cancel
Showing results for 
Search instead for 
Did you mean: 

Large log for SharePoint ULS

PetrHanz
Level 4
Partner Accredited Certified
 
1 ACCEPTED SOLUTION

Accepted Solutions

Hi PetrHanz,

The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

SharePointFeatureSetup.exe /install /all 

Usage:

SharePointFeatureSetup.exe <action> <targets> [options]

Action:

/install :: install the target component(s)
/uninstall :: un-install the target component(s)
/spcheck :: is SharePoint functional

Targets:

/feature :: feature component
/webparts :: web parts component
/versionhistory :: version history customization
/httpmodule :: httpmodule configuration
/all :: all components

Options:

/log:filename :: writes (appends) to the specified log file
/q :: suppress output to the console (quiet mode)

Regards,

Patrick 

View solution in original post

6 REPLIES 6

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Your question is empty PetrHanz.

Regards. Gertjan

PetrHanz
Level 4
Partner Accredited Certified

Hi Gertjan, many thanks for warning  :)

Problem is that on SharePoint server I have 4-6GB logs - 10 per daily with still repeating record, see italic.  There are ULS logs. EV logs are in other directory and it is small.

Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-29ca-10d1-b810-4fceaf806c7f

with some requests.

dtrace is disabled, web.config ( IIS setting of logs ) have none influence on this logs ( I hope) . I am look up for decreasing  of the size logging (suppress the occurence of the record)  but I need to leave the setting of  ULS logging for recording of other messages. 

 

TID Area Category EventID Level Message Correlation
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Claims Authentication 00000 Medium STS setting for SuppressModernAuthForOfficeClients:'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x2518 SharePoint Foundation Application Authentication bjkut Medium IsClaimsTrustedAuthenticationOnly: 'False', IsOfficeClientIDCRLRequest: 'False', HasSPTrustedSecurityTokenIssuer: 'True', ForceIdcrlForOfficeClients: 'False'. 0d8c31a0-39c7-10d1-b810-4b1da580e28b
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database ahjqp High [Forced due to logging gap, cached @ 04/08/2022 02:30:05.38, Original Level: Verbose] SQL connection time: 0.0243047649910813 for Data Source=SPSQL;Initial Catalog=SP2016_Content_SpvCorporate;Integrated Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool Size=100;Connect Timeout=60;Packet Size=8000;Application Name=SharePoint[w3wp][2][SP2016_Content_SpvCorporate] ConnectionId: 92df62ab-322c-4d91-ad93-eeadf867c89f 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database asutt High [Forced due to logging gap, Original Level: Verbose] Query Duration: query {0}, connection {1} for procedure {2} in database {3} on server {4} 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High Leaving Monitored Scope: (VqueryEngine) Execution Time=69.542567560961; CPU Milliseconds=4; SQL Query Count=3; Parent=SPRequest.GetListItemDataWithCallback2 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____Execution Time=69.542567560961 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr Medium ____CPU Milliseconds=4 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Database adhpr High ____SQL Query Count=3 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation General f6l7 High Leaving Monitored Scope: (SPRequest.GetListItemDataWithCallback2) Execution Time=79.7370894904241; CPU Milliseconds=11; SQL Query Count=4; Parent=EnsureListItemsData 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly High Leaving Monitored Scope: (EnsureListItemsData) Execution Time=79.807908547036; CPU Milliseconds=12; SQL Query Count=4; Parent=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,4 aytib,0 bjkuz,0 a7r51,0 a1n25,0 a9fy7,0 a9fy6,0 bjvyg,0 avwh6,0 az4z8,0 agb9s,0 ajd6k,0 ajd6l,0 0,0 avwh7,0 avwh8,0 avwh0,0 avwh1,0 aj1kn,0 avwh2,0 avwh3,0 avwhu,0 avwhv,0 ayswq,0 anvuv,0 a0t92,0 a08yd,0 a0t94,0 a0t97,0 a0t98,0 ayswq,3 az4z8,15 adhpr,69 adhpr,0 adhpr,0 adhpr,0 adhpr,0 f6l7,0 b4ly,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 200 for HTTP request POST to https://documents.domain.cz/_vti_bin/EVCustom.asmx 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=98.9214411328814; CPU Milliseconds=20; SQL Query Count=6; Parent=None 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x02E4 SharePoint Foundation Asp Runtime avwid Medium SPRequestModule.EndRequestHandler End 0d8c31a0-59c2-10d1-b810-43c65fd6473f
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhy Medium SPRequestModule.BeginRequestHandler Begin
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring nasq Medium Entering Monitored Scope (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")). Parent=None
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory.
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Logging Correlation Data xmnv Medium Name=Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders") 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwhz Medium SPRequestModule.BeginRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwia Medium SPRequestModule.PostLogRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwib Medium SPRequestModule.PostLogRequestHandler End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwic Medium SPRequestModule.EndRequestHandler Begin 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Site Cache az4z8 Medium Looking up SPSite by ID 8018144a-8162-47e6-a31b-71b553fdfa2b in memory. 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Asp Runtime avwh5 Medium SPRequestModule.PreSendRequestHeaders End 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Micro Trace uls4 Medium Micro Trace Tags: 0 avwhy,0 nasq,0 az4z8,0 avwhz,0 avwia,0 avwib,0 avwic,0 az4z8,0 avwh5 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 Web Content Management Publishing aytib Medium ObjectCachePerRequest Global:True, Enabled:False 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Runtime aoxsq Medium Sending HTTP response 401 for HTTP request POST to https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx 0d8c31a0-39c8-10d1-b810-4da9fdba5646
04/08/2022 02:30:05.44 w3wp.exe (0x3E7C) 0x3948 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope: (Request (POST:https://documents.domain.cz/corporate/_vti_bin/EVCustom.asmx:ListFolders")) Execution Time=0.886635033223496; CPU Milliseconds=0; SQL Query Count=0; Parent=None 0d8c31a0-39c8-10d1-b810-4da9fdba5646

Hi PetrHanz,

The EVCustom.asmx page is called very often for SP archiving as all of the actions during archiving are driven through that page. I see some 401 errors in the log.  Have you created a new WebApp since installing EV?  If so, the page may not be installed in that new WebApp.  This could be verified in IIS.  

You can run the following on every Front End server to ensure all of the WebApp's on the server contain the EV configuration. 

SharePointFeatureSetup.exe /install /all 

Usage:

SharePointFeatureSetup.exe <action> <targets> [options]

Action:

/install :: install the target component(s)
/uninstall :: un-install the target component(s)
/spcheck :: is SharePoint functional

Targets:

/feature :: feature component
/webparts :: web parts component
/versionhistory :: version history customization
/httpmodule :: httpmodule configuration
/all :: all components

Options:

/log:filename :: writes (appends) to the specified log file
/q :: suppress output to the console (quiet mode)

Regards,

Patrick 

PetrHanz
Level 4
Partner Accredited Certified

Hi Patrick,

many thanks for your answer. So, any log has more 4 millions rows and  count of rows with code 401 are perhaps 40 thousand. Of course I will check the configuration and  repair this 401. It could reduce the number of rows but only a little.

So, probably I am not able to decrease of the logging ( only set the ULS logging and this setting has influence on all environment  ) ? Therefore I have to count with the large logs 

 

 

   

PetrHanz
Level 4
Partner Accredited Certified

Hi Patrick

So, I will prepare script where ULS logs < 2 days of modification date will compress and deleted. Many thanks for your help. I will close this like accept. 

So  I 'd like ask you for following idea I have NTFS store ( enable dedupe + compression). The type of stores  are SHP, SMTP journaling, Filesystem. I need move the store to the new dedupe storage  NFS. 

1. Move store from EV console doesn"t support for these types of store.

2. Manual moving of data or migration to second store has serious limit: Moved data are in compress and  with SIS deduplication. Therefore this process in not suitable because dedupe ratio (on block dedupe storage ) is very low.   

Any idea ?  Many thanks Patrick

 

Hi PetrHanz,

Thank you for the update on this thread. 

May want to open a new thread for the moving data question.  Typically, we could copy the partition data, if new storage is same type, then update that PartitionRootPath in SQL.  Otherwise, it would be a migration tool such as Migrate to copy the data to the new store.  

Regards,

Patrick