SharePoint 2010 Troubleshooting: Tracing Service failed to create the trace log file. Error 5: Access is denied.

Issue

We have certainly noticed that SharePoint diagnostics logs had stopped working and have seen Event ID 5401 and 6457.

---

Background

 We have SharePoint Server 2010 running on Windows Server 2008, since few months Diagnostics logs were not being captured.
We did notice it when we try to get the logs for the some other troubleshooting.
The Diagnostics Logs folder was empty.

---

Error

Event ID’s 5401 and 5457 were reported thoroughly. In our event logs.

Event ID 5401

Log Name: Application
Source: Windows SharePoint Services 3
Date: 03/09/2014 14:48:09
Event ID: 5401
Task Category: Unified Logging Service
Level: Error
Keywords: Classic
User: N/A
Computer: <Compute Name>
Description:
Tracing Service failed to create the trace log file at <’Location of the logs folder’>. Error 5: Access is denied.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
 <Provider Name="Windows SharePoint Services 3" />
 <EventID Qualifiers="0">5401</EventID>
 <Level>2</Level>
 <Task>301</Task>
 <Keywords>0x80000000000000</Keywords>
 <TimeCreated SystemTime="2014-09-03T13:48:09.000000000Z" />
 <EventRecordID>47490</EventRecordID>
 <Channel>Application</Channel>
 <Computer><Computer Name></Computer>
 <Security />
 </System>
 <EventData>
 <Data>D:\Test</Data>
 <Data>5</Data>
 <Data>Access is denied.
</Data>
</EventData>
</Event>

Event ID 6457

Log Name: Application
Source: Windows SharePoint Services 3
Date: 03/09/2014 14:45:10
Event ID: 6457
Task Category: Unified Logging Service
Level: Error
Keywords:      Classic
User: N/A
Computer: <Computer Name>
Description:
Not enough free disk space available. The tracing service has temporary stopped outputting trace messages to the log file. Tracing will resume when more than 220 MB of disk space becomes available.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
 <Provider Name="Windows SharePoint Services 3" />
 <EventID Qualifiers="0">6457</EventID>
 <Level>2</Level>
 <Task>301</Task>
 <Keywords>0x80000000000000</Keywords>
 <TimeCreated SystemTime="2014-09-03T13:45:10.000000000Z" />
 <EventRecordID>47489</EventRecordID>
 <Channel>Application</Channel>
 <Computer>><Computer Name></</Computer>
 <Security />
 </System>
 <EventData>
 <Data>220</Data>
 </EventData>
</Event>

---

Troubleshooting

Restarted the tracing service on all WFE’s and index server, but it did not help.
Checked the disk space on the server and we had ample space on the drives.
Have followed the steps given in the TechNet article http://technet.microsoft.com/en-us/library/cc561048(v=office.12).aspx, but it did not help as well.
Created a Test folder and tried to update the location in Central admin diagnostics tab but was stil having the same issue.

---

Resolution

Looking at the access denied part reported in the event viewer. We have compared the setting of the Diagnostic folder with other platforms we have and noticed that the account under which tracing services was running was not added.
That account was Local Service account (may be different based on how your environment is set-up).
Added the LOCAL SERVICE account with correct level of permissions and restarted the tracing service and it did fixed the issue i.e. logs started to generate.
If you have any queries, please post in the comments below. I will be happier to help you.

---

Applies to:

• SharePoint Server 2010
• Windows Server 2008 R2

---