SharePoint ULS log viewer

For the updated ULS Viewer go to: http://www.jeremytaylor.net/2014/08/27/uls-log-viewer-sharepoint-2013/

When using SharePoint 2010 or SharePoint 2013, you will notice much said about the “ULS logging”.  Here is a tool that greatly helps when troubleshooting ULS log files. Its from Microsoft but its unsupported now as they have stopped further development / improvements on it.

Summary

ULSViewer allows users to open a ULS log file and display its contents in a user friendly format. Users can then perform advanced functions such as filtering, sorting, highlighting, loading logs, appending logs, etc in order to single out the data that is important to the user. This information can be used to diagnose problems with machines running ULS services, or to monitor machines and the events they create in realtime.

Introduction

This article discusses the ULS Viewer tool.

ULSViewer allows users with access to ULS log files to view their logs in a more user friendly interface instead of using standard log file viewers. Logs opened can be filtered, sorted, highlighted, appended, etc in order to single out the data that is important to the user. This information can be used to diagnose problems with machines running ULS services, or to monitor machines and the events they create.
The ULSViewer tool runs on either 32 or 64 bit architectures of Microsoft Windows 2003 Server, Windows 2008 Server, Windows 2008 Server R2, Windows 7, Windows Vista, and Windows XP.
Features
The ULSViewer tool performs various actions against the data from ULS log files in order to better analyze it.  ULSViewer allows the user to:

  • Highlight data of importance to the user on the fly
  • Bookmark log entries
  • Append logs to other logs in order to track trends
  • Hide unimportant data
  • Only view critical log entries by sorting data by severity
  • Write rules to prompt the user when certain events occur
  • View your data in a spreadsheet instead of the text file ULS generates
  • Monitor remote machines logs that are running ULS services
  • Open multiple logs at the same time in order to compare log files.
  • Open logs files from multiple machines at the same time.

Installation

To obtain the ULSViewer tool, follow these steps:

  1. The following file is available for download from the MSDN Code Gallery ULSViewer site at: http://code.msdn.microsoft.com/ULSViewer

Download the ULSViewer tool now.http://code.msdn.microsoft.com/Project/Download/FileDownload.aspx?ProjectName=ULSViewer&DownloadId=7482)

  1. In the File Download dialog box, click Save, and then save the file to your machine.
  2. When the download is completed, click Close.
  3. In the folder you saved the file, double-click ULSViewer.exe.

Usage Syntax

UlsViewer.exe [-Options]Options:
file:<filename>
This will open the given file in ULSViewer
(You can omit the -file: and if the file exists, it will still work)
ulsrt
This will open the real-time ULS tracing in a tab in the ULSViewer window.
realtime:<directory>
This will make ULSViewer monitor a specific path for real-time ULS tracing.Running UlsViewer.exe without parameters will show the ULSViewer UI.

UI Detail

DROPDOWN MENUS – FILE

Save As Saves the active log window to a file
Save Workspace Saves the entire workspace including all log tabs to a file
Load Workspace Loads a previous workspace from a file
Open From
File Opens a log file from a file on the local hard drive or any networked drive
ULS Opens the current ULS log file on the machine if it is running ULS services at the time. UlsViewer will try to automatically stop process the log if running unattended for more than 2 hours to prevent memory leak.
Clipboard Opens a log file if one has been placed on the clipboard through a copy action
Append From
File Opens a file on a local or networked drive and appends it to the end of the currently opened log file
ULS Opens the current ULS log file on the machine if it is running ULS services and appends that data to the end of the currently opened log file. UlsViewer will try to automatically stop process the log if running unattended for more than 2 hours to prevent memory leak.
Clipboard Takes log data from the clipboard and appends it to the end of the end of the currently opened log file
Recent Recent drops down a list of the last log files that the user opened. From here, the user can click on any of these recent logs and they open in a new tab.
Abort Load If the user is loading a log file, abort load stops the file from being loaded to the workspace.

DROPDOWN MENUS – EDIT

Sort Entries Sorts all log data in the current tab by timestamp
Find Opens a prompt to search for a value in any field in the current log
Find Again Moves to the next instance of the last value entered in the Find box. If the user has not used the Find function it acts as if the user had selected find
Find Previous Moves to the previous instance of the last value entered in the Find box. If the user has not used the find function it acts as if the user had selected Find
Goto Opens a window where the user can enter a timestamp and have it take the user to the entry in the log as close to that timestamp as it has available
Next Same Thread Takes the currently selected log entry and jumps to the next log entry with the same thread id
Prev Same Thread Takes the currently selected log entry and jumps to the previous log entry with the same thread id
Next Same Process Takes the currently selected log entry and jumps to the next log entry with the same process id
Prev Same Process Takes the currently selected log entry and jumps to the previous log entry with the same process id
Next Same Correlation ID Takes the currently selected log entry and jumps to the next log entry with the same correlation id
Prev Same Correlation ID Takes the currently selected log entry and jumps to the previous log entry with the same correlation id
Modify Filter Opens a window for modifying the currently applied filters

  • Each line contains four filter fields, in order to specify a filter the user needs to specify
    • FIELD – This is which field in the log to look under
    • OPERATION – Specify if the user wants the field to contain or equal the value to look for
    • VALUE – Type the value that the user wants the filter to search for
    • AND/OR – Specify the modifier between individual rules applied to the filter
Toggle Bookmark Takes the currently selected log entry and tags it as a bookmark
Next Bookmark Moves to the next bookmark in the current log
Previous Bookmark Moves to the previous bookmark in the current log
Clear Bookmarks Clears all bookmark tags in the current log

DROPDOWN MENUS – FORMATTING

Edit Default Formatting Opens a window that allows for the highlighting of entries to be modified.
 

  • To add a new formatting entry select ADD.
  • Just like with the Modify Filter specify the following fields…
    • FIELD – This is which field in the log to look under
    • OPERATION – Specify if the user wants the field to contain or equal the value to look for
    • VALUE – Type the value that the user wants the filter to search for
    • AND/OR – Specify the modifier between individual rules applied to the filter
    • Then, in section two, the user can specify which colors the entries are highlighted.
    • In section three the user can specify which portions of the entry are highlighted when the event occurs.
    • Save/Save As/Load – These three buttons allow the user to save the changes to the current configuration, save the current configuration to a file, and load a previously saved format configuration.
    • Choose Columns – Opens a window that allow user to control which columns to be shown and their width.
Clear Bookmarks Clears all bookmark tags in the current log

DROPDOWN MENUS – TOOLS

Notification Filter Opens another window that allows the user to modify which log entries will prompt an on screen notification. By default, traces with Assert and Critical level will be shown in the notification list.
Options Opens another window that allows the user to control how large cache files can be, custom sounds for notifications, and if the whole row should be highlighted when using smart highlighting

DROPDOWN MENUS – WINDOW

Close Page Closes the current page
Clear Page Deletes the contents of the current page
Next Tab Switches to the next tab of log data
Previous Tab Switches to the previous tab of log data
New Tab Creates a new tab with all the trace entries in the current tab.

BUTTON PANEL

  Starts the display of the data if the user has chosen to open a log file that is being actively written to.
Pauses the display of the data from an actively written to log file.
Redirects the user to the Filter By menu which can be found by navigating EDIT > MODIFY FILTER.
Closes the currently open log file.
Opens the notification list. The list looks as follows…  

  • This screen displays a list of log entries that are flagged for notifications. The user can double click on the notification and ULSViewer will take the user to the entry.  
  • The “Clear” button will clear the list of notifications. 
  • The “Remove” button will remove the selected notification from the screen. 

The “Bookmark & Clear” button will add bookmarks to each of the events in the notification log and clear the screen.

This button will allow popup notifications when activated. If not activated it will not show the popup notifications.
Left Allows the user to select a previously saved filter and apply it.
Right Allows the user to select a previously saved format and apply it.
  Allows “VerboseEx” messages to be displayed in the data view.
  Allows “verbose” messages to be displayed in the data view.
  Allows “medium” messages to be displayed in the data view.
  Allows “high” messages to be displayed in the data view.
  Start to record incoming log file data into a new csv file.
  Stop recording incoming log file data into the csv file.
  Highlights all values in the data view that are exactly the same as the value that the mouse is hovering over.
  Changes the magnification of the log data.
   Opens a hierarchical view of the data by child/parent relationship. This data is displayed in the TREE PANEL.

DATA DISPLAY PANEL

The Data Display Panel is broken up into two different pieces, the tabbed portion and the data portion.

Tabbed Portion The tabbed portion is at the top of the screen in the many colors. Each of these tabs corresponds to one log file that is open in ULSViewer. Users can switch between them by clicking on the tabs directly.
Data Portion The data portion is the grid below the tabbed portion. The data portion is where all the data from each of the log entries are displayed on the screen. Each log file is broken up into fields like TimeStamp, PID, TID, Product, Category, Event ID, Level, Correlation, Message, etc.

 

RIGHT MOUSE BUTTON MENU

In the Data Display panel additional functionality is accessed through a right mouse button menu. 

  • Right Mouse Button Menu
      
New Page By This Item This button opens a “restrict by entry” window which allows for a filter to be applied on the fly.

  • The boxes are all populated with the selected log entry that was right clicked on. The user can now check all boxes for values that the user wants the data to be filtered by
  • For instance, if the user wanted to create a filter for the PID of a certain entry the user could right click on it, select New Page By This Item, then check the PID box and click OK. The new filtered data is opened in another tab
Filter By This Item This does the exact same thing as the “New Page By This Item” selection except that new filtered data is not opened in another tab 
Filter By This Time Range If one item is selected this button applies a filter that removes all data that did not occur at the time of the selected entry. If multiple entries are selected then the program filters for all data that occurred between the two selected log entries
Show Errors Only Applies a filter that will only show errors that occurred in the ULS log that is open
Copy Copies the log entry onto the clipboard
Export To File Exports the selected log entries to a specified file
Static Grouping
From All Groups all data in the data view panel by Time, PID, TID, Product, Category, Event, or Level
From Selected Groups all the selected data in the data view panel by Time, PID, TID, Product, Category, Event, or Level
Quick Filter Quick filter populates another menu with the values of the currently selected log entry and by selecting one of the options will filter out log entries that are not the same as the selected option.
Quick Formatting
Auto Color Column Automatically applies a coloring scheme to the first 100 different distinct column values for any given column selected
Clear All Quick Formatting Removes all currently applied quick formatting
Format when {column} is {value} Apply a specific selected color when a column contains the value under the mouse when the right click menu was invoked

TREE VIEW

The Tree panel is divided into two different areas. The top view and the data view.

Top View The top view is composed on a drop down box and a refresh button. The drop down box allows the user to choose from Correlation and all customer columns available, such as Name, Site, and User. The data in the data view is then organized in parent/child relationships to each other through one of those fields. In the above example the tree view is expressing the parent/child relationships between the log entries Correlation values.
Data View The data view just displays the relationships between the values chosen in the drop down box in the top view. The relationships can be expanded or retracted via the + or – boxes on parent nodes. When the user clicks on a node in the tree view, the Data Display Panel is filtered to show only traces related to the selected node.

Glossary

Workspace The collection of all open ULS log files regardless of active tab
EventId The specific value that is tied to a certain event that occurs in a ULS system and is written in the log
Process (Process Identification) The specific value that is tied to the product that ULS was operating under when the event was written to the log
Correlation (Correlation Identification) The specific value that is tied to the event that the certain event is correlated to
Thread (Thread Identification) The specific value that is tied to the thread that spawned the portion of ULS that created the event
Filter A user generated statement that only allows certain types of events to be displayed
Tab Any one of multiple log files that are open in the workspace
ULS (Unified Logging Service) A group of services that generate reports and monitor certain services on the users machine
Clipboard Collection of all recent copy actions

7 thoughts on “SharePoint ULS log viewer

Leave a Reply

Your email address will not be published. Required fields are marked *