SharePoint ULS Logs (Detailed tutorial)

In this SharePoint tutorial, we will learn everything about, SharePoint ULS Logs, like:

  • What are different ways to check logs in SharePoint
  • What are SharePoint ULS logs
  • How to view SharePoint ULS logs using SharePoint log viewer
  • Change SharePoint uls logs location
  • How to find SharePoint uls log details based on correlation id using PowerShell
  • How to write custom message to SharePoint 2013 ULS Logs Programmatically

Different ways to check logs in SharePoint

Let us see what are the different ways to check error logs in SharePoint 2013/2016/2019. If any error occurred in your SharePoint environment, then it is necessary to get the logs. Below is the area where we should check for SharePoint logs:

1. Event Viewer

This is one of the popular places to search for SharePoint errors.

You can open this by using the command like this:

Start -> Run and then enter eventvwr and click on Ok. This will open the Event Viewer window.

It has a separate section for SharePoint with a name as Windows SharePoint Services. Apart from this, you can also check in the Windows Logs -> Applications section for errors.

2. SharePoint Logs

By default, SharePoint maintains log inside the 14/15 hive folder, which is located in
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14/15\LOGS

You can check in the above locations also.

You can use ULS log viewer tool to see logs from 14 hive folder. This is a good tool.

3. IIS logs

You can also check in IIS logs for some errors.

The IIS logs presented in C:\Windows\System32\LogFiles location.

The IIS logs contain information about each request and the response.

Apart from this you can also enable tracing in SharePoint by modifying in the web.config file like below:

<system.web>
<trace enabled="true" requestLimit="40" localOnly="false"/>
</system.web>

These are different ways to check logs in SharePoint 2013/2016/2019.

SharePoint ULS logs

If you are working with some custom solutions or you face any issue or unexpected behavior then debugging more ULS logs is very much helpful. By default, SharePoint maintains ULS logs for every request. Actually, ULS logs are the first place for a developer or an administrator to check out.

SharePoint maintains Logs and Exceptions of SharePoint in ULS (Unified Logging Service). By default SharePoint stored in .log files in 15 hive folder (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS). But you can change the default path to some other location.

In real-world scenarios to get details from ULS logs is difficult without using a tool.

View SharePoint ULS logs

Let us see, how to view SharePoint ULS logs using SharePoint Log Viewer.

SharePoint Log Viewer is very efficient and has a lot of options like view real-time logs, export logs, show logs from multiple files, filter based on various filter columns.

SharePoint Log Viewer supports Moss 2007, SharePoint 2010 as well as SharePoint 2013.

See also  How to Create Content Type in SharePoint using Power Automate

Download and Install SharePoint Log Viewer

To use SharePoint Log Viewer to view logs from SharePoint, first, download SharePoint LogViewer from GitHub.

Then double click on the setup file to run SharePoint Log Viewer.

Open SharePoint Log Files using SharePoint Log Viewer

To see the existing log click on the Open Files button like below: Then you can browse the log file and see the log details.

SharePoint Log file locations: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS

sharepoint log viewer
View ULS Logs using SharePoint LogViewer in SharePoint 2013

View Real Time Logs using SharePoint Log Viewer

To view real-time logs, click on the “Start Live Monitoring” button as shown in the fig below:

uls logs sharepoint
View ULS Logs using SharePoint LogViewer in SharePoint 2016

Export Logs in SharePoint Log Viewer

We can also export logs by click on the “Export Log Entries” button as shown in the fig below:

uls logs sharepoint 2013
View ULS Logs using SharePoint LogViewer in SharePoint 2013

Filter Logs SharePoint Log Viewer

Once you load any log file you will be able to filter logs based on various criteria like Correlation id, area, categoryid, eventid etc. It will be like below:

View ULS Logs using SharePoint Log Viewer in SharePoint 2013
View ULS Logs using SharePoint LogViewer in SharePoint 2013

Change Columns in SharePoint LogViewer

By default, it will display all the columns in the UI. If you want to show only a few selected columns then you can click on the Setting icon and then in the Settings dialog box you can check and uncheck columns as shown in the fig below:

sharepoint log viewer 2016
View ULS Logs using SharePoint LogViewer in SharePoint 2019

Send Notification using SharePoint Log Viewer

If you want to send any notification to specific id then you can configure in the tool from the Settings icon. Click on the Settings icon -> Notifications -> then check the checkbox “Enable Email Notifications“.

Then it will enable the fields to enter Sender Email Address, Recipients Email Address, and Smtp Server.

sharepoint log viewer
View ULS Logs using SharePoint LogViewer in SharePoint 2013

This is how we can view SharePoint ULS logs.

Change SharePoint ULS Logs Location

Let us see, how to change SharePoint ULS logs location in on-premises versions.

ULS logs are stored on the file system of every SharePoint server in the <Program Files Directory>\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS folder.

Basically whenever some error occurred in the SharePoint site, then SharePoint will show the error message with a unique GUI id which is known as a correlation ID. And internally it will put a log entry in the ULS log with the same correlation id.

The ULS logs are text files and you can use ULS viewer to read properly from the logs files.

If you want you can change the number of days logs are kept and the total amount of disk space that can be used by the logs. All these things can be changed from the central admin by an administrator.

To change this, Open SharePoint 2013/2016 Central Administration and click on Monitoring and then in the Monitoring page, Click on Configure diagnostic logging from the Reporting section as shown in the fig below:

 sharepoint 2013 change uls log location
sharepoint 2013 change uls log location

Then in the Diagnostic Logging page, Go to the Trace Log section and there change the path, Number of days to store log files and Maximum storage space for Trace Logs (GB) like below:

SharePoint ULS Logs
SharePoint ULS Logs

Now save the changes. This way, we can change the ULS log location in SharePoint 2019/2016/2013 from SharePoint central administration.

Find SharePoint ULS logs based on correlation id using PowerShell

Let us see now, how to find uls logs based on Correlation ID from ULS Logs in SharePoint 2013/2016/2019 using PowerShell.

This command will be very much helpful if you are working with multiple servers that are load balanced. Usually, the logs file will be too big, and to get log details for a particular Correlation ID is difficult for multiple servers.

See also  How to Import Data from Excel to a SharePoint list using Power Automate?

Whenever any error occurs on any SharePoint page, SharePoint through an error saying Something went wrong, and then it will display a correlation id. Let us first understand what is a correlation id in SharePoint?

What is SharePoint correlation id?

If some error occurred in a page or site in SharePoint, most of the time SharePoint returns a unique GUID as “correlation ID”. As a SharePoint developer, you can take the correlation Id and search in the logs to get more information about the request.

SharePoint maintains logs in different areas. So it is very difficult to find what exactly the error is. But SharePoint provides an id which is known as correlation ID which is nothing but a GUID that is assigned to each conversation a user does or a SharePoint process does.

A site collection administrator can take the correlation id and search in the trace log to know where exactly the error occurred.

Just to remember for each entry in the trace log it contains a Correlation ID. A SharePoint administrator can view ULS logs using PowerShell with the correlation ID to track more information about the request.

Even administrators can use SharePoint Log Viewer to retrieve logs from SharePoint 2013/2010/2016. But normally your local SharePoint administrator will not be able to retrieve logs in SharePoint online.

Also, that entry contains the correlation id and some meaningful error message.

The correlation ID is exposed when an error page is displayed, and throughout the trace logs.

The correlation ID is not an error number or code. Simply, it’s a GUID (globally unique identifier) that’s automatically generated for every request that the SharePoint server receives. It’s unique to each request, not each error. However, when an error occurs, the error message contains the correlation ID that was valid for the request at the time.

The correlation ID is meant to be used to help a SharePoint Admin trace what was happening at the time of an error. It is only valuable as an interactive tool to help the Admin track down your error. An Admin uses the correlation ID as “breadcrumbs” to retrace requests or processes in the SharePointUnified Logging System (ULS) to find what leads up to and causes a problem.

If SharePoint gets an error that it can’t identify while working on that task, it posts an “Unexpected error has occurred” message and includes the correlation ID. The correlation ID can help find out what happened but doesn’t identify what happened.

A correlation ID in SharePoint is like a unique GUID generated at the time of a request in SharePoint. Each correlation ID is unique to each request on a SharePoint farm.

PowerShell Script to Find ULS Logs based on Correlation ID in SharePoint

Below is the PowerShell command, which will pick the error details for the particular Correlation ID from all the servers to a single place.

You can run the PowerShell command using Windows PowerShell ISE or using Visual Studio Code.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"
Merge-SPLogFile -Path "E:\Bijay\TempError.txt" -Correlation ff3a479d-8e3b-a03f-6251-ce47ef2463c6 -Overwrite

Make sure you have write access to the E:\Bijay\ folder.

Once you run the command, it will pull the logs from all the servers and it will write in the text file.

Similarly, also you can use get-splogevent command to retrieve logs based on the correlation id.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"}

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

Get-SPLogEvent -StartTime YYYY-MM-DDTHH:mm:ss | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

You can also use the below command if you are trying in your local system rather in load balancer servers.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "da80689d-e397-70c8-65fd-34a7bc8a5446"} | select Area, Category, Level, EventID,Message | Format-List > E:\errorlog.txt

Merge-SPLogFile in SharePoint 2010/2013/2016/2019

Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. You can run this command from PowerShell.

See also  Save Office 365 Email Attachments to OneDrive for business using Power Automate

This will be very much helpful if you are working in a multi-server environment. As SharePoint maintains log entries in each server, by using this command you can pull them in a single file.

You can filter based on various criteria like StartTime and EndTime, Process, Area, Category, EventID, and Message etc.

Below is the full syntax according to Microsoft.

Merge-SPLogFile -Path <String> [-Area <String[]>] [-AssignmentCollection <SPAssignmentCollection>] [-Category <String[]>] [-ContextFilter <String[]>] [-Correlation <Guid[]>] [-EndTime <DateTime>] [-EventID <String[]>] [-ExcludeNestedCorrelation <SwitchParameter>] [-Level <String>] [-Message <String[]>] [-Overwrite <SwitchParameter>] [-Process <String[]>] [-StartTime <DateTime>] [-ThreadID <UInt32[]>]

Below are some example which will be helpful:

Example-1:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite

Example-2:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search

Example-3: (merges the log data of level High or higher)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High

Example-4: (merges based on a Correlation ID)

Merge-SPLogFile –Path "S:\SPLogs\MergedLogs.log" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite

Example-5: (Based on Time)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" – EndTime "06/09/2008 16:15"

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file

While working with Merge-SPLogFile PowerShell command, you might come across an error as Cmdlet did not return any records in the log file. Check your time range or filters.

We run the below PowerShell cmdlet to get SharePoint error details from ULS logs.

Merge-SPLogFile –Path "E:\SPLogs\MergedLogs.txt" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite
Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file
merge sp log file with correlation id

Below is the solution you can try to solve the issue.

Open your SharePoint 2013 Central Administration and then click on Monitoring. Then on the Monitoring page click on “Configure diagnostic logging” in the Reporting section.

This will open the Diagnostic Logging page. Then check the checkboxes like below are click on OK.

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file
merge-splogfile correlation id

I hope this will be helpful to find SharePoint uls log details based on a correlation id using PowerShell. We also saw how to fix the error Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file in SharePoint 2013, SharePoint 2016 or SharePoint 2019.

Write to SharePoint 2013 ULS Logs Programmatically

Let us see, how to write to SharePoint 2013 ULS logs programmatically using the SharePoint server object model. Also, we will see how to write to ULS logs in SharePoint using PowerShell.

Let us see how to write our custom messages to ULS logs using PowerShell and SharePoint server object model.

Write to ULS log using PowerShell in SharePoint

Below is the PowerShell code to write to ULS logs. We can put the below code in windows PowerShell ISE.

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
$diagSvc = [Microsoft.SharePoint.Administration.SPDiagnosticsService]::Local
$category = new-object Microsoft.SharePoint.Administration.SPDiagnosticsCategory("My Custom Category",
[Microsoft.SharePoint.Administration.TraceSeverity]::Monitorable,
[Microsoft.SharePoint.Administration.EventSeverity]::Error )
$diagSvc.WriteTrace(0, $category, [Microsoft.SharePoint.Administration.TraceSeverity]::Monitorable, "This is our custom error message writted from PowerShell" )

After this if you want to check in USL log files you can see it will write like below:

05/10/2016 12:22:14.58 PowerShell_ISE.exe (0x9598) 0x65C4 Unknown My Custom Category 00000 Monitorable This is our custom error message writted from PowerShell cf54b83a-a9d2-0006-4a21-56cfd2a9d101
sharepoint write to uls log using powershell
Write to SharePoint 2013 ULS Logs Programmatically

Write to SharePoint 2013 ULS Logs Programmatically

You can also use the SharePoint server 2013 server object model code to write to the SharePoint uls logs. You can use the below code in a visual web part.

SPDiagnosticsCategory category = new SPDiagnosticsCategory("My Custom Category",TraceSeverity.High,EventSeverity.ErrorCritical);

SPDiagnosticsService.Local.WriteTrace(0,category,TraceSeverity.High,"This is our custom error message writted from SharePoint 2013 Server object model");

I hope this will be helpful to Write to ULS log using PowerShell and programmatically using the SharePoint server object model.

You may like the following SharePoint tutorials:

In this SharePoint tutorial we learned about SharePoint ULS logs.

  • Different ways to check logs in SharePoint
  • SharePoint ULS logs
  • View SharePoint ULS logs using SharePoint Log Viewer
  • Change SharePoint ULS Logs Location
  • Find SharePoint ULS logs based on correlation id using PowerShell
  • Write to SharePoint 2013 ULS Logs Programmatically
>