*insert spooky music*

Ok so here is one that truly shows that I have no social life: a customer once asked me “why can we specify 1 – 30 usage log files, when configuring usage analysis processing?”, the answer to which at that time was “not entirely sure, but I know if you hit 30 it will stop recording usage data" – at least that is what the docs say :)

So, I left it for a while but then a mate asked the same question and days of working with WSS 2.0 started itching in my brain, this is what I found and it is still relevant:

Taken from the following document: http://office.microsoft.com/download/afile.aspx?AssetID=AM102437481033 (modified to be relevant to WSS 3.0 / MOSS 2007):

Inside this folder is a folder for every virtual server named using the Windows SharePoint Services virtual server globally unique identifier (GUID), and under those folders, a different folder for each day will be generated. The path of these folders cannot be modified.

You can configure the limit of logs to be created on a daily basis, with a maximum number of 30 log files. If you set a maximum number of n log files, this applies to each virtual server. This means that the log folders of each of the virtual servers (web applications) will contain at most n log files. In other words, if this number is set to 1 there will be 1 log file for each virtual server. Having many virtual servers (web applications) and having many log files might reduce performance during logging. You should consider increasing the number of log files if a front-end Web server (standalone or member of a Web farm) has log files with more than a million entries.

The front-end Web server might not have enough memory to memory-map a really large log file, which leads to a situation in which the log file might not get processed. Each hit that a front-end Web server receives uses approximately 200 bytes (B) in a log file. As a result, approximately 200 megabytes (MB) of RAM are used to memory-map a log file that contains a million hits. Memory mapping occurs only for several minutes during usage processing. Because log files are processed serially, when you have several log files, a smaller memory footprint results when a log file is processed. 

Windows SharePoint Services logs HTTP 2.x information to the log files and does not log HTTP 3.x or HTTP 4.x information to the log file. When you use multiple log files, the log files are created at the same time, and all hits from one website are contained in the same log file. Usage data for a website is updated one time each day.

The number of requests that are sent to the back-end server during usage processing is proportional to the number of websites on the server. However, the memory footprint on the back-end server is not affected by the number of websites. The additional load that usage processing generates does not significantly affect the performance of the back-end servers on the server farm.


Doug “bobTheBuilder” McCusker