After a short investigation in the Windows Event Logs I find a lot of these entries:
| Log Name: | Microsoft-Windows-Kernel-EventTracing/Admin |
| Source: | Microsoft-Windows-Kernel-EventTracing |
| Date: | 01.1.2013 11:22:33 |
| Event ID: | 2 |
| Task Category: | Session |
| Level: | Error |
| Keywords: | Session |
| User: | <The account running the service application> |
| Computer: | <affected server> |
| Description: | Session "WSSTRACESESSION14" failed to start with the following error: 0xC0000022 |
Poking deeper into the problem, only the new application server was affected. The description states that the WSSTRACESESSION14 ‘failed to start’. This normal happens when the binary is bricked or, what is much more common, there is a security problem. And because the ULS was writing files, I guessed it must be a security issue.
As is turned out the user described in the event log was missing in the local Windows group “Performance Log Users”. I compared the group with working SharePoint server in my farm and added the missing user accounts. Finally I restarted the Timer Service and executed an IISReset. By looking into the directory where the ULS logs are saved it was obvious that the service was working now as expected.
