How do I instrument an on-prem SharePoint 2016 cluster?

There are several log files including diagnostic, trace, event, audit, and usage that can be monitored using the FileFollower ingester for windows

Sharepoint has a few different logging locations, some of them are on disk in %commonprogramfiles%/Microsoft Shared/web server extensions/<VERSION>/Logs.

There are several log files in there including diagnostic, trace, event, audit, and usage. These logs can be monitored using the FileFollower ingester for windows:

Docs: https://docs.gravwell.io/docs/#!ingesters/file_follow.md

Download: https://update.gravwell.io/files/gravwell_file_follow_3.2.2.msi

The sharepoint logs can then be assigned to specific tags and processed for metrics, diagnostics, etc. like any other source.

Still having some trouble? Reach out to support@gravwell.io with any questions.