Set up and configure SPDiag

Applies To: Office SharePoint Server 2007

This Office product will reach end of support on October 10, 2017. To stay supported, you will need to upgrade. For more information, see , Resources to help you upgrade your Office 2007 servers and clients.


Topic Last Modified: 2016-11-14

Read this section for information about SPDiag configuration details and how to configure farm servers for the troubleshooting process. Read the appropriate "Installing SharePoint Administration Toolkit" topic for installation details.

Configuring SPDiag

After you open a new SPDiag project, and before you begin collecting data with SPDiag, you should use the Options dialog box to configure the tool. In most cases, the default values will work, but if the locations of performance monitor files or IIS log files have been changed from their default locations on any of the servers in the farm, you can specify their locations here.

You can also specify a network share from which to collect log files if you have a log file archive on the network.

Files tab

On the Files tab, you can set the locations of data files that SPDiag uses to collect information. Note that for each server, you must specify the exact local path to the folders containing the log files. You can add multiple paths with each entry separated by a semicolon. SPDiag does not search recursively, so any subdirectories containing log files must be added explicitly.

  • Select server: Use this field to select the Web server on which you wish to specify file locations.

  • Performance counter file location: Use this field to set the path for the performance counter files on the Web server.

  • IIS log file location: Use this field to set the path for the IIS log files on the server.

Misc tab

On the Misc tab, you can set various options for collected information.

  • Log upload speed: Use this field to specify the rate at which logs will be uploaded to the project database. The following table displays the available settings.




    Collects data from one server at a time.


    Collects data from up to 5 servers simultaneously. This is the default.


    Collects data from up to 10 servers simultaneously.

    If you are using the farm’s database server to store the project database, you should use Low or Medium to reduce the performance impact on the database server. If you are using a dedicated SQL Server to host the project database, you can use High for maximum performance.

    If you want to change the log upload speed after data collection has begun, you can click Cancel in the data collection notification window, change the log upload speed, and restart data collection.

  • Max number of rows in custom reports: Use this field to specify the number of rows you wish to display in customer reports that you generate. The default is 100 rows.

  • Max number of rows in merged logs: Use this field to specify the number of rows you wish to collect from all log files that are included in the project. The default is 50,000 rows.

  • Performance counter time interval (in seconds): Use this field to specify the refresh rate of performance counters used for data collection. The default is 5 seconds.


    This setting does not affect the refresh rate for data collected through Live Capture. See the "Collecting performance counter data using Live Capture" section later in this article for more information.

Configuring the farm servers

Before you begin using SPDiag, you must ensure that the servers in the farm are configured to provide the data required by SPDiag.

While most of the data needed for troubleshooting is logged by default on farm servers, there are certain data points that must be manually configured.

Configuring performance counters

Before you use SPDiag to collect data from farm servers, you can use the Performance Monitor snap-in (Perfmon.msc) to create a binary (.blg) PerfMon logs on your farm servers. SPDiag can collect data from any .blg files it finds in the performance counter file location you specified for each farm server.

When you are troubleshooting a SharePoint farm, it is helpful to log a wide spectrum of performance data, especially processor and memory usage, disk I/O, and important IIS counters. If possible, log any performance counters that might contain useful information on every farm server over a period of time sufficient to capture measurements that span both peak and off-peak farm usage.

You can also use SPDiag’s Live Capture feature to create data collector sets on farm servers. See Collecting performance counter data using Live Capture later in this article for more information.

Configuring IIS logs

SPDiag collects information from the IIS logs on Web servers in the farm. IIS logs most of the required information by default, but SPDiag requires certain data that is not logged by default.

Use the information in this section to make sure that IIS is correctly configured.

The IIS logs should be checked to assure that logs are created in the W3C Extended Log Format (IIS default), and that all the fields needed to create reports, as shown in the table below, are present in the logs. If the format of the logs is not W3C, then you can use LogParser.exe to manually convert the logs to the W3C format.


SPDiag assumes that IIS log files are collected in UTC time, while all other logs represent local server time. If you have to convert your logs to W3C, IIS logs are imported into LogParser in UTC. Therefore, before collecting converted IIS logs with SPDiag, you should convert all time records in the log files to UTC.

The following table displays the IIS log fields that are commonly used for troubleshooting, and indicates whether they are logged by default and whether they are required for SPDiag troubleshooting.


Appears as


Logged by default?


Time taken


The length of time that the action took, in milliseconds.

Note that this is a required field for SPDiag troubleshooting, and is not enabled by default.





The host header name, if any.

Note that this is a required field for SPDiag troubleshooting, and is not enabled by default.





The date on which the activity occurred.





The time, in coordinated universal time (UTC), at which the activity occurred.



Client IP address


The IP address of the client that made the request.





The requested action, for example, a GET method.



URI stem


The target of the action, for example, default.htm.



URI query


The query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is only necessary for dynamic pages.



HTTP status


The HTTP status code.



User agent


The browser type or other client from which the request originated.



User name


The name of the authenticated user who accessed your server. Anonymous users are indicated by a hyphen.



Server IP address


The IP address of the server on which the log file entry was generated.



Server port


The server port number that is configured for the service.



Protocol substatus


The substatus error code.



Service Name and Instance Number


The Internet service name and instance number that was running on the client.



Server name


The name of the server on which the log file entry was generated.



Win32 status


The Windows status code.



Bytes sent


The number of bytes sent by the server.



Bytes received


The number of bytes received by the server.



Protocol version


The protocol version —HTTP or FTP —that the client used.





The content of the cookie sent or received, if any.





The site that the user last visited. This site provided a link to the requested site.



Because SPDiag collects IIS log data from existing IIS log files, it is recommended that you enable any IIS log fields listed in this table that are not already being logged on the Web servers in your farm before running SPDiag. If you elect to enable a specific IIS log field, you should enable it on all Web servers in the farm.


If the IIS logs are missing required fields, you can manually configure IIS to add the fields. If you choose not to add the required fields, some reports will not be complete. A red circle with an exclamation point will appear at the top of the Consolidated Logs View pane if the collected logs are incomplete. You can check the SPDiag trace log in the SPDiag installation folder (by default, C:\Program Files\Microsoft\SPAdministrationToolkit\SharePoint Diagnostics\SPDiag.log) for more information.

Configuring the SQL Server project database

The SharePoint Diagnostic tool uses a SQL Server 2005 or SQL Server 2008 database as a repository for collected data. Although you can use the SQL Server used by the SharePoint farm, we recommend you do so only if you are certain the server has sufficient resources, or you are using SPDiag during off-peak hours.

Each logical project has a single project database that can contain up to seven days of data. In large farm environments, this can represent a large volume of data, and the collection and retrieval processes can take hours and consume significant resources on the project database and on the network between the SPDiag tool and the project database server. For this reason, you should employ a separate database server for use as an SPDiag project data repository, unless the farm’s database server has the capacity to handle the extra load without causing performance issues for farm users.

The SPDiag user must have create permissions on the project database server instance. When a new project is created in SPDiag, a new project database is automatically created on the database server in the context of the user’s domain account.

If you are planning to create SPDiag project databases on a database server in a different domain than your user account, or if Active Directory is not used in your environment, ensure that your account has the appropriate privileges to authenticate to the SQL Server database.

To download a trial version of SQL Server 2005, see Download SQL Server 2005 Trial Software (