SPDocKit Event Collection feature provides continuous load of the SharePoint ULS and Windows Event logs in real-time. If you enable this feature, the SPDocKit Event Collection Service will gather selected events and store them to your disk. SPDocKit Event Viewer presents a centralized place for you to explore, detect and prevent possible issues appearing on your SharePoint farm.
Use this feature to keep multiple farms under control and find problems more easily. Here is how the optimal installation scheme looks like:
1. Install SPDocKit Event Collection Service, preferably to a server that is not part of your SharePoint farm. Run the SPDocKit setup file and select Collection Service feature in an advanced mode. Check system requirements for this server.
2. If you choose to install this feature together with the SPDocKit, navigate to the Monitoring Screen and click Event Collection Configuration button. This will start configuration process of the collection service.
However, if you choose to do a standalone installation of the SPDocKit Event Collection Service, you will need to start the Configuration Wizard manually. Default location of the Configuration Wizard is: C:\Program Files\Acceleratio\SPDocKit\EventCollection\CollectionService\ConfigUtil.exe.
2. SPDocKit Event Collection Configuration window will open.
- Service Account – Service account you specify here will be used to collect the logs from the servers in your farm. You need to ensure the provided account has the following rights:
- Log On As a Service Right – this right will be given to the account automatically by the wizard
- Local administrator on SharePoint servers – account needs to be a member of the Local Administrators group on all SharePoint servers. This is required in order to be able to read SharePoint ULS logs and Windows event logs. For more information about Unified Logging Service (ULS) click here.
- Local administrator on the Local server – account needs to be a member of the Local Administrators group on the server where Event Collection Service is installed.
- SPDocKit Database
- SPDocKit_service_role on an SPDocKit database – provided service account needs to be granted SPDocKit_service_role role on the SPDocKit database.
- Index Location – you need to ensure that the provided service account has write access to the index location directory. The directory for the index must be empty or contain an existing index. It is recommended not to place index to a system drive. Be careful if you plan to use the system drive for index location, as it can be quickly filled up.
- Port To Use – by default port 7895 is set, but you can change it to suit your needs.
- Max Index Size – by default we set this value to 200GB with a maximum of 1TB. Feel free to change it to suit your needs and hardware capabilities.
- If the service determines that the index exceeds the maximum index size, it will stop the event collection. Note that the actual size of the index can vary because of index reorganization and can require up to 3 times the amount of disk space specified here.
3. When you enter all of the required data, click OK and you will receive a message:
If you installed the Event Viewer application on a separate server, you will need this URL to connect to the Event Collection Service. You can copy it to your clipboard by clicking the icon in the right corner.
However, if you have the Event Viewer installed on the same server as a Collection Service, after completing the Event Collection Configuration, the Event Viewer will start automatically.
1. Install SPDocKit Event Viewer, to any server, with or without SPDocKit. Run the SPDocKit setup file and select Event Viewer feature in an advanced mode.
2. If you installed the feature together with the SPDocKit, navigate to the Monitoring Screen and click Start Event Viewer button. This will start Event Viewer application.
However, if you choose to do a standalone installation of the SPDocKit Event Viewer application, you will need to start the Viewer manually. Default location is: C:\Program Files\Acceleratio\SPDocKit\EventCollection\Viewer\SPDocKit Event\Viewer.exe
On the home screen of the SPDocKit Event Viewer, you see the list of available farms. By default, anybody that has the SPDocKit Event Viewer installed and is connected to the Collection Service can view the collected events from all farms. Farms you see here come from the SPDocKit database provided in the Event Collection Service Configuration.
If you wish to restrict access to specific farms, or for specific people, you can do so by using SPDocKit Role Based Security feature. For more information on this feature, please go here.
2. Wait for 5 minutes for SPDocKit Event Collection Service to start indexing gathered logs. Event Viewer is now ready to use.
3. To change the default settings for the SPDocKit Event Viewer click the Settings button located in the top right corner.
3. On the settings screen you can change:
- When you configure SPDocKit Event Collection for the first time, an agent will be associated with all the farms in your SPDocKit Database. If at some point you connect another farm to your SPDocKit Database, it will be associated with the first free active agent.
- Of course, this situation may not be ideal all the time, so you can change the agent for a chosen farm, as you desire. More than one agent can be configured to the same SPDocKit database, but only one to a selected farm.
ULS Collection Configuration
- Here you can change which ULS event levels you want to collect. You can choose from: Unexpected, Monitorable, High, Exception, Medium, Warning, Verbose, Information and Critical.
- All of the ULS categories and sources are preselected by default.
Windows Event Log Collection Configuration
- By default this feature is disabled but you can enable it, by simply checking the box. Window Event Levels you can monitor are: Warning, Verbose, Information, Critical, and Error. If you wish to add new Windows Event Source you can do it by inputting it in the provided field and pressing the plus sign.
4. Agents Screen
- On this screen, you can set Event collection ON or OFF
- If you decide you want to stop the Event collection, you can do so by unchecking the Event collection active – checkbox. This will stop the agent from collecting any logs on any farm.
- Other settings you can change are:
- How often to collect data (default is 15 seconds).
- How long to keep collected data (default is 7 days). This setting serves a critical role in data retention. If you notice your disk to fill up quickly and have no need to keep data for a long period of time, you can set this to a value that best suits your needs. Data retention is executed automatically every day at midnight by SPDocKit Event Collection Service.
- How big can your index get. You already setup this setting in a Configuration Wizard but if you wish to change it, you can do it here.
Information you can see about your agent are:
- Status – it can be Online, Offline or Not Accessible (when the SPDocKit Event Collection Service is offline), and Collection Disabled (when it is not collecting any logs, on any farm).
- Connection URL – an URL you use to connect to the SPDocKit Event Collection Service.
- Events in Index – number of collected and indexed events so far.
- Index Size – current size of the index.
If you wish to completely remove the agent, you must either uninstall Collection Service feature or stop the SPDocKit Event Collection Service by force.
- To remove Collection Service feature, you need to modify your current installation. Navigate to SPDocKit installation file, choose the option Modify Available Options, uncheck the Collection Service feature and finish the wizard.
- If you wish to stop the SPDocKit Event Collection Service go to the Task Manager, right-click the SPDocKit Event Collection Service and click If you prefer you can do the same thing in the Services window.