Plan for monitoring in SharePoint Server
APPLIES TO: 
2013 2016 2019 Subscription Edition 
SharePoint in Microsoft 365
To make sure that SharePoint Server is running smoothly, IT professionals must monitor farms, servers, applications, services, and performance closely. You should do preventive maintenance regularly to prevent problems from happening, and create a plan that will minimize damage when a problem occurs.
Microsoft provides many tools that help you monitor the overall health status of the SharePoint Server environment. If anything goes wrong, you can find plenty of resources and use the monitoring tools to analyze logs, identify the cause, and then take correct actions to solve the problems.
You also need to plan how many people you want to monitor the SharePoint Server environment. Then create a response plan to cover actions that you should take when a problem occurs.
Overview of monitoring tools
There are many tools that you can use to monitor SharePoint Server and troubleshoot problems. Each tool covers different parts of the SharePoint environment, and some tools may overlap areas. Consider which tools can maximize your monitoring actions. The following monitoring tools are available:
SharePoint Health Analyzer
On the Central Administration home page, click Monitoring, Health Analyzer. You can use this built-in feature to analyze and resolve problems in the following areas: security, performance, configuration, and availability. Health Analyzer rules are predefined and run at scheduled intervals, such as hourly, daily, weekly, and monthly. If an error is detected, the corresponding rule is triggered. Each rule has a brief explanation about why the error occurs and provides you with a link to a detailed article that contains step-by-step help to resolve the problem. When you follow the help process, you can re-run the rule to verify resolution. If the error does not appear in the list, the problem is resolved.
Timer Jobs
On the Central Administration home page, click Monitoring, Timer Jobs. SharePoint Server uses configurable timer jobs to collect health data and then writes the data to the logging folder and to the Logging database. The data is then used in reports to display the health status of the farm servers.
You can reschedule a timer job, enable or disable it, and run it on demand. Daily, weekly, and monthly schedules also include a window of execution. The timer service will select a random time within this interval to start running the timer job on each applicable server. This feature is appropriate for high-load jobs that run on multiple servers on the farm.
Note
Running timer jobs at the same time on all servers on the farm can affect system performance. You should plan timer jobs carefully to avoid overlap with other timer jobs.
Reporting
On the Central Administration home page, click Monitoring, Reporting. This feature lets you configure diagnostic logging and data collection, and view administrative and health reports. Because some configurations will use up drive space and adversely affect system performance you must carefully plan what configurations to set.
Microsoft PowerShell
PowerShell is a powerful tool for monitoring SharePoint Server. You can run commands to obtain the exact logs that you want to view. For more information, see View diagnostic logs in SharePoint Server.
System Center - Operations Manager with System Center Management Pack for SharePoint Server
System Center - Operations Manager is a powerful monitoring platform that lets you monitor services, devices, and operations for many computers in a single console. By using Operations Manager, you can view status, health, performance information, and alerts generated for availability, performance, configuration and security situations. For more information, see Operations Manager.
To use Operations Manager to monitor SharePoint Server, you must install System Center Management Pack for SharePoint Server. You can use this tool to monitor events, collect SharePoint component-specific performance counters in one central location, and raise alerts for operator intervention as necessary. Download and install System Center Management Pack for SharePoint Server 2016.
Event Viewer
Event Viewer is a Microsoft Management Console (MMC) snap-in. It lets you browse and manage event logs. It is a very handy tool for troubleshooting problems. You can filter for specific events across multiple logs, and reuse useful event filters as custom views. For more information, see Event Viewer.
SharePoint Developer Dashboard
This tool provides diagnostic information that can help a developer or system administrator analyze performance of SharePoint Web pages. This utility can help if a page is loading slowly, a Web Part is not performing, or if a database query on the page is not performing. The SharePoint Developer Dashboard is disabled by default. You can enable it by using PowerShell. For more information, see SharePoint Developer Dashboard.
Windows Management Instrumentation (WMI)
WMI provides many classes for you to monitor the SharePoint Server environment. For each manageable resource, there is a corresponding WMI class. For more information, see Windows Management Instrumentation (WMI) Overview.
SQL Server Reporting Services (SSRS)
SQL Server Reporting Services provides a full range of ready-to-use tools and services to help you create, deploy, and manage reports for your organization. It also has programming features that let you extend and customize reporting functionality. By using SQL Server Reporting Services, you can create interactive, tabular, graphical, or free-form reports from relational, multidimensional, or XML-based data sources. You can publish reports, schedule report processing, or access reports on-demand. You can use SQL Server Reporting Services to create reports based on predefined models, and to interactively explore data within the model. You can select from a variety of viewing formats, export reports to other applications, and subscribe to published reports. The reports that you create can be viewed over a Web-based connection or as part of a Windows application or SharePoint site. For more information, see Reporting Services (SSRS).
SharePoint Health Analyzer, Timer Jobs, Reporting, and PowerShell are built-in features, whereas System Center, System Center Management Pack for SharePoint Server 2016, and SQL Server Reporting Services are independent tools. SharePoint Developer Dashboard and WMI are built-in tools and intended for developers or system administrators. These tools are complementary and apply to different scenarios.
The following table shows a summary of these tools. You must balance the pros and cons of the monitoring tools when you determine which tools to use under certain scenarios.
Summary of monitoring tools
| Tool | Optional or built-in | Skill level required | Pros | Cons | Resources |
|---|---|---|---|---|---|
| SharePoint Health Analyzer | Built-in | Basic | Gives step-by-step instructions for resolving a problem. Customizable. You can disable some rules if you don't need them. |
Does not cover all possible problems. A rule is triggered only after a problem has already happened. |
Configure SharePoint Health Analyzer rules in SharePoint Server View and resolve SharePoint Health Analyzer alerts in SharePoint Server SharePoint Health Analyzer rules reference for SharePoint Server 2016 |
| Timer jobs | Built-in | Advanced: You have to consider the implications of enabling or disabling a timer job and changing schedules. | Wide range of monitoring items. Easy to reschedule. Customizable. You can create new timer jobs to meet your specific requirements. |
Can affect system performance and conflict with one another. | Configure SharePoint Health Analyzer timer jobs in SharePoint Server 2016 Timer job reference for SharePoint Server |
| Reporting | Built-in | Viewing skill level: Basic | Flexible. Lets you configure the severity of events to log, enable event log flood protection, and configure trace logs. | Only shows administrative and health statistics, without any suggested solutions. You have to interpret the logging data. Can affect performance and disk usage. |
View reports and logs in SharePoint Server 2016 |
| PowerShell | Built-in | Advanced: you have to know what to look for, and you have to run PowerShell commands. | Filters data, displays it in various ways, and outputs data to a grid with which you can filter, sort, group, and export the data to Excel 2016. | You have to know which PowerShell commands to run. | View diagnostic logs in SharePoint Server |
| System Center with System Center Management Pack for SharePoint Server | Optional but recommended | Advanced: you need to know what to look for and how to interpret data. | The tool can detect, diagnose, and alert you about software and hardware incidents, and refer you to knowledge articles. It helps you to do more monitoring with fewer people by monitoring many key scenarios. | Requires additional servers to deploy. | System Center Management Pack for SharePoint Server 2016 |
| Event Viewer | Built-in | Basic | You can view events from multiple event logs, save useful event filters as custom views that can be reused, schedule a task to run in response to an event, and create and manage event subscriptions. | Does not suggest resolutions. | Event Viewer |
| SharePoint Developer Dashboard | Built-in | Advanced: you have to know what to look for and how to interpret data. | Easy to analyze performance of SharePoint pages. | Limited to monitoring performance of SharePoint pages. | SharePoint Developer Dashboard |
| Windows Management Instrumentation (WMI) | Built-in | Advanced: you have to know what to look for and how to write WMI scripts for the managed objects. | Can monitor, track, and control system events that are related to software applications, hardware components, and networks. | You have to identify which managed objects to monitor. You have to write WMI scripts. |
Windows Management Instrumentation (WMI) Overview |
| SQL Server Reporting Services | Optional but recommended. | Advanced: you have to design and manage reports. | Comprehensive platform to create and manage reports. | Advanced skills required to create and develop solutions. You have to know PerformancePoint Dashboard Designer and Visual Studio. | Reporting Services (SSRS) |
For a SharePoint farm with no more than 10 servers, we recommend that you at least install the following independent tools:
System Center 2012 - Operations Manager with System Center Management Pack for SharePoint Server 2013
Monitors the health status of SharePoint products.
SQL Server Reporting Services
Deploy it if you use the Reporting Services to view Report Definition Language (RDL) files, and design reports by Visual Studio and PerformancePoint Dashboard Designer.
Identify monitoring scenarios
Identify the scenarios that you want to monitor —for example, health, workflows, search, SQL Server, virtual environments, and performance. The following table shows some key scenarios and the monitoring tools that you can use to monitor those scenarios.
Scenarios and monitoring tools
| Tool\Scenario | Health | Search | Databases | Performance | Workflows | Virtual environments | Business Data Connectivity | Business Intelligence | Access Services | Farms | Servers | Service applications | Web applications |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SharePoint Health Analyzer | √ | √ | √ | √ | X | X | √ | √ | √ | √ | √ | √ | X |
| Timer jobs | √ | √ | √ | √ | √ | X | X | √ | X | X | X | √ | √ |
| Reporting | √ | √ | √ | √ | √ | X | √ | √ | √ | √ | √ | √ | X |
| PowerShell | √ | √ | √ | √ | √ | X | √ | √ | √ | √ | √ | √ | √ |
| System Center with System Center Management Pack for SharePoint Server | √ | √ | √ | √ | X | √ | √ | √ | √ | √ | √ | √ | X |
| Event Viewer | √ | √ | √ | √ | √ | X | √ | √ | √ | √ | √ | √ | √ |
| SharePoint Developer Dashboard | X | X | X | √* | X | X | X | X | X | X | X | X | X |
| Windows Management Instrumentation (WMI) | √ | √ | √ | √ | X | √** | X | √ | X | X | √ | X | X |
| SQL Server Reporting Services | √ | √ | √ | √ | √ | X | √ | √ | √ | √ | √ | √ | √ |
Note:
*: SharePoint Developer Dashboard only monitors performance of web pages.
**: The WMI interfaces can manage the Hyper-V services.
Determine daily, weekly, and monthly monitoring items
You can decide which items to monitor daily, weekly and monthly based on the "Daily Tasks" section (on page 45), the "Weekly Tasks" section (on page 53), the "Monthly Tasks" section (on page 54), and the "Impromptu Tasks" section (on page 54) in the SharePoint Server 2013: Operations Framework and Checklistswhite paper.
Note
While this white paper addresses SharePoint 2013, you can still use this information to help plan monitoring schedules for SharePoint Server.
Plan monitoring personnel
You have to estimate how many people you will require to monitor the SharePoint Server environment. Depending on the size of the SharePoint environment, you might assign dedicated people to monitor the SharePoint environment. For very large enterprise farms, you might require that one or two people are dedicated to each farm.
When planning for monitoring personnel, consider the following:
Small farm (Small user base, or line of business (LOB) applications)
Medium farm (Enterprise, Service Applications, etc.)
Large enterprise farm (Large Enterprise, Many Service Applications, Self-Provisioning, etc.)
High availability requirements (Service level agreements, SLAs)
High performance requirements (Page render times)
User base size (how many unique users)
Concurrent users (how many users actively hitting the portal at once)
Requests per second (also during peak hours)
Operational maturity
Management tools
The following table shows approximately how many people of different skill levels are required to monitor the SharePoint environment depending on the number of servers. Note that this table only provides a very rough estimate.
Monitoring personnel required
| Number of servers | Personnel required | Skill level required |
|---|---|---|
| 1~4 | 1 | Basic |
| 4~10 | 1~2 | Advanced |
| 10~40 | 3~4 | Basic and Advanced |
| 40~100 | 5+ | Basic and Advanced |
| 100+ | 10+ | Basic and Advanced |
Create a response plan
We recommend that you create a response plan to help prepare for potential problems and to specify what actions to take when a problem does occur.
The response plan should exclude SharePoint Health Analyzer rules that provide workable solutions already. For a problem that has no immediate solutions, you must investigate the logs by using monitoring tools such as the Event Viewer to find a solution.
The following table shows some factors that you should consider when you develop a response plan.
Suggested items in a response plan
| Item | Description |
|---|---|
| Alert/Event/Problem | The verbatim message, the verbatim event, or description of the problem. |
| Affected services/applications | Services or applications that will be affected by the problem. |
| Symptom | Symptom of the problem. |
| Severity | Severity of the problem. Problems with high severity must have high priority. |
| Problem must be resolved in (minutes or hours) | Acceptable lapse time of service. |
| Possible causes | Possible causes of the problem. |
| Resolutions | Resolutions of the problem. |
| Contacts | People who should be contacted when this problem occurs. |
| Escalation | People or teams that should be contacted if the resolutions did not successfully resolve the problem. |
| Related resources | Any resources that may help resolve the problem, such as articles on Microsoft Learn for SharePoint Server. |
| Note | Any issues that you want to highlight. |
See also
Concepts
Overview of monitoring in SharePoint Server
Monitor apps for SharePoint for SharePoint Server
Storage and SQL Server capacity planning and configuration (SharePoint Server)
Monitor cache performance in SharePoint Server 2016