Correct Empty ULS Logs in SharePoint 2010

If you're unsure what ULS logs are or what they're used for, please see my previous post where I cover the basics. On a recent project, I was adding a new server to a SharePoint 2010 farm. After the join was completed, I went to go review the ULS logs to ensure all looked well and no serious errors or other issues came up. To my surprise, it was empty! It turned out to be a simple fix, but here are some things to check when this happens:

1. ULS logging is driven by the Windows service "SharePoint 2010 Tracing". Ensure this service is started, and if it is already running, right-click on it and choose restart. Then re-check the ULS logs.
2. If the above tracing service is started and re-starting doesn't help, it likely is permissions related. This was the problem in my case. To fix this, do the following:
   1. In this environment, the tracing service was running as the application pool account. We need to add that account to the local user group "Performance Log Users".
   2. Check the membership of this group on a working farm server, and ensure the new farm server has the same group membership.
   3. Restart the tracing service, and check the ULS logs again for entries.
3. If you still have trouble, check the other local security groups like WSS_WPG and WSS_ADMIN_WPG groups and ensure the problem server has the same memberships.

While you shouldn’t have to, it might be necessary to either perform an IISRESET on the problem server, or even reboot to ensure new credentials take affect.

All About SharePoint 2010 ULS Logging

I use SharePoint’s ULS logs almost daily when supporting and administering SharePoint (2007 and 2010 for that matter).  Let’s look at what it is, and how it can help you troubleshoot issues in SharePoint 2010.

What is this “ULS Logging”?

Like most (but not all) features in SharePoint 2010, logging did get an upgrade from 3.0 / 2007.  First of all, what is ULS?  It stands for Unified Logging Service (ULS).  It is the engine that handles creating a detailed trace output of all of the events that occur in SharePoint.  It is dependent on the Windows service “SharePoint 2010 Tracing”.  By default, SharePoint creates these log files in the file system in the “14 hive”:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS

These log files are written by SharePoint in real-time and contain information regarding event logging per its configuration in Central Administration.