Living a SharePoint life

Tuesday, October 1, 2013

Help! My ULS Logs are empty. What shall I do?

A few weeks ago we added a new dedicated application server to an existing farm. Everything seemed fine so far until a coworker called and informed me that the ULS wasn’t writing information to the log files. In fact the files were created but in the end no content was written to them.

After a short investigation in the Windows Event Logs I find a lot of these entries:

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 01.1.2013 11:22:33
Event ID: 2
Task Category: Session
Level: Error
Keywords: Session
User: <The account running the service application>
Computer: <affected server>
Description: Session "WSSTRACESESSION14" failed to start with the following error: 0xC0000022

Poking deeper into the problem, only the new application server was affected. The description states that the WSSTRACESESSION14 ‘failed to start’. This normal happens when the binary is bricked or, what is much more common, there is a security problem. And because the ULS was writing files, I guessed it must be a security issue.

As is turned out the user described in the event log was missing in the local Windows group “Performance Log Users”. I compared the group with working SharePoint server in my farm and added the missing user accounts. Finally I restarted the Timer Service and executed an IISReset. By looking into the directory where the ULS logs are saved it was obvious that the service was working now as expected.

Featured Post

How are Microsoft Search quota consumed?

With Office 365 Search, Microsoft has created a central entry point for the modern workplace. In one convenient spot, users can access all ...