# Ssrstracelog Review

> Analyze SQL Server Reporting Services (SSRS) report server trace logs, RSReportServer.config / ReportingServicesService.exe.config excerpts, ExecutionLog3 query output, and related Windows Event Log entries to diagnose failed report server startups, database connectivity errors, memory pressure and AppDomain recycling, slow or aborted report processing, subscription delivery failures, and scale-o…

- **Type:** Skill
- **Install:** `agentstack add skill-vanterx-mssql-performance-skills-ssrstracelog-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vanterx](https://agentstack.voostack.com/s/vanterx)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vanterx](https://github.com/vanterx)
- **Source:** https://github.com/vanterx/mssql-performance-skills/tree/main/skills/ssrstracelog-review

## Install

```sh
agentstack add skill-vanterx-mssql-performance-skills-ssrstracelog-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SSRS Trace Log Review Skill

## Purpose

Analyze SQL Server Reporting Services (SSRS) diagnostic artifacts to find why a report
server fails to start, can't reach its report server database, runs reports slowly or
aborts them, drops subscription deliveries, or fails to join a scale-out deployment.
Applies 24 checks (G1–G24) across six categories:

- **G1–G4** — Trace configuration and log health: `DefaultTraceSwitch` level, file size
  and retention settings, restart/recycle frequency visible in trace file rollover, and
  stale component-level trace overrides
- **G5–G9** — Startup and report server database connectivity:
  `rsReportServerDatabaseUnavailable`, `rsReportServerDatabaseLogonFailed`,
  `rsErrorOpeningConnection` sub-causes, orphaned database pointers, and
  `rsServerConfigurationError`
- **G10–G13** — Memory pressure and AppDomain recycling: `MemorySafetyMargin` /
  `MemoryThreshold` / `WorkingSetMaximum` configuration, hard recycles from memory
  allocation failures, and `RecycleTime` / `MaxAppDomainUnloadTime` tuning
- **G14–G18** — Report processing and rendering: `ExecutionLog3` time-phase breakdown,
  legacy processing engine usage, `rsProcessingAborted` and error statuses, and external
  image fetch latency
- **G19–G21** — Subscriptions and delivery: file share and email delivery extension
  failures, and subscription scheduling clustering
- **G22–G24** — Scale-out and encryption keys: `rsInvalidReportServerDatabase` after
  upgrade, `rskeymgmt -j` join failures, and missing symmetric key backups

This skill is the SSRS counterpart to `sqlerrorlog-review` (Database Engine ERRORLOG) —
use both together when SSRS symptoms trace back to the report server database engine.

## Input

Accept any of:

- **Trace log excerpts** — `ReportServerService_.log` or (SSRS 2017+)
  `Microsoft.ReportingServices.Portal.WebHost_.log` content, pasted as text.
  Lines follow the format
  `!!!  : `
  (e.g. `library!WindowsService_10!4c7c!05/24/2016-01:05:06 e ERROR: ...`)
- **`ReportingServicesService.exe.config`** excerpts — the `DefaultTraceSwitch` value
  (in the `` block) plus the `` section
  (`FileName`, `FileSizeLimitMb`, `KeepFilesForDays`, `TraceListeners`, `TraceFileMode`,
  and the `Components` setting that carries per-component trace overrides)
- **`RSReportServer.config`** excerpts — the `` section (`MemorySafetyMargin`,
  `MemoryThreshold`, `WorkingSetMaximum`, `WorkingSetMinimum`, `RecycleTime`,
  `MaxAppDomainUnloadTime`, `PollingInterval`, `MaxQueueThreads`, `UrlRoot`)
- **`ExecutionLog3` query output** — results of
  `SELECT * FROM ExecutionLog3 ORDER BY TimeStart DESC` against the report server database
- **Windows Application Event Log entries** for source "Report Server Windows Service" or
  "ReportServer" (commonly Event ID 107 and related startup/connectivity events)
- A natural-language description ("SSRS shows 'report server can't open a connection to
  the report server database' after a restart")

### Where the files live

```
SQL Server 2016 (default instance MSSQLSERVER):
  Trace logs:   C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\LogFiles\
  Trace config: C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe.config
  Server config: C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\RSReportServer.config

SQL Server Reporting Services 2017+ / Power BI Report Server (standalone installer):
  Trace logs:   C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\LogFiles\
  Trace config: C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\bin\ReportingServicesService.exe.config
  Server config: C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\RSReportServer.config
```

Trace logs are created daily starting at the first entry after local midnight (UTC
timestamp in the filename) and whenever the service restarts — a burst of new trace log
files on the same day is itself a signal (see G3). `ExecutionLog3` is a view in the report
server database (default name `ReportServer`).

## How to Run

1. **Identify the artifact type(s)** in the input: trace log lines, trace config XML,
   server config XML, `ExecutionLog3` rows, Event Log entries, or a mix.
2. **Run G1–G4** against `ReportingServicesService.exe.config` / trace log filenames and
   header lines when present.
3. **Run G5–G9** against trace log error lines and Event Log entries — search for
   `rsReportServerDatabaseUnavailable`, `rsReportServerDatabaseLogonFailed`,
   `rsErrorOpeningConnection`, `rsServerConfigurationError`, and Event ID 107 first; these
   are usually the root cause of "report server unavailable" symptoms.
4. **Run G10–G13** against `RSReportServer.config` `` settings and trace log
   lines mentioning AppDomain recycling or memory allocation failures.
5. **Run G14–G18** against `ExecutionLog3` rows — compute `TimeDataRetrieval +
   TimeProcessing + TimeRendering` per row and compare to the dominant phase; check
   `Status` and `AdditionalInfo`.
6. **Run G19–G21** against trace log lines from the `emailextension` or
   `FileShareDeliveryProvider` components, and `ExecutionLog3` rows where
   `RequestType = Subscription`.
7. **Run G22–G24** against trace log lines mentioning `rsInvalidReportServerDatabase`,
   `rskeymgmt`, or scale-out join attempts.
8. **Order findings by causality** — a connectivity failure (G5–G9) usually explains
   downstream processing/subscription failures (G14–G21); report it as the root cause and
   the rest as cascade.
9. If a check cannot be evaluated because its artifact is absent, report
   "Cannot evaluate —  not provided" rather than skipping silently.

---

## Thresholds Reference

| Setting / Metric | Default | Notes |
|-------------------|---------|-------|
| `DefaultTraceSwitch` | `3` (exceptions, restarts, warnings, status messages) | `4` = verbose, `0` = disabled; lives in `` |
| `Components` (in ``) | `all` | per-component overrides as `:`, e.g. `all:3,RunningJobs:4`; components with no level use `DefaultTraceSwitch` |
| `FileSizeLimitMb` | 32 | per trace log file (0 or negative is treated as 1) |
| `KeepFilesForDays` | 14 | trace log retention (0 or negative is treated as 1) |
| `TraceFileMode` | `Unique` | one trace log per component per day; do not modify |
| `MemorySafetyMargin` | 80 (% of `WorkingSetMaximum`) | low/medium pressure boundary |
| `MemoryThreshold` | 90 (% of `WorkingSetMaximum`) | medium/high pressure boundary; must be > `MemorySafetyMargin` |
| `WorkingSetMaximum` / `WorkingSetMinimum` | not set (detected at startup) / 60% of max | KB; absent unless added manually |
| `RecycleTime` | 720 (minutes = 12 hours) | scheduled AppDomain recycle interval |
| `MaxAppDomainUnloadTime` | 30 (minutes) | background AppDomain shutdown wait |
| Execution log retention | 60 days | rows older than this are purged nightly |
| Report processing phase share | — | one of `TimeDataRetrieval`/`TimeProcessing`/`TimeRendering` consistently > 70% of `TimeStart`–`TimeEnd` for the same report flags that phase |

---

## Trace Configuration and Log Health Checks (G1–G4)

### G1 — Verbose or Disabled Tracing in Production
- **Trigger:** `ReportingServicesService.exe.config` shows verbose tracing sustained
  across multiple trace log files with no active investigation — either
  `DefaultTraceSwitch` value `4` (in ``) **or** the
  `` `Components` setting raising `all` to level 4 (`all:4`) — **or** tracing
  disabled (`DefaultTraceSwitch` value `0`)
- **Severity:** Warning
- **Fix:** Reset `DefaultTraceSwitch` to the documented default `3` (exceptions, restarts,
  warnings, status messages) and `Components` to `all`. Verbose mode generates large trace
  files and should only be enabled temporarily while reproducing an issue, then reverted.
  Disabling tracing (`0`) removes the primary diagnostic source for the next incident —
  Microsoft explicitly recommends against it.

### G2 — Trace Log Retention Misconfigured
- **Trigger:** `FileSizeLimitMb` or `KeepFilesForDays` in `ReportingServicesService.exe.config`
  is changed from the documented defaults (32 MB / 14 days) in a way that risks either
  filling the log volume (very large `FileSizeLimitMb` combined with high
  `KeepFilesForDays`) or losing history needed to investigate intermittent issues
  (`KeepFilesForDays` reduced to 1–2)
- **Severity:** Warning
- **Fix:** Size retention to the investigation window required (a week of daily logs at
  32 MB each is a small footprint). If verbose tracing (G1) is enabled temporarily, also
  temporarily raise `FileSizeLimitMb` so a single noisy day doesn't roll multiple files
  and lose context — then revert both together.

### G3 — Frequent Trace Log File Rollover (Service Restarts)
- **Trigger:** Multiple `ReportServerService_.log` files with timestamps close
  together on the same day (trace logs roll on every service restart, in addition to the
  daily midnight UTC rollover and `FileSizeLimitMb` rollover)
- **Severity:** Warning (Critical if rollovers correlate with user-visible outages)
- **Fix:** Each unexpected new trace log file is a service restart or AppDomain hard
  recycle. Correlate timestamps with G5–G9 (connectivity failures that crash startup) and
  G12 (memory-pressure hard recycles) to find the trigger. A healthy server shows at most
  one rollover per day (midnight UTC) plus planned `RecycleTime` recycles (every 12 hours
  by default, which do **not** create a new trace log file — only process restarts do).

### G4 — Stale Component-Level Trace Override
- **Trigger:** the `` `Components` setting contains a component-specific trace
  level override (e.g. `all:3,RunningJobs:4` or `all,SemanticQueryEngine:4`) that raises a
  single component above `DefaultTraceSwitch`, with no corresponding open investigation
- **Severity:** Info
- **Fix:** Component overrides left from a past investigation silently keep one subsystem
  at verbose logging. Remove the override (reverting that component to
  `DefaultTraceSwitch`) once the original issue is resolved — re-add it deliberately the
  next time that component needs to be debugged.

---

## Startup and Report Server Database Connectivity Checks (G5–G9)

### G5 — rsReportServerDatabaseUnavailable
- **Trigger:** Trace log or Event Log contains: *"The report server can't open a
  connection to the report server database. A connection to the database is required for
  all requests and processing. (rsReportServerDatabaseUnavailable)"* — or Windows
  Application Event ID **107**, source "Report Server Windows Service": *"Report Server
  Windows Service () can't connect to the report server database."*
- **Severity:** Critical
- **Fix:** This is the report server's generic "can't reach my database" error and blocks
  every request. Check, in order: (1) is the Database Engine instance hosting the report
  server database running — hand off to `/sqlerrorlog-review` if it crashed or is
  recovering; (2) are TCP/IP and Named Pipes enabled for remote connections on that
  instance (SSRS uses both); (3) does the connection string in Report Server Configuration
  Manager's "Database Setup" page still point at a valid server/instance/database name.
  Re-run the connection through Report Server Configuration Manager rather than editing
  `RSReportServer.config` directly — the tool updates dependent settings and restarts the
  service correctly.

### G6 — rsReportServerDatabaseLogonFailed
- **Trigger:** Trace log contains: *"The report server can't open a connection to the
  report server database. The logon failed (rsReportServerDatabaseLogonFailed). Logon
  failure: unknown user name or bad password."*
- **Severity:** Critical
- **Fix:** The domain account used for the report server database connection has an
  expired/changed password or has been locked out. Update the credential through Report
  Server Configuration Manager's "Database Setup" page (do not edit the connection string
  directly — passwords are encrypted with the report server's symmetric key, see G24).
  If the account is a gMSA, verify the report server host still has rights to retrieve the
  managed password.

### G7 — rsErrorOpeningConnection Sub-Causes
- **Trigger:** Trace log shows `rsErrorOpeningConnection` together with an inner
  `SqlException` / `SQL Server Network Interfaces` error, most commonly *"error: 26 -
  Error Locating Server/Instance Specified"*
- **Severity:** Critical
- **Fix:** Error 26 means the connection string's server\instance name can't be resolved —
  check the SQL Server Browser service is running (for named instances), the instance name
  in the connection string matches `@@SERVERNAME`, and firewall rules allow the SQL Server
  port (or UDP 1434 for the Browser service) from the report server host. Also confirm the
  Database Engine service account's password hasn't expired — an expired account password
  can surface here as a generic network/instance-location error rather than an auth error.
  Cross-check with `/sqlspn-review` if the report server and database engine are on
  different hosts and Kerberos is in use.

### G8 — Orphaned Report Server Database Pointer
- **Trigger:** Repeated SQL Server login failures (Error 18456) for the SSRS service
  account against a `ReportServer$` (or similarly named) database that does
  not exist on the target instance, while the SSRS service itself reports starting
  successfully
- **Severity:** Warning
- **Fix:** The SSRS service is configured to use a report server database that was never
  created or has since been dropped/renamed, and polls it continuously (e.g. via
  `PollingInterval`), generating a steady stream of failed-login noise in the Database
  Engine's ERRORLOG and security logs (visible from `/sqlerrorlog-review` E-checks for
  login failure bursts). Either point the instance at a valid report server database via
  Report Server Configuration Manager, or — if this SSRS instance is unused — disable or
  uninstall the service to stop the noise.

### G9 — rsServerConfigurationError
- **Trigger:** Trace log or Windows application log contains *"The report server
  encountered a configuration error. (rsServerConfigurationError)"* — typically
  immediately following a manual edit of `RSReportServer.config` or `RSReportDesigner.config`
- **Severity:** Critical
- **Fix:** A configuration file is missing, unreadable, or contains an invalid/missing
  XML element value that is critical to server operation (malformed XML stops startup
  entirely; an invalid non-critical value falls back to an internal default and is logged
  to the trace log instead). The accompanying second message states the actual
  cause — read the lines immediately following the `rsServerConfigurationError` entry. If this
  began after a manual edit, revert the change (restore from backup if available) per
  Microsoft's guidance for `RSReportServer.config`. Validate any setting changes against
  the [RsReportServer.config configuration file reference](https://learn.microsoft.com/sql/reporting-services/report-server/rsreportserver-config-configuration-file)
  before re-applying.

---

## Memory Pressure and AppDomain Recycling Checks (G10–G13)

### G10 — MemorySafetyMargin / MemoryThreshold Misconfigured
- **Trigger:** `RSReportServer.config` `` section sets `MemoryThreshold` ≤
  `MemorySafetyMargin`, or either value is set outside a sane 0–100 percent range
- **Severity:** Critical
- **Fix:** `MemoryThreshold` (default 90) must be greater than `MemorySafetyMargin`
  (default 80) — both are percentages of `WorkingSetMaximum` that define the
  low/medium/high memory-pressure boundaries. If the values are inverted or equal, the
  report server's pressure-response logic is undefined. Restore the documented defaults
  unless there is a specific, documented reason (e.g. lowering `MemorySafetyMargin` to
  react earlier to sudden processing-load spike

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vanterx](https://github.com/vanterx)
- **Source:** [vanterx/mssql-performance-skills](https://github.com/vanterx/mssql-performance-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-vanterx-mssql-performance-skills-ssrstracelog-review
- Seller: https://agentstack.voostack.com/s/vanterx
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.