none
SharePoint 2013 - Raw Error Rate Splunk, Grafana ( ? ) RRS feed

  • Question

  • Hi all,

    I work on an operations team that manages several SP 2013 farms. I've starting working with SharePoint 2013 from a monitoring perspective. I've been tasked to come up with "raw error rate", as a service level indicator as a window to what people's experience with the application has been (in general). "Raw Error Rate” is defined as the [Total Failed Transactions] / [Total Transactions]*100." We have Splunk and Grafana available to us to ingest and track log files and time series data.

    However, I'm unsure of the criteria I should use for this. For example, Splunk can ingest the IIS logs from our web front end servers, and I could use it to search on the unsuccessful responses. But SharePoint's HTTP response may not be based on an actual error. For example, HTTP 401/403 could be an error, or it could be that a user has been denied access to a site, or that the site is locked in Central Administration.

    My difficulty in understanding how to approach this is: for SharePoint, what defines a successful transaction from the user perspective? Is there a way to track this so we can tell where problems might be developing and we can be proactive in fixing them?

    I appreciate your help. Thanks!

    Kevin

    Friday, November 15, 2019 7:36 PM

Answers

  • Hi Kevin,

    For the IIS logs in WFE servers, it always shows http response. To know if it is an actual error, you have to check the uls log to know what actually happens.

    Default path of uls logs:

    %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\15\LOGS\ 

    Best Regards,

    Michael Han


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Monday, November 18, 2019 9:43 AM

All replies

  • Hi Kevin,

    For the IIS logs in WFE servers, it always shows http response. To know if it is an actual error, you have to check the uls log to know what actually happens.

    Default path of uls logs:

    %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\15\LOGS\ 

    Best Regards,

    Michael Han


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Monday, November 18, 2019 9:43 AM
  • Hi Kevin,

    Is there anything update?

    If you think my suggestion is helpful, you could mark it as an answer.

    Best Regards,

    Michael Han


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Tuesday, November 26, 2019 9:54 AM
  • Thanks for the information. It sounds like I have to use both sources to calculate something like a "raw error rate" since IIS logs by themselves do not provide the entire story. 
    Monday, December 2, 2019 9:28 PM