I discovered an issue where SharePoint stopped logging to the ULS after I shared the log files directory.
Upon further investigation I found that once I shared the SharePoint log directory via the "share with" command available when right clicking on a folder/file and then selected a particular user or group that SharePoint stops logging anything to the ULS logs.
I ended up finding that when you share a folder via this method there are accounts that are removed from the security on the logs directory.
The following accounts are what is on the SharePoint logs folder by default
SYSTEM
LOCAL SERVICE
WSS_RESTRICTED_WPG_V4
WSS_ADMIN_WPG
WSS_WPG
Administrators
After you share a directory in this method the following accounts are removed from the folder permissions
LOCAL SERVICE
WSS_RESTRICTED_WPG_V4
WSS_ADMIN_WPG
WSS_WPG
The reason logging breaks is because the SharePoint account that writes your logging info is a member of the WSS groups and when they are removed SharePoint can no longer write to the directory. What i found interesting is that there were no errors logged in the event logs and obviously not the ULS logs.
So to avoid this issue when sharing:
- Go to advanced sharing on the sharing tab under folder properties and setup the share from there. From my testing the accounts are not removed when shared this way.
To resolve the issue:
- Either add the individual accounts back to the folder security or go to central admin, change the logging location to a temporary folder, apply setting, then go back into the setting and change it back to the original location. This will also restore the permissions that were removed.
