Working With Microsoft Support Series: How to find correct ULS Logs

Working With Microsoft Support Series: How to find correct ULS Logs

This artcile will answer fallowing questions :

*Where can i find the SharePoint Logs?
*What are the SharePoint Logs ?
*How can i find the correct ones ?

Where can i find the SharePoint Logs?

For SharePoint 2010 :
The ULS Logs are stored in %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\14\LOGS\ Folder by default.

But what is the folder has customized and changed for another path . How could you find correct path ?

You can check from Central Administration
1) Open Start-> All Programs -> Microsoft Sharepoint 2010 Products -> SharePoint 2010 Central Administration
2) Click the “Monitoring”
3) Select the “Configure Diagnostics Logging” under reporting section
You can find the log location path under “Trace Log” section in Path Text Box.

You can use SharePoint Management Shell (Powershell) to define log location path

1) Open Start-> All Programs -> Microsoft Sharepoint 2010 Products -> SharePoint 2010 Management Shell

2) And type fallowing commands:
$config = Get-SPDiagnosticConfig

and press enter .

For SharePoint 2007 :
The ULS Logs are stored in %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\12\LOGS\ Folder by default.

But what is the folder has customized and changed for another path . How could you find correct path ?
You can check from Central Administration
1) Open Start-> All Programs -> Microsoft Office Server -> SharePoint 3.0 Central Administration
2) Click the “Operations” tab
3) Select the “Diagnostics Logging” under “Logging and Reporting” Section
You can find the log location path under “Trace Log” section in Path Text Box.

When you open this folder you may face with different type of files are stored in.

What are the SharePoint Logs ?

The LOGS folder contains log files (.log), data files (.txt), and usage files (.usage). The file naming convention for a SharePoint trace log is the server name followed by a date and time stamp. SharePoint trace logs are created at regular intervals and whenever there is an IISRESET. It is common to have many trace logs within a 24 hour period.

The Usage Logs:
Usage data is initially stored in Usage Log file (.USAGE ) on SharePoint Server under logging directory which is later processed by Microsoft SharePoint Foundation Usage Data Import Timer job that runs every 30 min into Usage Database.
There is another timer job Microsoft SharePoint Foundation Usage Data Processing, this job checks for expired usage data at the farm level and deletes data.
Expired usage data consists of records in the central usage data collection database that are older than 30 days.
For more information please check:
Logs are in MACHINE NAME-DATE[YYYYMMDD]-TIME[HHMM].usage format.
For example:

Sharepoint ULS Logs:
The Unified Logging Services (ULS) provides a single, centralized location for logging error and informational message related to SharePoint Server and SharePoint solutions.SharePoint 2010 includes improvements that are related to the management of the ULS and that make it easier for Administrator to troubleshoot issues.



These logs are very important when troubleshooting issues on your system. And reqested usually by support engineers so do not delete this logs before getting backup .

You can open ULS Logs with ULSViewer program:

Post-Setup-Configuration Diagnostics Logs (PSCDiagnostics):
PSCDiagnostics files are post-setup configuration files. Each time that you open SharePoint’s central administration page, a new PSCDiagnostics file is created. These files are always stored in the same directory as the trace logs. So, if you change the trace log location, these logs will follow.You also have a very fine degree of control over the types of events to log. The following is a comprehensive list of event types.For each event, you can set the least critical event to report to the event log and you can report the least critical event to report to the trace log

Logs are in PSCDiagnostics_MM_DD_YYYY_HH_MM_SS_SSS_randomnumber.log  format.

These logs are used by support engineer that defining installation,pacthing,upgrade and SharePoint Configuration Wizard problems. ,

The Upgrade and Upgrade Error logs:
Upgrade status indicators and log files should give you an indication of what went wrong during the upgrade process. We recommend that you carefully review all the errors that were logged in the upgrade log files. Warnings might not always indicate an issue, but you should review them all to determine whether any of them are likely to cause even more issues.
Logs are in Upgrade-DATE[YYYYMMDD]-TIME[HHMMSS-SSS].log format
The upgrade error log file combines all errors and warnings into a shorter file
and is named Upgrade-DATE[YYYYMMDD]-TIME[HHMMSS-SSS]-error.logs

How could you find correct SharePoint ULS Log files ?

When working with Microsoft , the support engineer may request that logs from you. But sometimes the log size can be huge. For example you have 8 server and 1 day logs for all servers can be tens of gigabytes .the important part in that log files that your issue’s reproduced time slice. So How could you find correct log files.

For example scenario :
you have 8 server farm and facing with incremental crawl problem . The crawl has taken 30 minutes and SE requested that ULS logs for all your servers.
And you know that the crawl start time is 11:25 and finish time is 11:55 . the correct files are highlighted.

SERVER-20121016-11:20.log ***->first log should be before 11:25
SERVER-20121016-11:40.log ***-> first logs should be before 11:55

you should get all ULS logs with explained method from all required servers (in this scenario for all servers) and it would be better to compress these files to a single zip file and than you can upload these logs to workspace that provided by Microsoft.

For Best Practices about Logging please read fallowing article


Import ULS log files to SQL Server database for Sharepoint 2010

Sometime you may need to import ULS log files to SQL server . It can be done with several ways by using SQL Server import tools or import from an Excel file to SQL  server. Or you can use fallowing free open source windows application tool. With this tool it can be done with more quickly . By multy-threading and bulk insert architecture feature provides you that ULS logs contains total 1.500.000 row  can be upload in  apprx. 2 minutes. (as you know it depends on your configuration and hardware)

Than you can query SQL tables as you wish : Fallowing query will return execution time over 1 sec for SPMonitoring event records.

select * from WFE1
where [ExecutionTime] > 1000 and [Eventid] =’b4ly’
order by [ExecutionTime] desc

“All These source codes are freeware and is provided on an “as is” basis without warranties of any kind, whether express or implied, including without limitation warranties that the code is free of defect, fit for a particular purpose or non-infringing. The entire risk as to the quality and performance of the code is with the end user

For Download  ULStoSQLImporter v1.0  for Sharepoint 2010:

Unable to create system performance counter with error code PDH_CSTATUS_NO_MACHINE

One of our case we faced with annoying ULS log errors about performace counters. Multiple errors like below filling ULS logs and keep inflated rapidly.

Unable to create system performance counter ComputerName\Memory\Available Mbytes\. The following exception was thrown: System.ComponentModel.Win32Exception: Unknown error (0x800007d0) at Microsoft.SharePoint.Win32.SPPdh.CheckReturnValue(PDH_STATUS status, Boolean throwOnError) at Microsoft.SharePoint.Utilities.SPPerformanceCounter.Initialize() at Microsoft.SharePoint.Utilities.SPPerformanceCounter.NextValue(Int32 retry, Int32 retryInterval) at Microsoft.SharePoint.Utilities.SPPerformanceCounterMonitorInternal.UpdateValue() at Microsoft.SharePoint.Utilities.SPPerformanceCounterMonitorInternal.Create(String computer, String category, String counter, String instance)
Performance Counter OS (pdh) call failed with error code PDH_CSTATUS_NO_MACHINE.

Microsoft Sharepoint Timer Service’s account does not have the necessary permissions to access the performance counters on the server.

Find Microsoft Sharepoint Timer Service account and set the account as local admin on all machines in farm.

TroubleShooting with Sharepoint 2010 Diagnostic Log Compression (DLC) v1.0

Here is the checklist.

1)      Check all WFE and APP servers gac folder that the assambly file of DLC named “DiagnosticLogCompression.dll” has registered.

2)      Check Sharepoint Timer Job Service is running and has correct account on every WFE and APP Servers.

3)      Check Diagnostic Log Compression feature is installed and enabled on Sharepoint Central Administration Application

CA-> Site Settings -> Manage Site Features  and check Diagnostic Log Compression Feature is activated.

4)      Check Sharepoint Timer Job Service Identity has enough rights to read/write to destination folder for log copy/move operations.

5)      If you are using UNC path check from every WFE and APP server havent any connection problem to reach defined UNC.

6)      Monitor from ULS Log via ULS viewer that Compression job is running as expected.

You can download ULS Viewer from this link :

Job Starting Message:

DLC -> Job:  Message:Job Starting

Directory Check Message:
DLC -> Job:  Message:Directory is OK! :   \\YOUR_NETWORK_PATH

The Log file is inuse message:

DLC -> Job:  Message:File in usage:C:\Program Files\Common Files\Microsoft Shared\Web Server

Several processed log file message:

DLC -> Job:  Message:Processing -> C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS\POSTPOINT2010-20110606-1744.log

Finish message:

DLC -> Job:  Message:Job completed successfully

7)      If you do any update or manuel installation don’t forget to reset Sharepoint Timer job Service on updated server. For example getting Error of in ULS Log:

06/10/2011 19:36:03.45               OWSTIMER.EXE (0x21BC)             0x2018  SharePoint Foundation               Topology            umbo    High       The type DiagnosticLogsHelper.JobLogCompress, DiagnosticLogCompression, Version=, Culture=neutral, PublicKeyToken=c1b6bc305019fff6 could not be found in its specified assembly.  Scanning all assemblies that have been loaded in the current app domain.      

end of list.