MOM 2005 Logging - Part I

This topic will be covered in a few different posts, but let's start with the basics of logging in MOM 2005.

 

Logging is set in the registry on both the management servers and clients in this key:

 

HKLM \ Software \ Mission Critical Software \

 

Values of note:

 

Tracelevel - this is the verbosity level of logging.  Values are ffffffff (disabled), and 0 thru 9.  The higher the number, the more verbose the logging.  By default, tracelevel is set to 1.  When troubleshooting an issue, tracelevel 6 is typically verbose enough to indicate an error condition.  Tracelevel should only be set to 9 when debugging an issue; do not leave the value at 9; you could see a performance hit with MOM. 

 

Tracecircularlines - this is the number of lines that are stored in a MOM log file.  When this limit is reached, the current log is renamed and a new current log is started. The naming convention will be discussed shortly.

 

Traceinitseconds - this is the amount of time that will elapse when the service is started when the log file is renamed to an (init) log.  There is no line limit for the (init) log, strictly a time limit.  The default is 90 seconds.

 

Naming convention

 

Let's start with the basic .mc8 MOM logs.

 

Initially, the MOM Service log is called momservice.mc8 (stored in %windir%\temp\Microsoft Operations Manager\ by default).  When the traceinitseconds value elapses (90 seconds by default), the momservice.mc8 is renamed to momservice(init).mc8.  The current log then becomes momservice(b).mc8.  After this, when the tracecircularlines value is met in the momservice(b).mc8, it is renamed to momservice(a).mc8 and the new current log is momservice(b).mc8.

 

In addition, when you start the MOM service, the existing momservice(init).mc8, momservice(b).mc8 and the momservice(a).mc8 are appended with a 1 to become momservice(init)1.mc8, momservice(b)1.mc8 and momservice(a)1.mc8.  MOM will keep 4 copies of these (the 4 last runs of the MOM service - i.e. momservice(init)4.mc8).

 

The momservice*.mc8 logs should not be confused with the momservice.log (different extension) - the momservice.log contains computer discovery logging where as the momservice*.mc8 logs contain such things as agent communications, rule processing, notification activities, etc.).

 

The next post will list the different MOM 2005 logs and what they contain.