SharePoint Monitoring
Contents
Please find below checklist attached.
What should we monitor in SharePoint Environment?
Start with SharePoint's core dependencies.
Windows
Active Directory
SQL Server
Internet Information Server (IIS)
SharePoint's Timer Service
SharePoint Search
SharePoint Content Databases
Overview of monitoring tools
SharePoint Health Analyzer
Timer Jobs
Reporting
Windows PowerShell
System Center 2012 - Operations Manager with System Center Management Pack for SharePoint Server 2013
Event Viewer
SharePoint Developer Dashboard
Windows Management Instrumentation (WMI)
SQL Server Reporting Services (SSRS)
Scenarios and monitoring tools
The key advantages to daily monitoring are as follows:
See the following sections for information about tasks that you can perform daily:
Weekly Tasks
Monthly Tasks
Other Tasks
Please find below checklist attached.
What should we monitor in SharePoint Environment?
Start with SharePoint's core dependencies.
SharePoint is dependent on services that provide different functions to the core SharePoint services. If any of these core dependencies fails, it will cause SharePoint to cease working and seriously degrade your SharePoint farm's ability to service clients. Above all, you need to ensure that all of the following services are available and that SharePoint is able to leverage them:
Windows
Without Windows, SharePoint wouldn't work at all. So that means you must be vigilant and monitor all event logs to ensure that the OS is performing as expected. Event logs can be a great indicator that patches haven't been applied because errors in the event log will often point to issues with your SharePoint infrastructure.
Active Directory
Whether you use forms-based authentication or Active Directory for authenticating users, Active Directory is a requirement for server-to-server communication. SharePoint uses several service accounts and needs to communicate with AD to validate the credentials it uses for those accounts. The critical accounts include the SharePoint service account and the search account. SharePoint applications may also have unique accounts.
SQL Server
Everything in SharePoint is stored in a SQL database. As a result, if SQL Server ceases to function, SharePoint will quickly follow. So you must ensure that SQL Server is not only functional but that the SharePoint Web Front End can communicate with it as well. Make sure the service accounts that SharePoint uses have the appropriate access to the various databases—primarily the SharePoint_Config database and secondarily the content databases associated with each Web application.
Internet Information Server (IIS)
SharePoint is a Web-based application server. It relies on the IIS configuration and on the service being fully operational. Depending on the complexity of your SharePoint environment, IIS will be configured with one or more application pools and one or more IIS websites.
There may not be a one-to-one relationship between an application pool and website, but central administration and the Shared Services Provider will probably have dedicated application pools—or at least they should in a production environment. Other Web applications, like your main portal site or your My Sites application may or may not have dedicated application pools. This is especially true if you have "extended" Web applications.
SharePoint is a Web-based application server. It relies on the IIS configuration and on the service being fully operational.
Take care to map out the relationships and the corresponding application pool identities. Keeping tabs on their status and response to requests will be key to ensuring SharePoint is available to your end users.
Beyond dependent services, there are a number of direct SharePoint components that are worth monitoring. Like dependent services, all of the following are more or less required for SharePoint's operation:
SharePoint's Timer Service
The "automatic" things that SharePoint does really aren't all that automatic. In fact, many of the processes that occur in a SharePoint environment are the result of the Timer Service and the related timer jobs defined in central administration.
The Timer Service is a true Windows service that is responsible for initiating this job. It generally runs every five minutes, but it could shut down or become inoperable for a few different reasons. Most often it's the result of some authentication problem with the identity it uses. This is a service that you should monitor. If it's not running, it's not likely to be noticed immediately, but when users don't get their alerts, you'll get calls.
SharePoint Search
Even with WSS, SharePoint has a search service running. The WSS search and the add-on MOSS search are used for indexing content as well as importing profile data. If these services are inoperable or inconsistently available, you'll almost immediately begin seeing issues with your farm, ranging from event log entries to inoperable search to your profile imports failing.
If you want to keep your users happy and SharePoint humming along, create a program for monitoring the items identified here. What hasn't been addressed are applications built on SharePoint or key add on tools like backup and recovery programs. All of these elements should also be monitored. Talk to you vendors to understand how these components can be included in your monitoring program.
SharePoint Content Databases
There's a known performance limit for SharePoint's content databases. In general, you shouldn't let these databases exceed 100 GB. Your site won't come crashing to a halt if you exceed that limit, but you will begin to notice performance degradation. Content databases are associated with an application, and you can have multiple data.
Overview of monitoring tools
There are many tools for you to monitor SharePoint 2013 and troubleshoot problems. Different tools cover different aspects of the environment, although there may be overlapped areas. Consider which tools can maximize your monitoring benefits. The following monitoring tools are available:
SharePoint Health Analyzer
On the Central Administration home page, click Monitoring, Health Analyzer. You can use this built-in feature to analyze and resolve problems in the following areas: security, performance, configuration, and availability. Health Analyzer rules are predefined and run at scheduled intervals, such as hourly, daily, weekly, and monthly. If an error is detected, the corresponding rule is triggered. Each rule has a brief explanation about why the error occurs and provides you with a link to a detailed article that contains step-by-step guidance to resolve the problem. When you take actions by following the guidance, you can re-run the rule to verify resolution. If the error does not appear in the list, the problem is resolved.
Timer Jobs
On the Central Administration home page, click Monitoring, Timer Jobs. SharePoint 2013 uses configurable timer jobs to collect health data and then writes the data to the logging folder and to the Logging database. The data is then used in reports to display the health status of the farm servers.
You can reschedule a timer job, enable or disable it, and run it on demand. Daily, weekly, and monthly schedules also include a window of execution. The timer service will select a random time within this interval to start running the timer job on each applicable server. This feature is appropriate for high-load jobs that run on multiple servers on the farm.
NoteNote:
Running timer jobs at the same time on all servers on the farm can affect system performance. You must schedule them carefully to avoid overlap with other timer jobs.
Reporting
On the Central Administration home page, click Monitoring >Reporting. This feature lets you configure diagnostic logging and data collection, and view administrative and health reports. Because some configurations will use up drive space and adversely affect system performance you must carefully plan what configurations to set.
Windows PowerShell
Windows PowerShell is a powerful tool for monitoring SharePoint 2013. You can run commands to obtain the exact logs that you want to view. For more information, see View diagnostic logs in SharePoint 2013.
System Center 2012 - Operations Manager with System Center Management Pack for SharePoint Server 2013
System Center 2012 - Operations Manager is a powerful monitoring platform that lets you monitor services, devices, and operations for many computers in a single console. By using Operations Manager, you can view status, health, performance information, and alerts generated for availability, performance, configuration and security situations. For more information, see Operations Manager (
To use Operations Manager to monitor SharePoint products, you must install System Center Management Pack for SharePoint Server 2013. You can use this tool to monitor events, collect SharePoint component-specific performance counters in one central location, and raise alerts for operator intervention as necessary. Download and install System Center Monitoring Pack for SharePoint Server or System Center Monitoring Pack for SharePoint Foundation.
Event Viewer
Event Viewer is a Microsoft Management Console (MMC) snap-in. It lets you browse and manage event logs. It is a very handy tool for troubleshooting problems. You can filter for specific events across multiple logs, and reuse useful event filters as custom views. For more information, see Event Viewer (
SharePoint Developer Dashboard
This tool provides diagnostic information that can help a developer or system administrator analyze performance of SharePoint Web pages. This utility can help if a page is loading slowly, a Web Part is not performing, or if a database query on the page is not performing. The SharePoint Developer Dashboard is disabled by default. You can enable it by using Windows PowerShell. For more information, see SharePoint Developer Dashboard (
Windows Management Instrumentation (WMI)
WMI provides many classes for you to monitor the SharePoint 2013 environment. For each manageable resource, there is a corresponding WMI class. For more information, see WMI Overview (
SQL Server Reporting Services (SSRS)
SQL Server Reporting Services provides a full range of ready-to-use tools and services to help you create, deploy, and manage reports for your organization. It also has programming features that let you extend and customize reporting functionality. By using SQL Server Reporting Services, you can create interactive, tabular, graphical, or free-form reports from relational, multidimensional, or XML-based data sources. You can publish reports, schedule report processing, or access reports on-demand. You can use SQL Server Reporting Services to create reports based on predefined models, and to interactively explore data within the model. You can select from a variety of viewing formats, export reports to other applications, and subscribe to published reports. The reports that you create can be viewed over a Web-based connection or as part of a Windows application or SharePoint site. For more information, see SQL Server Reporting Services (
Scenarios and monitoring tools
Tool\Scenario / Health / Search / Databases / Performance / Workflows / Virtual environments / Business Data Connectivity / Business Intelligence / Access Services / Farms / Servers / Service applications / Web applicationsSharePoint Health Analyzer / √ / √ / √ / √ / X / X / √ / √ / √ / √ / √ / √ / X
Timer jobs / √ / √ / √ / √ / √ / X / X / √ / X / X / X / √ / √
Reporting / √ / √ / √ / √ / √ / X / √ / √ / √ / √ / √ / √ / X
Windows PowerShell / √ / √ / √ / √ / √ / X / √ / √ / √ / √ / √ / √ / √
System Center 2012 - Operations Manager / √ / √ / √ / √ / X / √ / √ / √ / √ / √ / √ / √ / X
Event Viewer / √ / √ / √ / √ / √ / X / √ / √ / √ / √ / √ / √ / √
SharePoint Developer Dashboard / X / X / X / √* / X / X / X / X / X / X / X / X / X
Windows Management Instrumentation (WMI) / √ / √ / √ / √ / X / √** / X / √ / X / X / √ / X / X
SQL Server Reporting Services / √ / √ / √ / √ / √ / X / √ / √ / √ / √ / √ / √ / √
The key advantages to daily monitoring are as follows:
- Meeting the performance requirements of your service level agreements (SLAs).
- Completing successfully specific administrative tasks, such as daily backup operations, and checking server health.
- And probably the most important one: detecting and addressing issues upfront, such as bottlenecks in the server performance or need for additional resources before they affect productivity.
See the following sections for information about tasks that you can perform daily:
- Performing and Monitoring Backups
- Checking Disk Usage
- Checking the Event Viewer
- Monitoring Server Performance
- Monitoring Network Performance
Performing and Monitoring Backups
SharePoint Server 2010 makes it possible to configure and schedule backups on various levels:
Back up a Web application (
Back up a service application (
Back up a farm configuration (
Back up search (
Back up the Secure Store service (
Back up a content database (
Back up databases to snapshots (
Back up customizations (
Back up a site collection (
Export a site, list, or document library (
Back up or archive logs (
These capabilities mean you can design a backup/restore and disaster recovery strategy that meets the specific requirements of your organization.
Most of these options also provide for two different types of backup:
Full – Complete backup of all the content, including full history.
Differential – Backup of only the content that has changed since the last full backup
Checking Disk Space
SharePoint requires disk space to store its logs, search indexes, SQL Server databases, andSQL Server transaction logs.
You should monitor the amount of disk space available regularly to ensure that serversrunning SharePoint Server or SQL Server databases are not being negatively impacted byinsufficient storage resources.
Checking the Event Viewer
You can use the Event Viewer to obtain information about service failures and warnings about system resources such as virtual memory and disk space. Use the Event Viewer to view and manage event logs; obtain information about hardware, software, and system problems that must be resolved; and identify trends that require future action.
Event Viewer maintains logs about application, security, and system events on your computer. It also provides a central location for installed applications, for example SharePoint Server and SQL Server, to report warnings and error conditions. This makes it vitally important to review event logs daily.
A server that is running a Windows Server 2008 operating system records events by default in three types of logs:
Application logs
The Application log contains events logged by applications or programs. Developers of those applications determine which events to log. For example, a database program might record a file error in the Application log. Most events that are related to SharePoint Server will be found in the Application log.
Security logs
The Security log records events such as successful and unsuccessful logon attempts, as well as events related to resource use such as creating, opening, or deleting files or other objects. For example, if logon auditing is enabled, attempts to log on to the system are recorded in the Security log.
System logs
The System log contains events that Windows system components log. For example, the failure of a driver or other system component to load during start-up is recorded in the System log. The event types logged by system components are predetermined by the server.
Monitoring Server Performance
Monitoring server performance helps to ensure your servers are functioning correctly and allows you to identify bottlenecks in the system. By reviewing and analyzing the data produced by performance monitoring, you can identify problems and apply corrective action. You can also use the monitoring data to further enhance the performance of your servers by identifying areas that need additional resources. For example, you may need to increase your storage capacity to handle the growing number of users in your organization or increase memory when using more SharePoint services.
Task Manager
Task Manager is a Windows Server 2008 tool that provides information about the processes and programs that are running on your local computer. You can use Task Manager to monitor key indicators of your computer's performance in real time.
System Monitor
Using the System Monitor tool, you can define, collect, and view extensive data about the usage of hardware resources and the activity of system services on computers that you administer. System Monitor lets you monitor a single computer or several computers simultaneously. This flexibility can be helpful when you want to locate a problem within your SharePoint farm.
Performance Logs and Alerts
With Performance Logs and Alerts, you can collect performance data automatically from local or remote computers. You simply need to select the counters relevant to the investigation you wish to perform, and a sampling interval. The resulting data can be reviewed by using System Monitor or imported to a spreadsheet or databases for analysis and report generation.
Alerts can also be configured. This is a system-generated event that is triggered when counters that you are tracking perform outside predefined thresholds. When it does you can configure an action to occur, for example have a message be sent, a program executed, or an entry made in the application event log.
Monitoring Network Performance
It is important to monitor your network performance because its performance can affect the performance of your SharePoint Server 2010 environment. You can monitor your network by using the following tools:
Network Monitor
Windows Management Instrumentation (WMI)
Simple Network Management Protocol (SNMP)
You can also use third-party monitoring tools or Microsoft Systems Center Operations Manager (SCOM) to monitor your SharePoint system.
Weekly Tasks
As a best practice, perform the following tasks and procedures weekly:
Archive Event Logs
If event logs are not configured to overwrite events as required, they must be regularly archived and deleted. This action is especially important for security logs, which may be required when investigating attempted security breaches.