Windows PowerShell for Developers #7: SharePoint ULS Logs

When I'm not messing about with virtual chemicals on a  computer, I'm messing about with SharePoint as part of my day job.  SharePoint is a vast and complex product, and as is the case with such products, it tends to go wrong quite a lot.

When it does go wrong you'll see a screen like this:


So at this point you are supposed to click on the TECHNICAL DETAILS link.  Then you see a screen like:


The Correlation ID is the key to solving the error.  The Correlation ID allows you to locate the error in the SharePoint server's ULS Logs:  as more than one server can be participating in the same task then it serves to unify any messages it generates.  These files can be found in the C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS\ folder for a SP 2013 machine. 

I'm not going to go into the structure of these files, save to say that there are LOTS of them and they are VERY large.  Most SharePoint professionals will at this point open a whole bunch of these files in a program called ULS Viewer.  ULS Viewer allows you to filter the individual log records by Correlation ID and track the error down. 

This is all very well if you are running all your services on one SharePoint server, but what if you have a multi-server farm?  Do you have to open all the logs on all the servers to track down your error?  I used to do this - and most other SP professionals I know also do - until I discovered a wonderful PowerShell command.  Merge-SPLogFile takes a Correlation ID and scours all the log files on all your servers in the farm to identify all the records that match it.  And, even better, if the same error has various messages scattered among different servers, they'll all be collected together in one place.

To use this command:

1. Log onto one of your farm servers locally as under administrator privileges.
2. Run the SharePoint 2013 Management Shell as Adminstrator
3. Type the following line:
   Merge-SPLogFile -Path .\error.log -Correlation <correlation ID>
4. Open up the error.log file in ULS Viewer. 

MergeSP-LogFile takes a number of other parameters to help you to refine your search, which I won't go into here, save to say that you can get help on the command using the usual methods.  This single PowerShell command has saved me hours of time tracking down and resolving errors.  It is not very well publicised - a fact for which I should be thankful, as it's given me a wonderful excuse to pen a blog entry.