In this SharePoint tutorial, we will learn everything about, SharePoint ULS Logs, like:
- What are different ways to check logs in SharePoint
- What are SharePoint ULS logs
- How to view SharePoint ULS logs using SharePoint log viewer
- Change SharePoint uls logs location
- How to find SharePoint uls log details based on correlation id using PowerShell
- How to write custom message to SharePoint 2013 ULS Logs Programmatically
Different ways to check logs in SharePoint
Let us see what are the different ways to check error logs in SharePoint 2013/2016/2019. If any error occurred in your SharePoint environment, then it is necessary to get the logs. Below is the area where we should check for SharePoint logs:
1. Event Viewer
This is one of the popular places to search for SharePoint errors.
You can open this by using the command like this:
Start -> Run and then enter eventvwr and click on Ok. This will open the Event Viewer window.
It has a separate section for SharePoint with a name as Windows SharePoint Services. Apart from this, you can also check in the Windows Logs -> Applications section for errors.
2. SharePoint Logs
By default, SharePoint maintains log inside the 14/15 hive folder, which is located in
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14/15\LOGS
You can check in the above locations also.
You can use ULS log viewer tool to see logs from 14 hive folder. This is a good tool.
3. IIS logs
You can also check in IIS logs for some errors.
The IIS logs presented in C:\Windows\System32\LogFiles location.
The IIS logs contain information about each request and the response.
Apart from this you can also enable tracing in SharePoint by modifying in the web.config file like below:
<system.web>
<trace enabled="true" requestLimit="40" localOnly="false"/>
</system.web>
These are different ways to check logs in SharePoint 2013/2016/2019.
SharePoint ULS logs
If you are working with some custom solutions or you face any issue or unexpected behavior then debugging more ULS logs is very much helpful. By default, SharePoint maintains ULS logs for every request. Actually, ULS logs are the first place for a developer or an administrator to check out.
SharePoint maintains Logs and Exceptions of SharePoint in ULS (Unified Logging Service). By default SharePoint stored in .log files in 15 hive folder (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS). But you can change the default path to some other location.
In real-world scenarios to get details from ULS logs is difficult without using a tool.
View SharePoint ULS logs
Let us see, how to view SharePoint ULS logs using SharePoint Log Viewer.
SharePoint Log Viewer is very efficient and has a lot of options like view real-time logs, export logs, show logs from multiple files, filter based on various filter columns.
SharePoint Log Viewer supports Moss 2007, SharePoint 2010 as well as SharePoint 2013.
Download and Install SharePoint Log Viewer
To use SharePoint Log Viewer to view logs from SharePoint, first, download SharePoint LogViewer from GitHub.
Then double click on the setup file to run SharePoint Log Viewer.
Open SharePoint Log Files using SharePoint Log Viewer
To see the existing log click on the Open Files button like below: Then you can browse the log file and see the log details.
SharePoint Log file locations: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS
View Real Time Logs using SharePoint Log Viewer
To view real-time logs, click on the “Start Live Monitoring” button as shown in the fig below:
Export Logs in SharePoint Log Viewer
We can also export logs by click on the “Export Log Entries” button as shown in the fig below:
Filter Logs SharePoint Log Viewer
Once you load any log file you will be able to filter logs based on various criteria like Correlation id, area, categoryid, eventid etc. It will be like below:
Change Columns in SharePoint LogViewer
By default, it will display all the columns in the UI. If you want to show only a few selected columns then you can click on the Setting icon and then in the Settings dialog box you can check and uncheck columns as shown in the fig below:
Send Notification using SharePoint Log Viewer
If you want to send any notification to specific id then you can configure in the tool from the Settings icon. Click on the Settings icon -> Notifications -> then check the checkbox “Enable Email Notifications“.
Then it will enable the fields to enter Sender Email Address, Recipients Email Address, and Smtp Server.
This is how we can view SharePoint ULS logs.
Change SharePoint ULS Logs Location
Let us see, how to change SharePoint ULS logs location in on-premises versions.
ULS logs are stored on the file system of every SharePoint server in the <Program Files Directory>\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS folder.
Basically whenever some error occurred in the SharePoint site, then SharePoint will show the error message with a unique GUI id which is known as a correlation ID. And internally it will put a log entry in the ULS log with the same correlation id.
The ULS logs are text files and you can use ULS viewer to read properly from the logs files.
If you want you can change the number of days logs are kept and the total amount of disk space that can be used by the logs. All these things can be changed from the central admin by an administrator.
To change this, Open SharePoint 2013/2016 Central Administration and click on Monitoring and then in the Monitoring page, Click on Configure diagnostic logging from the Reporting section as shown in the fig below:
Then in the Diagnostic Logging page, Go to the Trace Log section and there change the path, Number of days to store log files and Maximum storage space for Trace Logs (GB) like below:
Now save the changes. This way, we can change the ULS log location in SharePoint 2019/2016/2013 from SharePoint central administration.
Find SharePoint ULS logs based on correlation id using PowerShell
Let us see now, how to find uls logs based on Correlation ID from ULS Logs in SharePoint 2013/2016/2019 using PowerShell.
This command will be very much helpful if you are working with multiple servers that are load balanced. Usually, the logs file will be too big, and to get log details for a particular Correlation ID is difficult for multiple servers.
Whenever any error occurs on any SharePoint page, SharePoint through an error saying Something went wrong, and then it will display a correlation id. Let us first understand what is a correlation id in SharePoint?
What is SharePoint correlation id?
If some error occurred in a page or site in SharePoint, most of the time SharePoint returns a unique GUID as “correlation ID”. As a SharePoint developer, you can take the correlation Id and search in the logs to get more information about the request.
SharePoint maintains logs in different areas. So it is very difficult to find what exactly the error is. But SharePoint provides an id which is known as correlation ID which is nothing but a GUID that is assigned to each conversation a user does or a SharePoint process does.
A site collection administrator can take the correlation id and search in the trace log to know where exactly the error occurred.
Just to remember for each entry in the trace log it contains a Correlation ID. A SharePoint administrator can view ULS logs using PowerShell with the correlation ID to track more information about the request.
Even administrators can use SharePoint Log Viewer to retrieve logs from SharePoint 2013/2010/2016. But normally your local SharePoint administrator will not be able to retrieve logs in SharePoint online.
Also, that entry contains the correlation id and some meaningful error message.
The correlation ID is exposed when an error page is displayed, and throughout the trace logs.
The correlation ID is not an error number or code. Simply, it’s a GUID (globally unique identifier) that’s automatically generated for every request that the SharePoint server receives. It’s unique to each request, not each error. However, when an error occurs, the error message contains the correlation ID that was valid for the request at the time.
The correlation ID is meant to be used to help a SharePoint Admin trace what was happening at the time of an error. It is only valuable as an interactive tool to help the Admin track down your error. An Admin uses the correlation ID as “breadcrumbs” to retrace requests or processes in the SharePointUnified Logging System (ULS) to find what leads up to and causes a problem.
If SharePoint gets an error that it can’t identify while working on that task, it posts an “Unexpected error has occurred” message and includes the correlation ID. The correlation ID can help find out what happened but doesn’t identify what happened.
A correlation ID in SharePoint is like a unique GUID generated at the time of a request in SharePoint. Each correlation ID is unique to each request on a SharePoint farm.
PowerShell Script to Find ULS Logs based on Correlation ID in SharePoint
Below is the PowerShell command, which will pick the error details for the particular Correlation ID from all the servers to a single place.
You can run the PowerShell command using Windows PowerShell ISE or using Visual Studio Code.
Add-PSSnapin "Microsoft.SharePoint.PowerShell"
Merge-SPLogFile -Path "E:\Bijay\TempError.txt" -Correlation ff3a479d-8e3b-a03f-6251-ce47ef2463c6 -Overwrite
Make sure you have write access to the E:\Bijay\ folder.
Once you run the command, it will pull the logs from all the servers and it will write in the text file.
Similarly, also you can use get-splogevent command to retrieve logs based on the correlation id.
Add-PSSnapin "Microsoft.SharePoint.PowerShell"
get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"}
Add-PSSnapin "Microsoft.SharePoint.PowerShell"
get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List
Get-SPLogEvent -StartTime YYYY-MM-DDTHH:mm:ss | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List
You can also use the below command if you are trying in your local system rather in load balancer servers.
Add-PSSnapin "Microsoft.SharePoint.PowerShell"
get-splogevent | ?{$_.Correlation -eq "da80689d-e397-70c8-65fd-34a7bc8a5446"} | select Area, Category, Level, EventID,Message | Format-List > E:\errorlog.txt
Merge-SPLogFile in SharePoint 2010/2013/2016/2019
Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. You can run this command from PowerShell.
This will be very much helpful if you are working in a multi-server environment. As SharePoint maintains log entries in each server, by using this command you can pull them in a single file.
You can filter based on various criteria like StartTime and EndTime, Process, Area, Category, EventID, and Message etc.
Below is the full syntax according to Microsoft.
Merge-SPLogFile -Path <String> [-Area <String[]>] [-AssignmentCollection <SPAssignmentCollection>] [-Category <String[]>] [-ContextFilter <String[]>] [-Correlation <Guid[]>] [-EndTime <DateTime>] [-EventID <String[]>] [-ExcludeNestedCorrelation <SwitchParameter>] [-Level <String>] [-Message <String[]>] [-Overwrite <SwitchParameter>] [-Process <String[]>] [-StartTime <DateTime>] [-ThreadID <UInt32[]>]
Below are some example which will be helpful:
Example-1:
Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite
Example-2:
Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search
Example-3: (merges the log data of level High or higher)
Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High
Example-4: (merges based on a Correlation ID)
Merge-SPLogFile –Path "S:\SPLogs\MergedLogs.log" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite
Example-5: (Based on Time)
Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" – EndTime "06/09/2008 16:15"
Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file
While working with Merge-SPLogFile PowerShell command, you might come across an error as Cmdlet did not return any records in the log file. Check your time range or filters.
We run the below PowerShell cmdlet to get SharePoint error details from ULS logs.
Merge-SPLogFile –Path "E:\SPLogs\MergedLogs.txt" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite
Below is the solution you can try to solve the issue.
Open your SharePoint 2013 Central Administration and then click on Monitoring. Then on the Monitoring page click on “Configure diagnostic logging” in the Reporting section.
This will open the Diagnostic Logging page. Then check the checkboxes like below are click on OK.
I hope this will be helpful to find SharePoint uls log details based on a correlation id using PowerShell. We also saw how to fix the error Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file in SharePoint 2013, SharePoint 2016 or SharePoint 2019.
Write to SharePoint 2013 ULS Logs Programmatically
Let us see, how to write to SharePoint 2013 ULS logs programmatically using the SharePoint server object model. Also, we will see how to write to ULS logs in SharePoint using PowerShell.
Let us see how to write our custom messages to ULS logs using PowerShell and SharePoint server object model.
Write to ULS log using PowerShell in SharePoint
Below is the PowerShell code to write to ULS logs. We can put the below code in windows PowerShell ISE.
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
$diagSvc = [Microsoft.SharePoint.Administration.SPDiagnosticsService]::Local
$category = new-object Microsoft.SharePoint.Administration.SPDiagnosticsCategory("My Custom Category",
[Microsoft.SharePoint.Administration.TraceSeverity]::Monitorable,
[Microsoft.SharePoint.Administration.EventSeverity]::Error )
$diagSvc.WriteTrace(0, $category, [Microsoft.SharePoint.Administration.TraceSeverity]::Monitorable, "This is our custom error message writted from PowerShell" )
After this if you want to check in USL log files you can see it will write like below:
05/10/2016 12:22:14.58 PowerShell_ISE.exe (0x9598) 0x65C4 Unknown My Custom Category 00000 Monitorable This is our custom error message writted from PowerShell cf54b83a-a9d2-0006-4a21-56cfd2a9d101
Write to SharePoint 2013 ULS Logs Programmatically
You can also use the SharePoint server 2013 server object model code to write to the SharePoint uls logs. You can use the below code in a visual web part.
SPDiagnosticsCategory category = new SPDiagnosticsCategory("My Custom Category",TraceSeverity.High,EventSeverity.ErrorCritical);
SPDiagnosticsService.Local.WriteTrace(0,category,TraceSeverity.High,"This is our custom error message writted from SharePoint 2013 Server object model");
I hope this will be helpful to Write to ULS log using PowerShell and programmatically using the SharePoint server object model.
You may like the following SharePoint tutorials:
- SharePoint web application
- PowerShell SharePoint site collection example
- SharePoint list delete title column
- SharePoint list operations using rest api
- SharePoint modern list view customization example
- Create SharePoint list view
- SharePoint event receiver example
In this SharePoint tutorial we learned about SharePoint ULS logs.
- Different ways to check logs in SharePoint
- SharePoint ULS logs
- View SharePoint ULS logs using SharePoint Log Viewer
- Change SharePoint ULS Logs Location
- Find SharePoint ULS logs based on correlation id using PowerShell
- Write to SharePoint 2013 ULS Logs Programmatically
After working for more than 15 years in Microsoft technologies like SharePoint, Office 365, and Power Platform (Power Apps, Power Automate, and Power BI), I thought will share my SharePoint expertise knowledge with the world. Our audiences are from the United States, Canada, the United Kingdom, Australia, New Zealand, etc. For my expertise knowledge and SharePoint tutorials, Microsoft has been awarded a Microsoft SharePoint MVP (9 times). I have also worked in companies like HP, TCS, KPIT, etc.