u might have stumbled across this blog entry when looking for information on the ULS. If that is the case, while I will not
go into great detail on the ULS I can at least tell you that it stands for stands for Unified Logging Service and is a corner
stone of SharePoint troubleshooting and it is the first place I recommend looking at to start tracking down the details of any
errors you might be encountering. If you are looking for a decent article on the ULS I’d recommend checking out the general
MSDN article that gives a general
overview.
Now, assuming that you have at least a basic understanding of the ULS and where the files can be found (default is the
“SharePoint HIVE”Logs folder). If you open one of the files up, I am willing to bet that you would find yourself wondering
how on earth you can make heads or tails of the information stored in the file and if you have a large farm, how you can pull
it all together so you can track down any issues quickly and more efficiently. Well you are in luck as one of the better tools
out there is free, full of features, and rather easy to use. This tool is called the ULSViewer and can be downloaded from
here or
here.
ULSViewer can be used in different modes. The log can be read from log files, real time ULS log, from multiple servers, or
even from the clipboard. Here’s some examples:
On a machine running SharePoint 2010, run ULS Viewer. Click File, Open From, then choose ULS (This could also be done by
simply press Ctrl+U).
Immediately the logs will be shown in real-time. From here you can do things like filter by message level by click the icons
in the of the tool bar
You can ask set filters based on what you are looking for (error message, correlation id, etc). You can do this by clicking
on the “filter” icon in the tool bar and then defining 1 or more filters.
Note: One of the great things you can also do is save filters and reuse them. I find that I have a number of filters that I
use over and over and this helps save a lot of time!
Another feature that I find really handy is the “Toggle Correlation Tree” button.
When you click on this it opens up a side panel that can show you a list of all of the correlation ids and when you click
on one of those nodes you immediately see the main area filters to show only the log entries related to that single correlation
id.
The reason why this is so useful is because in SharePoint we use correlation ids to trace a series of events that occurred
at once (like a transaction).
For example if you look at the screenshot below you’ll see that I selected the correlation id
‘ce44ed9c-e3b3-c0ad-3409-5e8c8d8d317f’ and this one appears to be related to a UserProfileImport Sync job.
If you’re running this on a development machine or are trying to track down an error that doesn’t happen regularly
another good feature is the notifications. You can enable notification by level in side of ULS Viewer (by default it will pop
up notification for Critical message). For example in this screenshot, when Health Analyzer checked my machine for a security
rule, it wrote a critical message into the log. With ULS Viewer, you can quickly identify the location of the message. If
there’s an exception, you can also check the detail of that.
Another great feature is the ability to open up multiple ULS logs from different servers. So if you have a 4 or 5 server
farm, you could either review each log individually or you could open them up as a “FARM” and let ULSView take over the
complicated work of combining the log files into a single view. You can do this either from the tool bar by clicking on the
“farm” icon or by going to File -> Open From -> Farm (Ctrl+ R)
Farm Icon
File -> Open From
Which then opens this dialog
From here you can add all of your servers (NetBios, FQDN, or IP addresses work just fine) and then specify a share that is
available on ALL of the servers list.
Tip: The SAME share must be available on all servers for this to work. I normally create a standard share on all of my
SharePoint servers called “UlsLogs” and grant read only access to the development and operations teams.
Also another useful feature is that once you have configure ULSView for your environment (include what servers/files are
being monitored), you can save everything to a “workspace”. This workspace can be shared with others and opened at any
time. This provides a very quick way to start viewing a farm.
Tip: I usually create one workspace per environment and share what with the development and operations team.