SharePoint 2007: Tracing Service failed to create the trace log file...Access is denied.

Problem

You check a farm server Application event log and see the following listed multiple times:

Log Name:          Application
Source:            Windows SharePoint Services 3
Date:              [date/time]
Event ID:          5401
Task Category:     Unified Logging Service
Level:             Error
Keywords:          Classic
Computer:          [farm server name]
Description:
Tracing Service failed to create the trace log file at [path to log file 
storage].  error 5: Access is denied.

You check the folder and verify that trace logs have not been created in some time.  You also check the folder's security settings and verify that the account running Windows SharePoint Services (ie, the farm service account) is listed and has Full Control.

You then check the Log On for the Windows SharePoint Services Tracing service and determine that it is the Local Service account.  This account is not listed on the folder's Security tab.

Solution

1. Add the WSS_WPG group to the folder's Security and grant the group
• Read & execute
• List folder contents
• Read
2. Also add the WSS_ADMIN_WPG group while you're at it, granting it Full Control.

References

• Event ID 5400 (Windows SharePoint Services health model)
• Files and permissions for Office SharePoint Server 2007
• Account permissions and security settings (Office SharePoint Server)
• Event ID 10016, KB 920783, and the WSS_WPG Group: not directly related but provides useful insight on the broader issue of using user groups rather than individual accounts when configuring access.

Notes

• The NT AUTHORITY\Local Service account is automatically added to the WSS_WPG group when this account is made the log on for the service, which in this case occurs at installation.