Share via

SharePoint: View Diagnostic Logs Using PowerShell

  • Article

This post discusses Merge-SPLogFile and Get-SPLogEvent in both versions SharePoint 2010 and 2013.

Cmdlet

Description

 Purpose

Get-SPLogEvent

Reads/queries ULS trace logs.

Trace Log Querying and Filtering

Merge-SPLogFile

Combines trace log files from all farm servers into a single file in local machine.

Trace Log Merging

Merge-SPLogFile

Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. This command can be run from PowerShell.

This will be very helpful when working in multiserver environments. As SharePoint maintains log entries in each server, by using this command it can pull them in a single file.

Filtering can be based on various criteria like StartTime, EndTime, Process, Area, Category, EventID and Message, etc.

If you are a Server Administrator then it's great that you have shell admin rights to troubleshoot.

Let’s see how these cmdlets will be helpful.

So we got an error. Open SharePoint Management Shell (run as administrator) on any SharePoint server of the farm.

Run the Merge-SPLogFile cmdlet. Using the correlation ID from our error above, we have something that looks like this:

Merge-SPLogFile -Path ".\error.log" -Correlation "5ca5269c-8de5-4091-3f1b-f179af4d5121"

We can then open our log file with ULS Viewer and see the specific exception:

See more for more filtered result

Syntax given in TechNet : Merge-SPLogFile (https://technet.microsoft.com/en-us/library/ff607721.aspx)

Get-SPLogEvent

Source: Get-SPLogEvent (https://technet.microsoft.com/en-us/library/ff607589.aspx)

One of the quick & awesome ways to do this is to simply hook up a PowerShell console (SharePoint 2010 Management Shell) and then write the following command (replace the <GUID> with the Correlation Id ):

Get-SPLogEvent | ?{$_Correlation -eq "<GUID>" }

You might want to be more precise and get more specific details out of your query, you can try something like this:

Get-SPLogEvent | ?{$_.Correlation -eq "<GUID>"} | select Area, Category, Level, EventID, Message | Format-List > C:\mylog.log

Hope this will be helpful!!!

See Also

 For more information about viewing SharePoint logs using Get-SPLogEvent, see TechNet Articles:

Powershell Cmdlets with ULS Logging: