If I make a change to the event throttling (for example, increase it show show only high-level events for all events), do I need to restart the Tracing service (in Windows Services) in order to apply this change? I don't want to restart it if it's not necessary and I don't want to not restart it if it's required.
2 Answers
You should not need to restart any services. It should take into effect shortly after you click OK in Central Admin > Operations > Diagnostic Logging.
Notice how I use the word "should". It worked in my test farm, but from some research I've done, these changes don't always take into effect instantly like they were designed to. This previous post (https://sharepoint.stackexchange.com/questions/2297/how-can-can-i-disable-verbose-logging) explains that sometimes the tracing service may have to be restarted..You will have to check the log file and see if your changes have been made.
If you like doing items via stsadm you can follow the commands here to make your changes as well: http://technet.microsoft.com/en-us/library/cc261740(v=office.12).aspx
As mentioned already, you "Should" not have to restart the service, though you will find times where it does get stuck. I tend to restart it anyway as it gives me a nice clean break in my logging so I can tell based on the time stamp which log contains the events from when I made my changes to the logging levels. So for example, if I set logging to verbose, I tend to restart the service so that I know that the new logs generated from that point will have the verbose logging info. It may also be useful to use the stsadm/powershell commands to restart the service whenever you are about to reproduce an issue for the same reasons. That way I can get a log with as little additional noise as possible making it easier to generate logs that cover just the time period of the issue reproduction. Just my 2 cents, hope this helps.
