Have you tried the Merge-SPLogFile command when troubleshooting?

When troubleshooting SharePoint issues, the best way to filter out all the noise from your log files and sort it for easier troubleshooting is to use the ULS Log viewer tool.

Refer to my blog post on the ULS Log viewer comparison and verdict to get a feel for the other options and see how I got to my conclusion there. http://www.jeremytaylor.net/2012/07/14/sharepoint-uls-log-viewer-tool-comparison-and-verdict/

However, this ULS Log viewer tool does not display logs from other servers in the SharePoint farm, unless obviously its a single server farm.

The way to help you with a multiserver farm is to run the Merge-SPLogFile command in the SharePoint management shell. This command “merges” all logs from other servers in the farm and combines them into one ULS log file on the local server. That file can then be opened in your favourite ULS log viewer for troubleshooting.

Note: this works in both SharePoint 2013 and SharePoint 2010.

So how do we use it?

Here is an example of how I use it to grab all logs between say 10AM and 10:30AM on the 23rd July 2013:

Merge-SPLogFile -Path "D:\Temp\MergedLog-20130723-1000-1030.log" -StartTime "23/07/2013 10:00:00" -EndTime "23/07/2013 10:30:00"

If I know the correlation ID, then I would recommend you run the following command after updating it to your correlation ID:

Merge-SPLogFile -Path D:\Temp\MergedLog-419ac99c-81b2-0077-378d-3c23767d2955.log -Correlation 419ac99c-81b2-0077-378d-3c23767d2955

 

 

2014-11-07_10-39-43

Merge-SPLogFile looks across all the servers in the farm, aggregates the logs with the correlation ID and creates the aggregated .log file.

The merged log file containing only the  information you specified and require. In this case, a certain correlation ID.

The merged log file containing only the information you specified and require. In this case, a certain correlation ID.

 

Open the log file up in ULSViewer!

Open the log file up in ULSViewer!

 

There are a lot more examples of what you can do with Merge-SPLogFile you can get by typing this in the SharePoint management shell:

Get-help Merge-SPLogFile -examples

Here is the output from running get-help Merge-SPLogFile -examples in SharePoint 2013:

————–EXAMPLE 1—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite

This example merges the last hour of log data from all farm computers with
no filtering.

————–EXAMPLE 2—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite -Area
Search

This example merges the last hour of log data from the Search area.

————–EXAMPLE 3—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite -Area
“SharePoint Foundation”,”Web Analytics Services”

This example merges the last hour of log data from the SharePoint
Foundation and Web Analytics Services areas.

————–EXAMPLE 4—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite -Level
High

This example merges the log data of level High or higher.

————–EXAMPLE 5—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite
-StartTime “06/09/2008 16:00” – EndTime “06/09/2008 16:15”

This example merges the log data for events in a particular time range,
which is culture-specific to the United States.

————–EXAMPLE 6—————–

C:\PS>Merge-SPLogFile -Path “C:\Logs\FarmMergedLog.log” -Overwrite
-Message “permission changed

This example merges the log data for events with permission changed in the
message text.

————–EXAMPLE 7—————–

C:\PS>Merge-SPLogFile -Overwrite -Path d:\1.log -ContextFilter “name=timer
job” -Area “search*”

This example merges the log data for all search timer jobs.

————–EXAMPLE 8—————–

C:\PS>Merge-SPLogFile -Overwrite -Path d:\2.log -ContextFilter
“user=contoso?joeuser”

This example shows how to merge the log data for all user names that have
a contoso\joeuser or Contoso/joeuser format.

Leave a Reply

Your email address will not be published. Required fields are marked *