The Problem:
SharePoint 2007 by default stores 48 hours worth of logs in a directory buried in your program files folder (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\LOGS\ !). Very few events get logged to the application event log.
Expect each log file to be at least 200 megs (a log file being generated every 30 minutes by default), or 19 GB of space at the minimum being used by SharePoint logs.
Solutions:
Go to your central administration server web site, and open up the Diagnostic logging:
Central Administration -> Operations -> Logging and Reporting -> Diagnostic logging
In the Diagnostic logging page, focus on the following categories:
- Event throttling: how much you log
- Trace Log: where you store the logs
Event Throttling:
- For a Dev/staging server server, you should log all or "medium events"
- For a Production server, only log errors
- The search crawler will take up most of the log space
Trace Log:
- By Default, logs are sent to: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\LOGS\
- Store the logs on a separate drive so that at worse your drive gets full and your application stops logging, but still functions. It's a pretty standard practice for SQL server installations for instance.
- Reduce the number of log files. The default is two days worth of logging (96 files x 30 min intervals). See if this is too much for you; it might depend on how much you chose to log in the Event Throttling.
