Beware of the Default Logging in MOSS if you like your diskspace


By default, SharePoint trace logging is enabled and the log files are stored at: C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS on your front-end web server. Without changing the verbosity of logging via event throttling settings, or the number of minutes before creating a new log file, each log file is around 50 Meg! By default, SharePoint keeps 96 of these files, spanning 2 days for a grand total of around 4.8 Gig.

Here are the default log settings on the diagnostic logging operations page:


In our case, we want to keep the current verbosity level and expand the length of time that we retain the logs to 3 days, but we want to store the logs on a different disk. All we have to do is change the path in the Trace Log section of this maintenance page and increase the number of log files to 144.

NOTE on PSCDiagnostics files: You may notice log files whose names start with “PSCDiagnostics”. These files are post-setup configuration files. Each time that you open SharePoint’s central administration page, a new PSCDiagnostics file is created. These files are always stored in the same directory as the trace logs. So, if you change the trace log location, these logs will follow.

You also have a very fine degree of control over the types of events to log. The following is a comprehensive list of event types:


For each event, you can set the least critical event to report to the event log:


and you can report the least critical event to report to the trace log:


You must press OK at the bottom of the maintenance page for each modification to the throttling settings. This works well enough if you are making a modest number of changes to these levels. However, if you are making more pervasive changes or you wish to make changes to hidden event categories, then the stsadm.exe command line utility is your better option.

Here is the command line syntax for showing hidden event categories:

stsadm.exe –o listlogginglevels -showhidden

Here is the command line syntax for changing logging levels as detailed in Jose Baretto’s blog. Here is a link to the entire post:

stsadm -o setlogginglevel [-category < [CategoryName | Manager:CategoryName [;…]] >] {-default | -tracelevel  < None;  Unexpected; Monitorable; High; Medium; Verbose> [-windowslogginglevel < None;  ErrorServiceUnavailable;  ErrorSecurityBreach;  ErrorCritical;  Error;  Warning;  FailureAudit; SuccessAudit;  Information;  Success>] }

One thought on “Beware of the Default Logging in MOSS if you like your diskspace

  1. Hello Dirk,

    Thank you for the clear article. I have a single question about the PSCDiagnostics files. Are you sure one is created every time I open Sharepoint’s Central Administration page? That sounds to me like quite often. I would have expected one to be created every time I run the Sharepoint Configuration Wizard from Start Menu | Administrative Tools, since that wizard performs the Post Setup Configuration, doesn’t it?


    Beat Nideröst

Leave a Reply

Your email address will not be published. Required fields are marked *