Monitoring Events for Windows SharePoint Services 2.0

Part of managing servers is monitoring the applications and services running on your servers so that you can take action either when an error occurs or before a limit is reached. Use the events, alerts, and System Monitor counters in this topic to monitor service status and troubleshoot issues for your front-end Web servers running Microsoft Windows SharePoint Services. When you monitor events for Windows SharePoint Services and related services, you can make sure that your users' SharePoint sites are available when they need them.

The following types of events are covered in this topic:

• Web Site and SQL Server Events

• Services Events

• Active Directory Events

• Virus Scanner Events

• HTML Transformation Events

• Baseline Server Events

  Note

  The Windows SharePoint Services 2.0 Monitoring Design and Implementation whitepaper contains more information about these events and errors and how one team, the Internet Platform and Operations group at Microsoft, used these errors and events to monitor Windows SharePoint Services during the beta release.

Web Site and SQL Server Events

The Windows NT Event log entries from Windows SharePoint Services all have the same Event ID (1000). For these events, the description field contains unique elements — usually the pound sign (#) followed by a number. These unique elements are called out in the following tables.

When the content and configuration databases cannot be reached, the Windows SharePoint Services service on the front-end Web server will be interrupted.

The following two events are alerts, sent through e-mail messages to system administrators.

Services Events

When the following errors occur with Web parts, the SharePoint Timer Services, STSWel, or W3WP, they should be investigated and troubleshooted. When these events occur, Windows SharePoint Services services are still available but certain components on one server may not be functioning normally.

Active Directory Events

The following three events are related to Active Directory account creation, deletion, and updating. Immediate action should be taken when an error is received.

Virus Scanner Events

If a virus scanner is installed to the front-end Web servers, the following events may be logged in certain scenarios.

HTML Transformation Events

HTML transformation server is an optional component for a server farm running Windows SharePoint Services. An HTML transformation server runs an HTML viewer service such as Microsoft Office 2003 HTML Viewer. If an HTML transformation server is configured, the events in this category should be configured and monitored.

Baseline Server Events

To make sure your servers are available to your users, you must monitor baseline server events, such as events for NetLogon, Internet Information Server (IIS), Microsoft SQL Server, and so on. The following events and System Monitor counters help you track the status of your servers.

You can also create a script to ping each front-end Web server to make sure that each port is responding, including the SharePoint Central Administration port. You can use the MOM scripts to create a URL monitoring rule and script to do this automatically. Note that the monitoring accounts must be able to access each port to be able to ping them.

If you want to understand the system load and service usage status for each server, you can also monitor the following System Monitor counters.