Home
  •  

Unable To Write To Trace Log

Microsoft.SharePoint.2016.Unable_to_write_to_trace_log (Rule)

This Rule collects data when the SharePoint cannot write to the Windows Trace log. This can happen because the hard drive on which the Trace log is located is full or the permissions on the trace logging directory are not set correctly.

Knowledge Base article:

Summary

To get the most current Knowledge Article from the Microsoft TechNet site, visit:

http://go.microsoft.com/fwlink/?LinkId=245017

Causes

View all current alerts from this object using this link:

View Alerts

Element properties:

TargetMicrosoft.SharePoint.2016.SPServiceInstance.Trace
CategoryEventCollection
EnabledTrue
Event_ID5401
Event SourceMicrosoft-SharePoint Products-SharePoint Foundation
Alert GenerateFalse
RemotableTrue
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.SharePoint.2016.Unable_to_write_to_trace_log" Enabled="true" Target="MOSS16Core!Microsoft.SharePoint.2016.SPServiceInstance.Trace" ConfirmDelivery="false" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">5401</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-SharePoint Products-SharePoint Foundation</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>