Sharepoint log question

Question

Dear all,

Hope all is going well!

We are having some issue, we currently using sharepoint server 2019 and running in 3 servers.

But only one server having a lot of logs in below path:

C:\Program files\common files\microsoft shared\web server extensions\logs\featureused

C:\Program files\common files\microsoft shared\web server extensions\logs\Userengagement

I would like to ask what this logs are for and also why only in one server, we are having a drive storage issue since log size is too big.

It would be really appreciated if anyone knows why only one server having this issue and what this logs are for and it is ok to delete and more information.

Hope you have a great day!

Thank you.

Answer 1

Hi @Soohyun Song,

Thank you for posting in this community.

Q1: What these logs are for?

1. UserEngagement Logs:
   • These logs track user interactions with SharePoint sites, pages, and content. They provide insights into how users engage with various features and functionalities.
   • Examples of events captured in UserEngagement logs include:
   • Page views: Which pages users visit and how frequently.
   • Document views: Which documents are accessed and by whom.
   • Search queries: What users search for within SharePoint.
   • Social interactions: Comments, likes, and shares on social features.
   • By analyzing UserEngagement logs, administrators can identify popular content, user adoption trends, and areas that need improvement.
2. FeatureUsage Logs:
   • FeatureUsage logs record the usage of specific SharePoint features and components.
   • Examples of events captured in FeatureUsage logs include:
   • Feature activation: When users enable or use specific SharePoint features (e.g., document libraries, workflows, lists).
   • Feature deactivation: When features are disabled.
   • Custom solutions: Usage of custom-developed features or solutions.
   • Third-party app usage: Interaction with apps integrated into SharePoint.
   • Monitoring FeatureUsage logs helps administrators understand which features are heavily utilized and which might need further promotion or optimization.

Q2: Why only in one server?

Unfortunately, I consulted the documentation but it does not explain why the logs are kept in only one server. By default, SharePoint Server writes diagnostic logs to the same drive and partition on which it was installed. Maybe that's the cause of the problem.

Q3: How to solve this drive storage issue?

First you can navigate to the logging location to manually empty the logs you don't need.

Second, please refer to the following configuration to avoid disk storage issues:

1.Limit the size of the disk occupied by the log.

• Please access SharePoint Central Administration as an administrator.
• In Central Administration, on the home page, click Monitoring.
• On the Monitoring page, in the Reporting section, click Configure diagnostic logging.
• Slide to the Trace Log area at the bottom. To restrict the disk space that logs can use, select the Restrict Trace Log disk space usage check box, and then type the number gigabytes (GB) you want to restrict log files to. When logs reach this value, older logs will automatically be deleted.
• After you have made the changes that you want on the Diagnostic Logging page, click OK.

For more information on configuring diagnostic logging see: Configure diagnostic logging by using Central Administration.

2.If you don't need these two logs, you can remove the featureused and Userengagement logs.

• Please access SharePoint Central Administration as an administrator.
• In Central Administration, on the home page, click Monitoring.
• On the Monitoring page, in the Reporting section, click Configure usage and health data collection.
• In the Event Selection section, Uncheck the checkboxes for the logs you don't want to record.
• After you have made the changes that you want on the Configure usage and health data collection page, click OK.

For more information on configuring usage and health data collection see: Configure usage and health data collection by using Central Administration.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Soohyun Song,

Thank you for your reply.

I looked up more information and found out:

Internally SharePoint does load balancing, so it decides which WFE serves the actual user request (you might also have external load balancer doing this for you when it comes to WFEs) - events related to this request get written to the ULS log of that specific WFE. Same goes for APP servers, depending on which server a service is run, events are logged only to ULS of that server.

So the question about why your logs are only being written to one server is something we haven't found out yet. If this issue affects you a lot, we suggest you open a ticket and ask.

Please accept my sincerely apologize for any in convenience this may cause. Thank you for your kind understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.