logserverconfig.xml reference

Applies to: FAST Search Server 2010

Use logserverconfig.xml to configure routing and filtering of log messages sent from Microsoft FAST Search Server 2010 for SharePoint components. The logging process consists of three steps. The first step is configured in loggerconfig.xml. logserverconfig.xml contains the configuration for the last two steps, the local and main log servers.

All FAST Search Server 2010 for SharePoint nodes have a local log server. This server performs logging locally and also forwards the log messages to the main (farm) log server which runs only on the administrative node.

Both log server subsystems run within the FAST Search Server 2010 for SharePoint Monitoring service. logserverconfig.xml is loaded when the Monitoring service is started up. The file must be located in the <FASTSearchFolder>\etc\ folder, where <FASTSearchFolder> is the path of the folder where you have installed FAST Search Server 2010 for SharePoint, for example C:\FASTSearch.

The list of destinations is used to set up the logging targets where incoming messages are sent.The programs list configures log level filtering for individual log sources. A default program entry (name = default) is defined for each log server. If an incoming log message does not match any of the defined programs, the default program entry is used instead.

You can edit the installed version of logserverconfig.xml to tune the existing values and to add program elements to override filtering and routing for specific log sources. However, in most cases, the default values will be acceptable.

Customizing logserverconfig.xml

Use a text or XML editor to change this file. Edits will not take effect until the FAST Search Server 2010 for SharePoint Monitoring service (FASTSearchMonitoring) is restarted.

Element quick reference

logserverconfig.xml uses the following elements:

logserverconfig.xml file format

logserverconfig.xml is an XML file and follows all conventions and syntax rules that are defined for the XML file format.

The basic file structure is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<logserverconfig version="1.0">

  <locallogserverconfig>

    <destinations>
      ... specification of where logs can be sent
    </destinations>

    <programs>
      <program name="default">
        ... routing to destination with log level filtering
      </program>
      ... add more program elements here to override defaults
    </programs>

  </locallogserverconfig>

  <mainlogserverconfig>
    .. same basic structure as for locallogserverconfig
  </mainlogserverconfig>

</logserverconfig>

logserverconfig element

This is the top level element of logserverconfig.xml.

Attributes

locallogserverconfig element

This element contains the configuration for the local log server.

mainlogserverconfig element

This element contains the configuration for the main (farm) log server.

flood_protect element

Filter that blocks log messages if flooding is detected.

Three time periods are available:

Log messages are filtered based on both log source and log level. For example, an active blocking of INFO messages will not affect ERROR messages from the same log source.

Attributes

Measure_minutes, block_minutes and trickle_minutes can be configured independently. However, the most logical results are achieved if the numbers are set to an integer multiple of the smallest value.

Block_minutes is usually set to a larger or equal value as measure_minutes. To disable the trickle feature, set trickle_minutes to the same value as block_minutes.

Example

In the following example, a maximum of 1000 messages is allowed for each 5 minute measurement period. If this threshold is exceeded, log messages will be blocked for the rest of the current 180 minute blocking period. However, 1 log message will be allowed to pass every 30 minutes (trickle period).

<flood_protect max_count       = "1000"
               measure_minutes = "5"
               block_minutes   = "180"
               trickle_minutes = "30" />

destinations element

This element is a container for one or more destination elements.

sharepointulslog element

This element defines a SharePoint Unified Logging Service (ULS) log destination for use with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

This destination uses the trace logs feature of the SharePoint Unified Logging Service (ULS).

mainlogserver element

This element defines a log destination which forwards logs from the local log server to the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

The forwarding of log messages uses a WCF protocol. Edit the bin\MonitoringService.exe.config .NET file to configure WCF service parameters, bindings, and behavior.

localeventlog element

This element defines an NT event log destination used with the local log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

farmeventlog element

This element defines an NT event log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

filedestination element

This element defines a text file log destination for use with the main (farm) log server. The element can contain one flood_protect element to define an optional filter that blocks log messages if flooding is detected.

Attributes

This destination logs messages to files in the <FASTSearchFolder>\var\log\syslog\ directory.

programs element

This element is a container for one or more program elements, and contains a list of log sources.

program element

Defines routing and filtering for a log source. The element contains one or more output elements to define routing of log messages to a particular destination, with a specified log level threshold filter.

Attributes

For the local log server, routing to the mainlogserver destination is implicit. This message forwarding cannot be disabled.

Example

In the following example, routing and filtering for log messages from the module indexer is defined. Only messages that use the log level of CRITICAL are routed to the destinations eventlog and ulslog. Log messages that use lesser log levels are discarded.

<program name="indexer">
  <output destination="eventlog" threshold="critical" />
  <output destination="ulslog"   threshold="critical" />
</program>

output element

Defines routing of log messages to a particular destination, with a specified log level threshold filter.

Example

In the following example, all messages are routed to the destination with the name file.

<output destination="file" threshold="debug" />

See Also

Concepts

loggerconfig.xml reference