SharePoint 2010 logging levels

According to MSDN “in Microsoft SharePoint Foundation 2010 the preferred method of writing to the Trace Logs is to use the SPDiagnosticsServiceBase class” (http://msdn.microsoft.com/en-us/library/ff512746.aspx).

MSDN also provides some guidance on the trace and event log severity levels to use (http://msdn.microsoft.com/en-us/library/ff604025.aspx), however the WriteEvent() and WriteTrace() methods use slightly different enums; the diagnostics logging configuration in Central Administration is slightly different again, and then you have a third set of values accessed by the PowerShell command Get-SPLogEvent.

The table below shows the mapping of levels from these different sources.

Despite the complicated mapping, in general I think things go in the right direction with events writing to the event log and trace log at the same time, and having a high trace level. The distinction between event logging and trace information is also good, with independently set thresholds.

EventSeverity EventLogEntryType TraceSeverity ULSTraceLevel ULSLogFileProcessor
.TraceLevel
None = 0 None = 0 0 (None) Unassigned = 0
ErrorServiceUnavailable = 10 Error 1 Critical = 1 (or ErrorCritical)
ErrorSecurityBreach = 20
ErrorCritical = 30
Error = 40
Exception = 4
Assert = 6
Warning = 50 Warning 8 Warning = 8
FailureAudit = 60
Unexpected = 10 Unexpected = 10 Unexpected = 10
Monitorable = 15 Monitorable = 15 Monitorable = 15
SuccessAudit = 70 Information 18 Information = 18
Information = 80
Success = 90
Verbose = 100
High = 20 High = 20 High = 20
Medium = 50 Medium = 50 Medium = 50
Verbose = 100 Verbose = 100 Verbose = 100
VerboseEx = 200 VerboseEx = 200 VerboseEx = 200

Continue reading SharePoint 2010 logging levels