Export (0) Print
Expand All
ABS
AND
ASC
COS
DAY
DDB
EXP
FV
IF
INT
LEN
LN
LOG
MAX
Me
MID
MIN
MOD
NOT
IS
NPV
ODD
OR
PI
PMT
PV
SIN
SLN
SUM
SYD
T
TAN
VAR
Expand Minimize

Monitoring Events for Windows SharePoint Services

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

Part of managing servers is monitoring the applications and services running on your servers so that you can take action either when an error occurs or before a limit is reached. Use the events, alerts, and System Monitor counters in this topic to monitor service status and troubleshoot issues for your front-end Web servers running Microsoft . When you monitor events for and related services, you can make sure that your users' SharePoint sites are available when they need them.

The following types of events are covered in this topic:

  • Web Site and SQL Server Events

  • Services Events

  • Active Directory Events

  • Virus Scanner Events

  • HTML Transformation Events

  • Baseline Server Events

Note: The Microsoft Windows SharePoint Services Monitoring Design and Implementation whitepaper, available on the Microsoft Web site , contains more information about these events and errors and how one team, the Internet Platform and Operations group at Microsoft, used these errors and events to monitor during the beta release.

Web Site and SQL Server Events

The Windows NT Event log entries from all have the same Event ID (1000). For these events, the description field contains unique elements - usually the pound sign (#) followed by a number. These unique elements are called out in the following tables.

When the content and configuration databases cannot be reached, the service on the front-end Web server will be interrupted.

Event

Cannot connect to database

Event Type

Error

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description contains

substring '#50070'

Response

Check the database connection information and make sure that the database server is running.

The following two events are alerts, sent through e-mail messages to system administrators.

Event

Database capacity reached

Event Type

Error

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description contains

substring '#50068'

Response

Change the content database Web site capacity settings or add more content databases.

Event

Database capacity warning reached

Event Type

Warning

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description contains

substring '#50069'

Response

Either change the content database Web site capacity settings or add more content databases.

Services Events

When the following errors occur with Web parts, the SharePoint Timer Services, STSWel, or W3WP, they should be investigated and troubleshooted. When these events occur, services are still available but certain components on one server may not be functioning normally.

Error

Web Part rendering failure

Provider Name

Application

Provider Type

Windows NT Event Log

Event Type

Error

Source Name

Windows SharePoint Services 2.0

Description contains

Substring 'VerifySafeControls failed for guid

Error

Web Part unsafe control detected

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

1000

Event Type

Error

Source Name

Windows SharePoint Services 2.0

Description contains

Substring 'Unsafecontrol exception (GetTypeFromGuid)'

Error

OWSTimer and STSWel error

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

1000

Event Type

Error

Source Name

Windows SharePoint Services 2.0

Description contains

Substring owstimer.exe

Error

W3WP error

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

1000

Event Type

Error

Source Name

Windows SharePoint Services 2.0

Description contains

Substring w3wp.exe

Active Directory Events

The following three events are related to Active Directory account creation, deletion, and updating. Immediate action should be taken when an error is received.

Event

Cannot add user to Active Directory

Event Type

Information

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description

#1966150: Adding user <username> to OU <active directory OU> in domain <domain name> FAILED with HRESULT <error code from AD handler>

Event

Cannot delete user from Active Directory

Event Type

Information

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description

#1966151: Deleting user %user% from OU %OU% in domain %DOMAIN% FAILED with HRESULT %HR%

Event

Cannot update user in Active Directory

Event Type

Information

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description

#1966152: Updating user %user% from OU %OU% in domain %DOMAIN% FAILED with HRESULT %HR%

Virus Scanner Events

If a virus scanner is installed to the front-end Web servers, the following events may be logged in certain scenarios.

Event

Virus checking, loading virus scanner

Event Type

Information

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description

#96000f: Loading antivirus scanner...

Event

Virus checking, cannot load virus scanner

Event Type

Information

Event Source

Windows SharePoint Services 2.0

Event Category

None

Event ID

1000

Description

#960010: Finished loading antivirus scanner. No scanner installed.

HTML Transformation Events

HTML transformation server is an optional component for a server farm running . An HTML transformation server runs an HTML viewer service such as Microsoft Office 2003 HTML Viewer. If an HTML transformation server is configured, the events in this category should be configured and monitored.

Event

HTML launcher started

Provider Name

Application

Provider Type

Windows NT Event Log

Source Name

Microsoft.Office.HtmlTrans.Launcher

Description contains

substring 'start'

Event

HTML load balancer stopped

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

0

Source Name

Microsoft.Office.HtmlTrans.LoadBalancer

Description contains

Substring 'stop'

Event

HTML launcher1 stopped

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

0

Source Name

Microsoft.Office.HtmlTrans.Launcher

Description contains

Substring 'stop'

Event

HTML load balancer 1 started

Provider Name

Application

Provider Type

Windows NT Event Log

Event Number

0

Source Name

Microsoft.Office.HtmlTrans.LoadBalancer

Description contains

Substring 'start'

Event

HTML transformation server CPU usage

Provider Name

Processor - % Processor Time-_Total-3.0-minutes

Provider Type

Windows NT Performance Counter

Baseline Server Events

To make sure your servers are available to your users, you must monitor baseline server events, such as events for NetLogon, Internet Information Server (IIS), Microsoft SQL Server, and so on. The following events and System Monitor counters help you track the status of your servers.

Server Type

Event or Perfmon Counter

Front-end Web server

IIS stop and start times

Front-end Web server

NetLogon Service stop and start times

Front-end Web server

WSS Service stop and start times

Front-end Web server

Web Service: Connection Attempts/second > 500/second

Active Directory server

Events from the standard Microsoft Operations Manager (MOM) pack for Active Directory

Back-end database server

Events from the standard Microsoft Operations Manager (MOM) pack for SQL Server

All servers

Server login successes and failures

All servers

Memory: % Committed Bytes in Use > 80%

All servers

Memory: Available Mbytes < 50MB

All servers

Processor: % Processor Time: _Total (CPU Utilization) > 80%

All servers

Current Connections - Error 2000

All servers

Disk usage <10%

All servers

System: Processor Queue Length > 10

All servers

Memory Pages/second >220

You can also create a script to ping each front-end Web server to make sure that each port is responding, including the SharePoint Central Administration port. You can use the MOM scripts to create a URL monitoring rule and script to do this automatically. Note that the monitoring accounts must be able to access each port to be able to ping them.

If you want to understand the system load and service usage status for each server, you can also monitor the following System Monitor counters.

Server Type

Perfmon Counter

Front-end Web server

Process (w3wp)\% Processor Time

Process (w3wp)\Private Bytes

Front-end Web server

Process (w3wp)\Working Set

Process (w3wp)\Handle Count

Front-end Web server

.NET CLR Memory\# Bytes in All Heaps

Front-end Web server

.NET CLR Memory\Large Object Heap Size

Front-end Web server

.NET CLR Memory\% Time in GC

Front-end Web server

ASP.NET\Worker Process Restarts

Back-end database server

Process(sqlservr)\% Processor Time

Back-end database server

Process(sqlservr)\Working Set

Back-end database server

SQLServer:General Statistics\User Connections

Back-end database server

SQLServer:Locks\Number of Deadlocks/sec

Back-end database server

SQLServer:Locks\Lock Waits/sec

Back-end database server

SQLServer:Locks\Lock Wait Time (ms)

Back-end database server

SQLServer:SQL Statistics\Batch Requests/sec

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft