeatureSetup.exe /install /all 

    Usage:

    SharePointFeatureSetup.exe <action> <targets> [options]

    Action:

    /install :: install the target component(s)
    /uninstall :: un-install the target component(s)
    /spcheck :: is SharePoint functional

    Targets:

    /feature :: feature component
    /webparts :: web parts component
    /versionhistory :: version history customization
    /httpmodule :: httpmodule configuration
    /all :: all components

    Options:

    /log:filename :: writes (appends) to the specified log file
    /q :: suppress output to the console (quiet mode)

    Regards,

    Patrick 

GertjanA's avatar
GertjanA
Moderator

Your question is empty PetrHanz.

PetrHanz's avatar
PetrHanz
Level 4
3 years ago

Hi Gertjan, many thanks for warning  :)

Problem is that on SharePoint server I have 4-6GB logs - 10 per daily with still repeating record, see italic.  There are ULS logs. EV logs are in other directory and it is small.

Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-29ca-10d1-b810-4fceaf806c7f

with some requests.

dtrace is disabled, web.config ( IIS setting of logs ) have none influence on this logs ( I hope) . I am look up for decreasing  of the size logging (suppress the occurence of the record)  but I need to leave the setting of  ULS logging for recording of other messages. 

 

TID Area Category EventID Level Message Correlation
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Claims Authentication 00000 Medium STS setting for SuppressModernAuthForOfficeClients:'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Application Authentication bjkut Medium IsClaimsTrustedAuthenticationOnly: 'False', IsOfficeClientIDCRLRequest: 'False', HasSPTrustedSecurityTokenIssuer: 'True', ForceIdcrlForOfficeClients: 'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database ahjqp High [Forced due to logging gap, cached @ 04/08/2022 02:30:05.38, Original Level: Verbose] SQL connection time: 0.0243047649910813 for Data Source=SPSQL;Initial Catalog=SP2016_Content_SpvCorporate;Integrated Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool Size=100;Connect Timeout=60;Packet Size=8000;Application Name=SharePoint[w3wp][2][SP2016_Content_SpvCorporate] ConnectionId: 92df62ab-322c-4d91-ad93-eeadf867c89f 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database asutt High [Forced due to logging gap, Original Level: Verbose] Query Duration: query {0}, connection {1} for procedure {2} in database {3} on server {4} 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High Leaving Monitored Scope: (VqueryEngine) Execution Time=69.542567560961; CPU Milliseconds=4; SQL Query Count=3; Parent=SPRequest.GetListItemDataWithCallback2 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____Execution Time=69.542567560961 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____CPU Milliseconds=4 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High ____SQL Query Count=3 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation General f6l7 High Leaving Monitored Scope: (SPRequest.GetListItemDataWithCallback2) Execution Time=79.7370894904241; CPU Milliseconds=11; SQL Query Count=4; Parent=EnsureListItemsData 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope: (EnsureListItemsData) Execution Time=79.807908547036; CPU Milliseconds=12; SQL Query Count=4; Parent=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,4 aytib,0 bjkuz,0 a7r51,0 a1n25,0 a9fy7,0 a9fy6,0 bjvyg,0 avwh6,0 az4z8,0 agb9s,0 ajd6k,0 ajd6l,0 0,0 avwh7,0 avwh8,0 avwh0,0 avwh1,0 aj1kn,0 avwh2,0 avwh3,0 avwhu,0 avwhv,0 ayswq,0 anvuv,0 a0t92,0 a08yd,0 a0t94,0 a0t97,0 a0t98,0 ayswq,3 az4z8,15 adhpr,69 adhpr,0 adhpr,0 adhpr,0 adhpr,0 f6l7,0 b4ly,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 200 for HTTP request POST to https://documents.domain.cz/_vti_bin/EVCustom.asmx 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=98.9214411328814; CPU Milliseconds=20; SQL Query Count=6; Parent=None 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwid Medium SPRequestModule.EndRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhy Medium SPRequestModule.BeginRequestHandler Begin
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring nasq Medium Entering Monitored Scope (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")). Parent=None
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory.
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Logging Correlation Data xmnv Medium Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhz Medium SPRequestModule.BeginRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 Web Content Management Publishing aytib Medium ObjectCachePerRequest Global:True, Enabled:False 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 401 for HTTP request POST to https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=0.886635033223496; CPU Milliseconds=0; SQL Query Count=0; Parent=None 0d8c31a0-39c8-10d1-b810-4da9fdba5646

  • plaudone1's avatar
    plaudone1
    Level 6
    3 years ago

    Hi PetrHanz,

    The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

    You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

    SharePointFeatureSetup.exe /install /all 

    Usage:

    SharePointFeatureSetup.exe <action> <targets> [options]

    Action:

    /install :: install the target component(s)
    /uninstall :: un-install the target component(s)
    /spcheck :: is SharePoint functional

    Targets:

    /feature :: feature component
    /webparts :: web parts component
    /versionhistory :: version history customization
    /httpmodule :: httpmodule configuration
    /all :: all components

    Options:

    /log:filename :: writes (appends) to the specified log file
    /q :: suppress output to the console (quiet mode)

    Regards,

    Patrick 

    • PetrHanz's avatar
      PetrHanz
      Level 4
      3 years ago

      Hi Patrick,

      many thanks for your answer. So, any log has more 4 millions rows and  count of rows with code 401 are perhaps 40 thousand. Of course I will check the configuration and  repair this 401. It could reduce the number of rows but only a little.

      So, probably I am not able to decrease of the logging ( only set the ULS logging and this setting has influence on all environment  ) ? Therefore I have to count with the large logs