ULS Logging – Part 1

Notes from studying Wrox – Real World Sharepoint 2010

Chapter 3 – Monitoring Sharepoint 2010

Unifi ed Logging Service (ULS) is the service responsible for keeping an eye on SharePoint and reporting what it fi nds. It can report events to three different locations: (1) Sharepoint Trace Logs (2) Windows Event Log and (3) Sharepoint logging database

(1) Sharepoint logs: They are plain old text files that are tab delimited and can be opened with any tool that can open text files. By default, this is the log location:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS

By default, a new log file is created every 30 minutes. But you can change it using PowerShell: with the set-SPDiagnosticConfig –LogCutInterval 60 command to change to 60 minutes.

SP 2010 file is much cleaner than SP 2007 log file, yet provide more info; SP 2010 perform file compression to log files to save space. With the SP 2010, you have better control over which events to log; and you can set it back to the original setting once issues is resolved. This is where to configure it: in Centeral Admin à Monitoring à Configure Diagnoctic Logging.

There are 20 categories to choose from; you can choose individual categories or subcategories to monitor. For some reason I can’t save the categories/subcategories on this page.

OK, I found out why – you have the use the category/subcategory checkboxes together with these two drop downs. In other words, select the categoryies/subcategories, and then select from the drop down as to how you want to log the selected items. Once you click OK, the changed categories/subcategories will become bold, so you know what has been changed compared to the original setting.

You can also change the location of log files. Remember this is a FARM LEVEl setting, not server setting. So all servers will be affected!!! Make sure the drive letter exists for each server
before you change the location.

Every Sharepoint 2010 Administrator should get cozy with Windows PowerShell.

Get-SPDiagnosticConfig: retrieve the diagnostic settings in your farm
Set-SPDiagnosticConfig: change them

Use Get-Help
to get help on a cmdlet

Change log file location – Set-SPDiagnosticConfig -LogLocation e:\Logs

You can get a list of the cmdlets that deal with the log levels by running the command Get-Command -Noun SPLogLevel in a SharePoint Management Shell. Search any command that has the keyword “SPLogLevel” in it.

This command lists all log levels of a specific category
Get-SPLogLevel | Where-Object {$_.area.tostring() -eq “Access Services”}

The -Identity parameter of Get-SPLogLevel corresponds to the second column (or Name column)

The Clear-SPLogLevel
cmdlet clears out any changes you have made, and sets the logging levels to their default values for both trace and event logging.

Correlation ID


correlation ID is a globally unique identifier GUID that is assigned to each conversation a user or process has with SharePoint. Each entry in the trace logs has a correlation ID, you can just open up the trace log in

Notepad and look for the lines that reference this conversation. The correlation ID is considered by many administrators to be one of the best new features in SharePoint 2010.

You can also use Developer Dashboard to get the CorrelationID.

To view developer dashboard:
(1) The user browsingthe page must have the AddAndCustomizePages permission (site collection admins and users in the Owner group, by default)
(2) it must be enabled in your farm

By default, it is OFF.

Powershell to turn it on/off/on demand:

$dash = [Microsoft.SharePoint.Administration.SPWebService]::ContentService.DeveloperDashboardSettings;

$dash.DisplayLevel = ‘OnDemand’;

# $dash.DisplayLevel = ‘Off’;

# $dash.DisplayLevel = ‘On’;

$dash.TraceEnabled = $true;


How to view/handle log files?

(1) Excel
(2) MSDN ULS Viewer –

Post a comment or leave a trackback: Trackback URL.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: