Export (0) Print
Expand All

logserverconfig.xml reference

FAST Search Server 2010
 

Applies to: FAST Search Server 2010

Topic Last Modified: 2011-01-14

Use logserverconfig.xml to configure routing and filtering of log messages sent from Microsoft FAST Search Server 2010 for SharePoint components. The logging process consists of three steps. The first step is configured in loggerconfig.xml. logserverconfig.xml contains the configuration for the last two steps, the local and main log servers.

All FAST Search Server 2010 for SharePoint nodes have a local log server. This server performs logging locally and also forwards the log messages to the main (farm) log server which runs only on the administrative node.

Both log server subsystems run within the FAST Search Server 2010 for SharePoint Monitoring service. logserverconfig.xml is loaded when the Monitoring service is started up. The file must be located in the <FASTSearchFolder>\etc\ folder, where <FASTSearchFolder> is the path of the folder where you have installed FAST Search Server 2010 for SharePoint, for example C:\FASTSearch.

The list of destinations is used to set up the logging targets where incoming messages are sent.The programs list configures log level filtering for individual log sources. A default program entry (name = default) is defined for each log server. If an incoming log message does not match any of the defined programs, the default program entry is used instead.

You can edit the installed version of logserverconfig.xml to tune the existing values and to add program elements to override filtering and routing for specific log sources. However, in most cases, the default values will be acceptable.

noteNote
To modify a configuration file, verify that you meet the following minimum requirements: You are a member of the FASTSearchAdministrators local group on the computer where FAST Search Server 2010 for SharePoint is installed.

Use a text or XML editor to change this file. Edits will not take effect until the FAST Search Server 2010 for SharePoint Monitoring service (FASTSearchMonitoring) is restarted.

logserverconfig.xml uses the following elements:

 

Element Description

<logserverconfig>

Top level element

<locallogserverconfig>

Configuration for the local log server

<mainlogserverconfig>

Configuration for the main log server

<flood_protect>

Filter that blocks excessive logging

<destinations>

A list of log targets:

  • <sharepointulslog> - SharePoint Unified Logging Service (ULS) log destination for the local log server

  • <mainlogserver> - Main log server forwarding destination for the local log server

  • <localeventlog> - NT event log destination for the local log server

  • <farmeventlog> - NT event log destination for the main (farm) log server

  • <filedestination> - Log file destination for the main (farm) log server

<programs>

A list of log sources:

  • <program> - Routing and filtering specifications for a log source

  • <output> - Specifications for routing log messages to a particular destination, with a log level threshold filter

logserverconfig.xml is an XML file and follows all conventions and syntax rules that are defined for the XML file format.

The basic file structure is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<logserverconfig version="1.0">

  <locallogserverconfig>

    <destinations>
      ... specification of where logs can be sent
    </destinations>

    <programs>
      <program name="default">
        ... routing to destination with log level filtering
      </program>
      ... add more program elements here to override defaults
    </programs>

  </locallogserverconfig>

  <mainlogserverconfig>
    .. same basic structure as for locallogserverconfig
  </mainlogserverconfig>

</logserverconfig>

This is the top level element of logserverconfig.xml.

 

Attribute Value Description

version

1.0

The version attribute provides future expansion of the file format. Currently only 1.0 is valid.

This element contains the configuration for the local log server.

This element contains the configuration for the main (farm) log server.

Filter that blocks log messages if flooding is detected.

Three time periods are available:

 

Period Description

Measure

Blocking will be enabled if the number of log messages exceeds max_count during a single measurement period.

Block

If blocking is enabled, log messages will be filtered until the end of the current blocking period.

Trickle

Even if blocking is enabled, a single log message may still pass during each trickle period.

Log messages are filtered based on both log source and log level. For example, an active blocking of INFO messages will not affect ERROR messages from the same log source.

 

Attribute Value Description

max_count

value

The number of log messages allowed for a single measurement period

measure_minutes

value

Length of measurement periods in minutes

block_minutes

value

Length of blocking periods in minutes

trickle_minutes

value

Length of trickle periods in minutes

Measure_minutes, block_minutes and trickle_minutes can be configured independently. However, the most logical results are achieved if the numbers are set to an integer multiple of the smallest value.

Block_minutes is usually set to a larger or equal value as measure_minutes. To disable the trickle feature, set trickle_minutes to the same value as block_minutes.

In the following example, a maximum of 1000 messages is allowed for each 5 minute measurement period. If this threshold is exceeded, log messages will be blocked for the rest of the current 180 minute blocking period. However, 1 log message will be allowed to pass every 30 minutes (trickle period).

<flood_protect max_count       = "1000"
               measure_minutes = "5"
               block_minutes   = "180"
               trickle_minutes = "30" />

This element is a container for one or more destination elements.

This element defines a SharePoint Unified Logging Service (ULS) log destination for use with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

 

Attribute Value Description

name

string

Symbol used to reference this log destination from a program element

This destination uses the trace logs feature of the SharePoint Unified Logging Service (ULS).

This element defines a log destination which forwards logs from the local log server to the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

 

Attribute Value Description

name

string

Symbol used to reference this log destination from a program element

The forwarding of log messages uses a WCF protocol. Edit the bin\MonitoringService.exe.config .NET file to configure WCF service parameters, bindings, and behavior.

This element defines an NT event log destination used with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

 

Attribute Value Description

name

string

Symbol used to reference this log destination from a program element

This element defines an NT event log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

 

Attribute Value Description

name

string

Symbol used to reference this log destination from a program element

This element defines a text file log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

 

Attribute Value Description

name

string

Symbol used to reference this log destination from a program element

This destination logs messages to files in the <FASTSearchFolder>\var\log\syslog\ directory.

This element is a container for one or more program elements, and contains a list of log sources.

Defines routing and filtering for a log source. The element contains one or more output elements to define routing of log messages to a particular destination, with a specified log level threshold filter.

 

Attribute

Value

Description

name

string

Log module name, matching the identifier that is used by the logging source.

Inspect <FASTSearchFolder>\var\log\syslog\all.log on the main log server to retrieve the identifiers.

Example: indexer

For the local log server, routing to the mainlogserver destination is implicit. This message forwarding cannot be disabled.

In the following example, routing and filtering for log messages from the module indexer is defined. Only messages that use the log level of CRITICAL are routed to the destinations eventlog and ulslog. Log messages that use lesser log levels are discarded.

<program name="indexer">
  <output destination="eventlog" threshold="critical" />
  <output destination="ulslog"   threshold="critical" />
</program>

Defines routing of log messages to a particular destination, with a specified log level threshold filter.

 

Attribute Value Description

destination

string

Symbol referencing a configured destination element

threshold

CRITICAL|ERROR|WARNING|INFO|VERBOSE|DEBUG

  • CRITICAL - route only CRITICAL messages.

  • ERROR - route messages that have log level ERROR and above.

  • WARNING - route messages that use log level WARNING and above.

  • INFO - route messages that use log level INFO and above.

  • VERBOSE - route messages that use log level VERBOSE and above.

  • DEBUG - route all log messages.

In the following example, all messages are routed to the destination with the name file.

<output destination="file" threshold="debug" />

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft