Changing Trace Switch Logging Levels
ControlPoint contains a number of trace switches that control the type and level of detail that is captured in the ControlPoint Administration (xcAdmin) log. Quest Support may suggest that one or more of these be changed for diagnosis and troubleshooting purposes.
NOTE Trace switches are Advanced settings.
Valid values for all trace switches, listed from least to most detail, are:
·Disabled
·Error (the default)
·Warnings
·Info
·Verbose
Note that as the logging level increases, the amount of detail is "additive." For example, if you select the logging level Info, then Errors and Warnings will also be included.
|
If you want to change the logging level for... |
Edit the following setting ... |
|---|---|
|
the SharePoint hierarchy building for navigation and selection |
SharePoint Hierarchy Access Logging |
|
the amount of time it takes the SharePoint Hierarchy to load |
SharePoint Hierarchy Load Time Logging |
|
reports and actions general processing |
Traverse Entry Logging |
|
Additional Traverse Entry Logging | |
|
the interaction between ControlPoint and databases |
Database Interaction Logging |
|
the validation of SharePoint users by ControlPoint |
SharePoint Access Logging |
|
aspx page major events |
aspx Page Major Event Logging |
|
the interaction between ControlPoint and Active Directory |
Active Directory Interactions Logging |
|
operations performed by the ControlPoint Scheduler |
ControlPoint Scheduler Logging |
|
the management of linked SharePoint groups |
Manage Linked SharePoint Group Logging |
|
WCF Services calls |
WCF Service Call Logging |
|
ControlPoint Policies and Site Provisioning operations |
ControlPoint Policies Logging |
|
copy/move at set site properties operations |
Copy/Move and Set Site Properties Logging |
|
non-specific events |
Non-Specific Event Logging |
|
Audit Log archiving |
Audit Log Archive Logging |
|
Workflow reporting for the Comprehensive User Analysis |
Comprehensive User Workflow Report Logging |
|
access to the Managed Metadata Service Application database |
Managed Metadata Service Application Database Access Logging |
|
ControlPoint operations performed via PowerShell |
PowerShell Processing Logging |
|
Set List properties operations |
Set List Properties Logging |
|
Social Activity Analysis processing |
Social Activity Analysis Logging |
|
ControlPoint Statistics Lists calculations |
Statistics Lists Calculation Logging |
|
the ControlPoint Database Recovery operation |
ControlPoint Database Recovery Logging |
Archiving SharePoint Audit Log Data
ControlPoint xcUtilities is a utility that includes functionality for moving SharePoint audit log data from content databases in your SharePoint farm to an external database, allowing you to free up space in content databases without losing this data. For example, archiving would be valuable if your organization is subject to regulations that require certain types of audit data be retained. The schema for the external database is provided, allowing you to report and analyze archived data using standard SQL-based tools.
If your organization is not subject to regulatory requirements and/or you simply want to purge SharePoint audit log data from content databases, use the ControlPoint Setting Number of Days to Keep Audit Records.
By default, the process archives data from all Web applications. You can, however, choose to include only Web applications that you specify (for example, only those that contain audit log data that is subject to regulatory requirements) using ControlPoint Configuration settings.
How the Audit Log Archiving Process Works
As part of the setup process, the table where archived audit log data will be stored is created in an external SQL database.
Whenever the archive process is run (which may be from the xcUtilities interface, from a command line or the ControlPoint application interface, the process carries out the following actions:
1Checks the parameter value of the ControlPoint Configuration Setting ArchiveAuditLogIncludeWeb
Applications for a list of Web applications for which audit log data should be archived. If the parameter value is null, all Web applications will be included in the archive process.
EXCEPTION: If the archive process was initiated from the ControlPoint application interface, all selected objects will be included, regardless of this setting.
See also Specifying the Web Applications to Include in the Archiving Process.
2For each Web application to be processed:
a)Uses the date for the earliest audit record in the content database(s) for the selected Web application as the start date.
b)Retrieves audit log records within the Web application that were created between the start date and the next process interval date, as determined by the ControlPoint Configuration Setting ArchiveAuditLogProcessInterval.
NOTE: By default, the process interval is one (1) hour, but this value can be changed. See Changing the Archive Audit Log Process Interval (Optional).
c)Writes the audit data for the process interval to the external database table as a database transaction.
NOTE: If an exception occurs, data will not be committed to the external database, the transaction will be rolled back, and the archiving process will stop. Exception conditions will be captured in the ControlPoint Task Audit.
d)Once the audit records have been committed to the external database, deletes the corresponding records from the content database.
NOTE: If an exception occurs during the deletion of audit records for a site collection, all the records for the site collection with the current task ID will be removed from the external database (to prevent duplication of data that still exists in the content database), and the archiving process will stop. Exception conditions will be captured in the ControlPoint Task Audit.
e)Advances to the next process interval and repeats substeps b) - d) until the last date to be processed (as determined by the user-specified number of days to keep in SharePoint) is reached.
3Repeats Step 2 for each Web application to be processed.
Tips for Archiving a Large Accumulation of Audit Data
If you have many months or even years' worth of accumulated data to archive, doing all of it in a single operation can be resource-intensive and can perform slowly. When you run the audit log archive process, however, you have the option of specifying the number of days' worth of audit log data to keep in the database. If, however, you have many months or even years' worth of accumulated data to archive, doing all of it in a single operation can be resource-intensive and can bog down your system. It is recommended, therefore, that when you initially run the archiving operation you specify a relatively large amount of data to retain, then incrementally reduce that number with each subsequent run of the operation until you have reached the number of days' worth that you want to retain on an ongoing basis.
EXAMPLE:
Suppose 1,000 days' worth of audit log data has accumulated on your farm, but going forward you only want to retain 60 days' worth. Depending on the size of your farm, archiving 940 days worth of data in a single operation might tie up the system for several hours. To avoid this problem, the first time you run the process you may want to choose to save 800 days' worth (that is, archive 200 days' worth) of audit log data.
The next time you run the operation, you may want to bring the number down to 600 (that is, archive another 200 or so days' worth), and so on, until you have reduced the amount of audit log data in the database to a manageable amount. You can then schedule the operation to run on a regular basis, saving only the amount that you want to retain on an ongoing basis.
