A few months back I decided that it was time to get rid of unnecessary SharePoint logs since I wasn't into development and event logs were coming sufficient. Just in case you guys are wondering how to enable diagnostic logs, here are the steps: -
1) Open central administration > operations. Click on 'diagnostic logging' under 'Logging and Reporting'.
2) Select 'no' for 'Customer Experience Improvement Program' and 'ignore errors' for 'error reports'. If you wish to throttle (restrict) the events captured, select from category and events to be captured in event logs and trace logs (12 hive).
3) Provide the location for storing these logs. I usually keep 5-10 log files of 10-30 minutes each; otherwise my disk becomes full. As a practice keep logs in a different disk then the MOSS/WSS installation so that disk full issues do not affect the service.
NOTE: there are two types of logs in 12 Hive logs folder (<local-drive>\Program Files\Common Files\Microsoft Shared\web server extensions\12\Logs). The ones sitting outside the GUID folders are used for debugging and called ULS (unified logging service) logs. The ones within the GUID are usage analysis logs.
Anyway, back to my original issue; I happily disabled the logs, however few weeks back decided to re-enable them. And what, did everything as described above and the log files hence created were empty. Hmm, mind boggling; didn't look like a permission issue; still haven' figured out yet; the logs were being constructed but were of 0 KB each; files were empty: -
Things to check in his situtaion: -
- enough disk space.
- check if WSS timer service and WSS tracing service are running. Restart them once again.
- try throttling the events (though this is most unlikely to work out as a solution since you would be restricting logs; exactly the opposite); however it worked for me; I enabled Verbose logging in trace log category of diagnostic logging page and logs started filling up. Whew!! Thank goodness, at least I have some data in logs now. This is a very strange behavior, what you guys should check is if you are throttling anything; remove that selection. For example throttling error events when no errors are there would give empty logs.
If anyone has figured out the solution, do let me know as my system is behaving exactly the opposite. :)