While troubleshooting a Records Center Routing Rule Event Receiver issue recently, I ran into a problem whereby ULS was apparently erroring when trying to log errors to the Application event log on the server. (So this error ended up masking the “real”\underlying error). The error ULS was throwing was “The Records Center refused the submission. There was an error routing the file: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.” Turns out, this issue arises when you configure SharePoint to run in a “least privileged” type scenario whereby the service account and/or IIS app pool account isn’t a member of the local Administrators group.
The resolution, the steps of which I’ve added to my standard SharePoint Installation Guide, is below:
The following steps should be performed on each SharePoint front end web server:
1. Open RegEdit and navigate to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key.
2. Grant each SharePoint Application Pool Identity Full Control of the EventLog node and the Security child node.
3. Exit RegEdit and perform an IISRESET /NOFORCE . |