Ssrstracelog Review

SSRS Trace Log Review Skill

Purpose

Analyze SQL Server Reporting Services (SSRS) diagnostic artifacts to find why a report server fails to start, can't reach its report server database, runs reports slowly or aborts them, drops subscription deliveries, or fails to join a scale-out deployment. Applies 24 checks (G1–G24) across six categories:

• G1–G4 — Trace configuration and log health: DefaultTraceSwitch level, file size

and retention settings, restart/recycle frequency visible in trace file rollover, and stale component-level trace overrides

• G5–G9 — Startup and report server database connectivity:

rsReportServerDatabaseUnavailable, rsReportServerDatabaseLogonFailed, rsErrorOpeningConnection sub-causes, orphaned database pointers, and rsServerConfigurationError

• G10–G13 — Memory pressure and AppDomain recycling: MemorySafetyMargin /

MemoryThreshold / WorkingSetMaximum configuration, hard recycles from memory allocation failures, and RecycleTime / MaxAppDomainUnloadTime tuning

• G14–G18 — Report processing and rendering: ExecutionLog3 time-phase breakdown,

legacy processing engine usage, rsProcessingAborted and error statuses, and external image fetch latency

• G19–G21 — Subscriptions and delivery: file share and email delivery extension

failures, and subscription scheduling clustering

• G22–G24 — Scale-out and encryption keys: rsInvalidReportServerDatabase after

upgrade, rskeymgmt -j join failures, and missing symmetric key backups

This skill is the SSRS counterpart to sqlerrorlog-review (Database Engine ERRORLOG) — use both together when SSRS symptoms trace back to the report server database engine.

Input

Accept any of:

• Trace log excerpts — ReportServerService_.log or (SSRS 2017+)

Microsoft.ReportingServices.Portal.WebHost_.log content, pasted as text. Lines follow the format !!! : (e.g. library!WindowsService_10!4c7c!05/24/2016-01:05:06 e ERROR: ...)

• ReportingServicesService.exe.config excerpts — the DefaultTraceSwitch value

(in the ` block) plus the section (FileName, FileSizeLimitMb, KeepFilesForDays, TraceListeners, TraceFileMode, and the Components` setting that carries per-component trace overrides)

• RSReportServer.config excerpts — the ` section (MemorySafetyMargin`,

MemoryThreshold, WorkingSetMaximum, WorkingSetMinimum, RecycleTime, MaxAppDomainUnloadTime, PollingInterval, MaxQueueThreads, UrlRoot)

• ExecutionLog3 query output — results of

SELECT * FROM ExecutionLog3 ORDER BY TimeStart DESC against the report server database

• Windows Application Event Log entries for source "Report Server Windows Service" or

"ReportServer" (commonly Event ID 107 and related startup/connectivity events)

• A natural-language description ("SSRS shows 'report server can't open a connection to

the report server database' after a restart")

Where the files live

SQL Server 2016 (default instance MSSQLSERVER):
  Trace logs:   C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\LogFiles\
  Trace config: C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe.config
  Server config: C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\RSReportServer.config

SQL Server Reporting Services 2017+ / Power BI Report Server (standalone installer):
  Trace logs:   C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\LogFiles\
  Trace config: C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin\ReportingServicesService.exe.config
  Server config: C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\RSReportServer.config

Trace logs are created daily starting at the first entry after local midnight (UTC timestamp in the filename) and whenever the service restarts — a burst of new trace log files on the same day is itself a signal (see G3). ExecutionLog3 is a view in the report server database (default name ReportServer).

How to Run

1. Identify the artifact type(s) in the input: trace log lines, trace config XML,

server config XML, ExecutionLog3 rows, Event Log entries, or a mix.

1. Run G1–G4 against ReportingServicesService.exe.config / trace log filenames and

header lines when present.

1. Run G5–G9 against trace log error lines and Event Log entries — search for

rsReportServerDatabaseUnavailable, rsReportServerDatabaseLogonFailed, rsErrorOpeningConnection, rsServerConfigurationError, and Event ID 107 first; these are usually the root cause of "report server unavailable" symptoms.

1. Run G10–G13 against RSReportServer.config `` settings and trace log

lines mentioning AppDomain recycling or memory allocation failures.

1. Run G14–G18 against ExecutionLog3 rows — compute `TimeDataRetrieval +

TimeProcessing + TimeRendering per row and compare to the dominant phase; check Status and AdditionalInfo`.

1. Run G19–G21 against trace log lines from the emailextension or

FileShareDeliveryProvider components, and ExecutionLog3 rows where RequestType = Subscription.

1. Run G22–G24 against trace log lines mentioning rsInvalidReportServerDatabase,

rskeymgmt, or scale-out join attempts.

1. Order findings by causality — a connectivity failure (G5–G9) usually explains

downstream processing/subscription failures (G14–G21); report it as the root cause and the rest as cascade.

1. If a check cannot be evaluated because its artifact is absent, report

"Cannot evaluate — not provided" rather than skipping silently.

---

Thresholds Reference

| Setting / Metric | Default | Notes | |-------------------|---------|-------| | DefaultTraceSwitch | 3 (exceptions, restarts, warnings, status messages) | 4 = verbose, 0 = disabled; lives in ` | | Components (in ) | all | per-component overrides as :, e.g. all:3,RunningJobs:4; components with no level use DefaultTraceSwitch | | FileSizeLimitMb | 32 | per trace log file (0 or negative is treated as 1) | | KeepFilesForDays | 14 | trace log retention (0 or negative is treated as 1) | | TraceFileMode | Unique | one trace log per component per day; do not modify | | MemorySafetyMargin | 80 (% of WorkingSetMaximum) | low/medium pressure boundary | | MemoryThreshold | 90 (% of WorkingSetMaximum) | medium/high pressure boundary; must be > MemorySafetyMargin | | WorkingSetMaximum / WorkingSetMinimum | not set (detected at startup) / 60% of max | KB; absent unless added manually | | RecycleTime | 720 (minutes = 12 hours) | scheduled AppDomain recycle interval | | MaxAppDomainUnloadTime | 30 (minutes) | background AppDomain shutdown wait | | Execution log retention | 60 days | rows older than this are purged nightly | | Report processing phase share | — | one of TimeDataRetrieval/TimeProcessing/TimeRendering consistently > 70% of TimeStart–TimeEnd` for the same report flags that phase |

---

Trace Configuration and Log Health Checks (G1–G4)

G1 — Verbose or Disabled Tracing in Production

• Trigger: ReportingServicesService.exe.config shows verbose tracing sustained

across multiple trace log files with no active investigation — either DefaultTraceSwitch value 4 (in `) **or** the Components setting raising all to level 4 (all:4) — **or** tracing disabled (DefaultTraceSwitch value 0`)

• Severity: Warning
• Fix: Reset DefaultTraceSwitch to the documented default 3 (exceptions, restarts,

warnings, status messages) and Components to all. Verbose mode generates large trace files and should only be enabled temporarily while reproducing an issue, then reverted. Disabling tracing (0) removes the primary diagnostic source for the next incident — Microsoft explicitly recommends against it.

G2 — Trace Log Retention Misconfigured

• Trigger: FileSizeLimitMb or KeepFilesForDays in ReportingServicesService.exe.config

is changed from the documented defaults (32 MB / 14 days) in a way that risks either filling the log volume (very large FileSizeLimitMb combined with high KeepFilesForDays) or losing history needed to investigate intermittent issues (KeepFilesForDays reduced to 1–2)

• Severity: Warning
• Fix: Size retention to the investigation window required (a week of daily logs at

32 MB each is a small footprint). If verbose tracing (G1) is enabled temporarily, also temporarily raise FileSizeLimitMb so a single noisy day doesn't roll multiple files and lose context — then revert both together.

G3 — Frequent Trace Log File Rollover (Service Restarts)

• Trigger: Multiple ReportServerService_.log files with timestamps close

together on the same day (trace logs roll on every service restart, in addition to the daily midnight UTC rollover and FileSizeLimitMb rollover)

• Severity: Warning (Critical if rollovers correlate with user-visible outages)
• Fix: Each unexpected new trace log file is a service restart or AppDomain hard

recycle. Correlate timestamps with G5–G9 (connectivity failures that crash startup) and G12 (memory-pressure hard recycles) to find the trigger. A healthy server shows at most one rollover per day (midnight UTC) plus planned RecycleTime recycles (every 12 hours by default, which do not create a new trace log file — only process restarts do).

G4 — Stale Component-Level Trace Override

• Trigger: the ` Components` setting contains a component-specific trace

level override (e.g. all:3,RunningJobs:4 or all,SemanticQueryEngine:4) that raises a single component above DefaultTraceSwitch, with no corresponding open investigation

• Severity: Info
• Fix: Component overrides left from a past investigation silently keep one subsystem

at verbose logging. Remove the override (reverting that component to DefaultTraceSwitch) once the original issue is resolved — re-add it deliberately the next time that component needs to be debugged.

---

Startup and Report Server Database Connectivity Checks (G5–G9)

G5 — rsReportServerDatabaseUnavailable

• Trigger: Trace log or Event Log contains: *"The report server can't open a

connection to the report server database. A connection to the database is required for all requests and processing. (rsReportServerDatabaseUnavailable)" — or Windows Application Event ID 107, source "Report Server Windows Service": "Report Server Windows Service () can't connect to the report server database."*

• Severity: Critical
• Fix: This is the report server's generic "can't reach my database" error and blocks

every request. Check, in order: (1) is the Database Engine instance hosting the report server database running — hand off to /sqlerrorlog-review if it crashed or is recovering; (2) are TCP/IP and Named Pipes enabled for remote connections on that instance (SSRS uses both); (3) does the connection string in Report Server Configuration Manager's "Database Setup" page still point at a valid server/instance/database name. Re-run the connection through Report Server Configuration Manager rather than editing RSReportServer.config directly — the tool updates dependent settings and restarts the service correctly.

G6 — rsReportServerDatabaseLogonFailed

• Trigger: Trace log contains: *"The report server can't open a connection to the

report server database. The logon failed (rsReportServerDatabaseLogonFailed). Logon failure: unknown user name or bad password."*

• Severity: Critical
• Fix: The domain account used for the report server database connection has an

expired/changed password or has been locked out. Update the credential through Report Server Configuration Manager's "Database Setup" page (do not edit the connection string directly — passwords are encrypted with the report server's symmetric key, see G24). If the account is a gMSA, verify the report server host still has rights to retrieve the managed password.

G7 — rsErrorOpeningConnection Sub-Causes

• Trigger: Trace log shows rsErrorOpeningConnection together with an inner

SqlException / SQL Server Network Interfaces error, most commonly "error: 26 - Error Locating Server/Instance Specified"

• Severity: Critical
• Fix: Error 26 means the connection string's server\instance name can't be resolved —

check the SQL Server Browser service is running (for named instances), the instance name in the connection string matches @@SERVERNAME, and firewall rules allow the SQL Server port (or UDP 1434 for the Browser service) from the report server host. Also confirm the Database Engine service account's password hasn't expired — an expired account password can surface here as a generic network/instance-location error rather than an auth error. Cross-check with /sqlspn-review if the report server and database engine are on different hosts and Kerberos is in use.

G8 — Orphaned Report Server Database Pointer

• Trigger: Repeated SQL Server login failures (Error 18456) for the SSRS service

account against a ReportServer$ (or similarly named) database that does not exist on the target instance, while the SSRS service itself reports starting successfully

• Severity: Warning
• Fix: The SSRS service is configured to use a report server database that was never

created or has since been dropped/renamed, and polls it continuously (e.g. via PollingInterval), generating a steady stream of failed-login noise in the Database Engine's ERRORLOG and security logs (visible from /sqlerrorlog-review E-checks for login failure bursts). Either point the instance at a valid report server database via Report Server Configuration Manager, or — if this SSRS instance is unused — disable or uninstall the service to stop the noise.

G9 — rsServerConfigurationError

• Trigger: Trace log or Windows application log contains *"The report server

encountered a configuration error. (rsServerConfigurationError)"* — typically immediately following a manual edit of RSReportServer.config or RSReportDesigner.config

• Severity: Critical
• Fix: A configuration file is missing, unreadable, or contains an invalid/missing

XML element value that is critical to server operation (malformed XML stops startup entirely; an invalid non-critical value falls back to an internal default and is logged to the trace log instead). The accompanying second message states the actual cause — read the lines immediately following the rsServerConfigurationError entry. If this began after a manual edit, revert the change (restore from backup if available) per Microsoft's guidance for RSReportServer.config. Validate any setting changes against the RsReportServer.config configuration file reference before re-applying.

---

Memory Pressure and AppDomain Recycling Checks (G10–G13)

G10 — MemorySafetyMargin / MemoryThreshold Misconfigured

• Trigger: RSReportServer.config ` section sets MemoryThreshold` ≤

MemorySafetyMargin, or either value is set outside a sane 0–100 percent range

• Severity: Critical
• Fix: MemoryThreshold (default 90) must be greater than MemorySafetyMargin

(default 80) — both are percentages of WorkingSetMaximum that define the low/medium/high memory-pressure boundaries. If the values are inverted or equal, the report server's pressure-response logic is undefined. Restore the documented defaults unless there is a specific, documented reason (e.g. lowering MemorySafetyMargin to react earlier to sudden processing-load spike

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vanterx
• Source: vanterx/mssql-performance-skills
• License: MIT

Install and usage instructions live in the source repository linked above.