Tip 16: Moving the Default Logging Location
This tip is for Windows SharePoint Services 2.0/3.0, SharePoint Portal Server 2003 and Microsoft Office SharePoint Server 2007 and may apply to SharePoint Foundation 2010 and SharePoint Server 2010.
SharePoint logs are a great source to find in-depth information on what is going on inside SharePoint at any given time and a great resource when troubleshooting many different issues. That said, the logs can become very large also when the Diagnostic Logging in Central Administration is set to a very verbose level. This can become an issue on some servers because the default location of the logs is the same as the default install location, usually %CommonProgramFiles%Microsoft SharedWeb Server Extensions<Version>LOGS. If the drive that the logs are located at fill up to capacity, then there is a possibility that you will not even be able to login to the machine as when a system drive is full the Local Security Authority Subsystem Service (LSASS) cannot write to the system drive. So how can we mitigate this? We can change the location of the files to another drive so that if the log files do grow large, then it will not affect the base operation of the server. You can do this from Central Administration->Operations ->Diagnostic Logging. Change the Trace Log Path to whatever location you desire, you can also set the number of logs and the time in which each log is used.
One caveat when changing the location of the logs is that if the permissions of the location of the logs change the Psconfig.exe –cmd secureresources command will not update the log permissions so make sure that the permissions of the log file location does not change. Group Policy can be used to set the file system properties and overwrite them if they are changed by an external process.
