Configuring logging options

Applies to: Forefront Protection 2010 for SharePoint

You can configure the following logging options for Microsoft Forefront Protection 2010 for SharePoint (FPSP):

• Incident logging

• Writing to the event log

• Performance counter logging

Enabling or disabling incident logging

You can enable or disable incident logging for each scan job type (realtime, scheduled, on-demand). Enabling incident logging allows you to track the performance of FPSP more efficiently. However, disabling incident logging can save you disk space if your resources are limited, provided that you also disable quarantining for that scan job. If you disable incident logging for a scan job but quarantining remains enabled, the incident is still written to the database so that FPSP can quarantine the item. However, the item is not displayed in the Incidents pane.

To enable or disable incident logging options

1. In the Forefront Protection 2010 for SharePoint Administrator Console, click Policy Management, and in Global Settings, click Advanced Options.

2. In the Global Settings - Advanced Options pane, in the Logging options section, disable or enable the following incident logging options by using the check boxes.

   • Enable realtime incident logging—Specifies whether FPSP should enable incident logging for the realtime scan job. By default, realtime incident logging is enabled. To disable the logging of incidents detected during realtime scanning, clear the check box.

   • Enable scheduled incident logging—Specifies whether FPSP should enable incident logging for the scheduled scan job. By default, scheduled incident logging is enabled. To disable the logging of incidents detected during scheduled scanning, clear the check box.

   • Enable on-demand incident logging—Specifies whether FPSP should enable incident logging for the on-demand scan job. By default, on-demand incident logging is enabled. To disable the logging of incidents detected during on-demand scanning, clear the check box.

3. Click Save.

Enabling or disabling writing to the event log

You can enable or disable the writing of events to the event log. You can separately enable or disable event logging for incidents, engines, and operations. By default, event logging is enabled for all events.

To enable or disable writing to the event log

1. In the FPSP Administrator Console, click Policy Management, and in Global Settings, click Advanced Options.

2. In the Global Settings - Advanced Options pane, in the Logging Options section, you can select or clear the Enable event logging check box. By default, this is checked, which allows you to use the associated check boxes to enable or disable the following options, which are enabled by default:

   • Incidents - Enables or disables event logging for incidents.

   • Engines - Enables or disables event logging for engines.

   • Operational - Enables or disables event logging for all other events, such as system information and health events.

   When the Enable event logging check box is cleared, incidents logging is suspended for incidents, engines, and operational events.

3. Click Save.

Enabling or disabling performance counter logging

You can enable or disable the logging of performance counters that can be viewed in Windows Performance Monitor.

To enable or disable performance counter logging

1. In the FPSP Administrator Console, click Policy Management, and in Global Settings, click Advanced Options.

2. In the Global Settings - Advanced Options pane, in the Logging Options section, select or clear the Enable performance counters check box, and then click Save. By default, performance counter logging is enabled.