How to Search ULS Logs with Correlation ID

In order to troubleshoot and properly fix the problems in any application, administrators needs to use logging systems. SharePoint's logging system is called ULS log (also known as the diagnostic logging in Central Admin, among few other names) and it contains logs of everything it does when processing a request. Continue reading to find out more about ULS logs, but if you really want to dig into this subject and learn best practices be sure to check out this thorough whitepaper, so let's begin. 

What are ULS logs?

SharePoint creates a ULS log of everything it does when processing a request, and the correlation ID is simply a thread linked to that request, which will help you determine what’s been happening at each stage of the debugging process.

A correlation ID is a unique message linked to the GUID generated at the time of a request; each correlation ID is unique to each request on a SharePoint farm. The correlation ID is not an ID for every error in the SharePoint farm, but rather, a unique identifier for each request on the farm.

uls_logs

Where are ULS logs stored?

By default, when you install a SharePoint farm, the logs are stored in the following location (or, depending on the version of your SharePoint server, the number for the different SharePoint build is):

C:\Program files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS

To configure the logs location, you need to open Central Administration > Monitoring > Configure Diagnostics logging.

If you want to change the location of the diagnostic logging system via PowerShell, you can use following command:

Set-SPDiagnosticConfig -LogLocation “D:\Logs\SharePoint\”

The best practice is to move logs somewhere out of the system drive so they do not overload, or negatively affect, the performance of the system drive.

Determining how many days to store log files and restricting disk space for the logs

On the Diagnostic Logging page, you’ll also find options for configuring how many days you wish to keep the logs on the disk, and for restricting the amount of space the logs will use. The path for the ULS logs needs to be the same on every server, meaning that by configuring the path in Central Administration, it must exist on every server.

In terms of selecting the appropriate number of days and restricting trace-log disk space usage for the trace logs, there is no one simple answer.

But there are some factors you need to consider:

  • legal requirements for retention of the logs,
  • company policies for retention,
  • how long you consider it’s useful to keep the logs,
  • what questions you’re hoping to answer,
  • how much space the logs take up.

The goal would be to have all the required events for troubleshooting taking just a little disk space

How to view ULS logs like a boss?

There are few ways how to troubleshoot and read your SharePoint environment viewing logs in one place, but each of these ways among its advantages also has some drawbacks.

So with all those pros and cons in mind, SysKit Insights was created: a scalable, real-time monitoring solution that will help you to troubleshoot your SharePoint farms and search through the ULS logs that SharePoint farms generate with ease. 

 


This blog post just scratched the surface of ULS logs, that's why we prepared this detailed whitepaper which consists of in-depth explanations of matters mentioned above, along with logging levels in Central Administration, ULS Viewer, viewing real & past time centralized events, querying the logging database, tips & tricks and much more. It's suitable for the experienced users as well as for someone who is new to this subject, so make sure to check it out!

how to search ULS logs