04 Jan How to find Errors in the SharePoint ULS Log
From time to time – more often than wished for – you’ll get a generalized error message in your browser window printing “Sorry, something went wrong”. The real error message is written in the so-called ULS log. This log resides on every SharePoint server in a SharePoint farm and just waits for you to discover the extended error messages. So let’s dig in!
Step 1 – Know how to reproduce the error
With users reporting their steps on how to reproduce their error you are already ready and set.
Here is a non-complete list of things I like o ask:
- Which browser did you use?
- IE and Edge are the only browsers that support ActiveX and client services components like “Open in Explorer” or “Connect to Office”
- If the user has multiple accounts: Which account did you use?
- What was the correlation ID displayed on the “Sorry, something went wrong”-page?
- What are the steps to reproduce your issue?
When you’re able to reproduce the error, it will be a lot easier for you to track down the real error message.
If it’s not possible to reproduce the error, then you’ll need to have the correct ULS log levels in place and let the user tell you the error time and the correlation ID displayed on the “Sorry, something went wrong”-page. The next chapter shows you how to configure the ULS log levels.
Step 2 – Configure ULS Log Levels
The log level determines how much information is logged to the ULS log. Often the default configuration is enough. But if not, then you can configure the ULS log to show more information like database calls or permission mask checks.
To configure the ULS log level through the UI, log in to a SharePoint server and open up the Central Admin. Under “Monitoring – Reporting – Configure diagnostics logging” you’ll find the relevant settings including the path to the ULS log files.
Alternatively you can configure the log level via PowerShell as well:
Get-SPLogLevel # shows the current configuration Set-SPLogLevel -TraceSeverity Verbose
Hit Set-SPLogLevel again to reset the log level to the one displayed after the first command.
Step 3a (Error reproducable) – Reproduce the Error and find the Error Message
Since you know how to reproduce the error, you can use a tool called “ULS Viewer” to find the corresponding error message.
You can download the ULS Viewer from the Microsoft Download Center.
Open the ULS Viewer on a SharePoint server and hit the play button on the top next to the open button. Or just hit CTRL +U.
To monitor ULS logs from multiple servers at once, hit the button next to the play button (looks like a computer network). Or just hit CTRL +R.
With the ULS Viewer running, reproduce the error. I usually hide all error levels except unexpected. To do so just hit every button on the middle of the header (blue circle, white circle, yellow triangle and red circle).
When you have finally found your error, right-click on the column you want to filter on to open a context menu. I usually filter by correlation ID by clicking “Quick Filter – Show when Correlation is…” in the context menu.
Alternatively, you could just copy the correlation ID on the “Sorry something went wrong”-page that appears in the browser when an error is popping up.
To do so hit CTRL +F in the ULS Viewer and put in your correlation ID.
Step 3b (Error not reproducable) – Merge the Log Files and find the Error Message
You need to know at least a time frame of the error that appeared and a correlation ID to do the following. There are alternative ways of finding a solution but that would mean to stray trough the whole ULS log or trying out different parameters with the Merge-SPLogFile command…
The command to merge ULS logs from all SharePoint servers in the current farm is the following:
> Merge-SPLogFile -Path C:\Temp\mergedLog.log -Correlation 91bab29e-13c1-a0da-c633-e444233e6716
Here you’ll find more information about this neat PowerShll command.
To open up an existing ULS log you can browse to it by clicking the folder icon on the top left in the ULS Viewer or by pressing CTRL +O.
Step 4 – Find a Solution
With the real error message at hand you might already guess the solution or you do what we all do: ask google for a solution. You could even ask your question on StackExchange or similiar pages. With the real error provided in your question, you’ll get a solution a lot faster. Most of the experts will ask for the error message anyways 😉
We saw how important it is to be able to reproduce an error in SharePoint. That way it’s really easy to open up the ULS Viewer on a SharePoint server, filter out the log levels not needed, reproduce the error and see the unexpected error popping up – or you could even search for the correlation ID in the ULS Viewer.
There are some other techniques on finding errors without knowing the correlation ID or the time frame: merging the log files or just roaming through the ULS logs. But they are a definitely more time-consuming and need more SharePoint experience to find those nasty errors.