How to find Errors in the SharePoint ULS Log

From time to time – more often than wished for – you’ll get a generalized error message in your browser window printing “Sorry, something went wrong”. The real error message is written in the so-called ULS log. This log resides on every SharePoint server in a SharePoint farm and just waits for you to discover the extended error messages. So let’s dig in!

Step 1 – Know how to reproduce the error

With users reporting their steps on how to reproduce their error you are already ready and set.

Here is a non-complete list of things I like o ask:

  • Which browser did you use?
    • IE and Edge are the only browsers that support ActiveX and client services components like “Open in Explorer” or “Connect to Office”
  • If the user has multiple accounts: Which account did you use?
  • What was the correlation ID displayed on the “Sorry, something went wrong”-page?
  • What are the steps to reproduce your issue?

When you’re able to reproduce the error, it will be a lot easier for you to track down the real error message.

If it’s not possible to reproduce the error, then you’ll need to have the correct ULS log levels in place and let the user tell you the error time and the correlation ID displayed on the “Sorry, something went wrong”-page. The next chapter shows you how to configure the ULS log levels.

Step 2 – Configure ULS Log Levels

The log level determines how much information is logged to the ULS log. Often the default configuration is enough. But if not, then you can configure the ULS log to show more information like database calls or permission mask checks.

To configure the ULS log level through the UI, log in to a SharePoint server and open up the Central Admin. Under “Monitoring – Reporting – Configure diagnostics logging” you’ll find the relevant settings including the path to the ULS log files.

The path setting under “Monitoring – Reporting – Configure diagnostics logging” in the Central Admin.

Alternatively you can configure the log level via PowerShell as well:

> Get-SPLogLevel # shows the current configuration
> Set-SPLogLevel -TraceSeverity Verbose

Hit Set-SPLogLevel again to reset the log level to the one displayed after the first command.

Step 3a (Error reproducable) – Reproduce the Error and find the Error Message

Since you know how to reproduce the error, you can use a tool called “ULS Viewer” to find the corresponding error message.

You can download the ULS Viewer from the Microsoft Download Center.

Open the ULS Viewer on a SharePoint server and hit the play button on the top next to the open button. Or just hit CTRL +U.

ULS Viewer main screen.

To monitor ULS logs from multiple servers at once, hit the button next to the play button (looks like a computer network). Or just hit CTRL +R.

How to real-time log on multiple SharePoint servers.

With the ULS Viewer running, reproduce the error. I usually hide all error levels except unexpected. To do so just hit every button on the middle of the header (blue circle, white circle, yellow triangle and red circle).

How to hide VerboseEx, Verbose and Medium and High level error messages.

When you have finally found your error, right-click on the column you want to filter on to open a context menu. I usually filter by correlation ID by clicking “Quick Filter – Show when Correlation is…” in the context menu.

How to filter by correlation ID.

Alternatively, you could just copy the correlation ID on the “Sorry something went wrong”-page that appears in the browser when an error is popping up.

To do so hit CTRL +F in the ULS Viewer and put in your correlation ID.

Search for a specific correlation ID in ULS Viewer.

Step 3b (Error not reproducable) – Merge the Log Files and find the Error Message

You need to know at least a time frame of the error that appeared and a correlation ID to do the following. There are alternative ways of finding a solution but that would mean to stray trough the whole ULS log or trying out different parameters with the Merge-SPLogFile command…

The command to merge ULS logs from all SharePoint servers in the current farm is the following:

> Merge-SPLogFile -Path C:\Temp\mergedLog.log -Correlation 91bab29e-13c1-a0da-c633-e444233e6716

Here you’ll find more information about this neat PowerShll command.

To open up an existing ULS log you can browse to it by clicking the folder icon on the top left in the ULS Viewer or by pressing CTRL +O.

Step 4 – Find a Solution

With the real error message at hand you might already guess the solution or you do what we all do: ask google for a solution. You could even ask your question on StackExchange or similiar pages. With the real error provided in your question, you’ll get a solution a lot faster. Most of the experts will ask for the error message anyways 😉

Conclusion

We saw how important it is to be able to reproduce an error in SharePoint. That way it’s really easy to open up the ULS Viewer on a SharePoint server, filter out the log levels not needed, reproduce the error and see the unexpected error popping up – or you could even search for the correlation ID in the ULS Viewer.

There are some other techniques on finding errors without knowing the correlation ID or the time frame: merging the log files or just roaming through the ULS logs. But they are a definitely more time-consuming and need more SharePoint experience to find those nasty errors.

Leave a Reply