My friend Dan Winter posted 2009 SharePoint Toolbox Review today on his blog. Within the post, the best tool I like is the ULS Viewer. If there’s an election of SharePoint Administrator troubleshooting tools, I would vote it as the president!
So what is ULS? It stands for Unified Logging Service. Mr. Winter explained that a lot in his blog so I would not repeat. But, it is the top one thing you should look at when you want to troubleshoot some SharePoint issue. Of course, troubleshooting is not always to get the symbols, debug and trace problems… If that is indeed needed, then it may be a bug. Most of the time, ULS log is already quite helpful. For example, sometimes I got a service error in the webpage, some errors in event log, but nothing told the exact root of the problem. Then when I looked into ULS log, it told me that the credential of the user did not work. It is really helpful.
I did a user research earlier this year, more than 75% of SharePoint Administrators had no idea about ULS log. There’re some reasons. Since the ULS log is designed mainly for product group and customer service usage, the default format is not very user friendly. The log is hard to read, and you may get overwhelming messages instead of the useful ones. Now, we have ULS Viewer to solve the problem.
For SharePoint 2010, by default, ULS log is at
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS
You can check the directory and try to read those logs. I was quite used to that, with notepad:)
ULS Viewer can be used in different modes. The log can be read from log files, real time ULS log, or even clipboard. Here’s some examples:
On a machine running SharePoint 2010, run ULS Viewer. Click File, Open From, then choose ULS (This could also be done by simply press Ctrl+U). Immediately the logs will be shown in real-time. You can filter message level by click the icons in the middle. This can tell you what is going on inside SharePoint.
The best feature I love is the Toggle Correlation Tree button. In SharePoint 2010 we can use correlation id to trace a series of event inside SharePoint. For example, in this screenshot, my machine is trying to flush usage log. The different entries may be buried in the big ULS log file, but with correlation id you can easily track them – they shared the same id “c000006c-5b56-412b-9de1-78aae06d121f”.
Another good feature is the notifications. You can set notification level for ULS Viewer, by default it will pop up notification for Critical message. For example in this screenshot, when Health Analyzer checked my machine for a security rule, it wrote a critical message into the log. With ULS Viewer, you can quickly identify the location of the message. If there’s an exception, you can also check the detail of that.
I’m ready to throw my notepad away – ULS Viewer is the one to go with, for troubleshooting.
This is really amazing information. For sure, I am throwing the notepad away!! :)
Hi there, I have a question for you. I have tried to search on internet to find an answer for this, but without any results.
When I open the log file in ULS Viewer and I search for a correlation Id, the find function does not display it. It says that it cannot be found, eventhough I know it is there. How can I find a correlation Id in ULS Viewer? Thank you for your help.
After installation of SP1 for SharePoint 2010 there are no new ULS log files in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS
There some "PSCDiagnostics" log files...
you click the filter button, and add a criteria correlation id equals the id you copied from the error page.
if you have multiple SharePoint servers, you may need to check the uls log on every one. Developer dashboard in SharePoint 2013 improve to contain the uls log information.