Share via

SharePoint 2016 Managing the Logging using PowerShell

  • Article

Logging is a backbone of any software’s success. Logging help the System administrator, IT developers and support personnel to troubleshoot an issue & identify the root cause. With the help of logging, one can quickly identify the issue and provide the resolution to the issue. 

In SharePoint, Microsoft implements the logging called as Unified Logging Service. ULS is a way to keep track of problems with components and applications, provide quantifiable statistics for an application's history, help in troubleshooting issues, as well as help in monitoring the overall health of the systems that administrators are responsible for.

In SharePoint 2016, we have the many PowerShell cmdlets which help us to manipulate the ULS logs. In this article, I will give a brief overview along with the example for all available commands.

  • Get-SPLogLevel
  • Set-SPLogLevel 
  • Clear-SPLogLevel
  • Get-SPLogEvent
  • Get-SPDiagnosticConfig
  • Set-SPDiagnosticConfig
  • Get-SPDiagnosticsProvider
  • Set-SPDiagnosticsProvider
  • New-SPLogFile
  • Merge-SPLogFile
  • New-SPUsageLogFile

Get-SPLogLevel

The Get-SPLogLevel cmdlet displays a list of objects or diagnostic levels based on the criteria specified. If no parameter is specified, a list of all diagnostic levels for all categories is returned. SharePoint divide into more than 25 major areas along with dozens of the category in each area.

Examples:

 Get-SPLogLevel

This command will return throttle level for categories

Get-SPLogLevel -Identity "SOAP"

This command will return the throttle level for SOAP category.

Get-SPLogLevel -Identity "eApproval:*"

This command will retutn throttle level for all categories under the eApproval Area.​

Get-SPLogLevel -Identity "eApproval:*", General, audit

This command will return throttle level for everything from eApproval area along with General, Audit. Note general category is part of different area so it will return everything.

Set-SPLogLevel 

The Set-SPLogLevel cmdlet sets the Windows event logging and trace logging levels for one or more diagnostic logging categories registered in the farm. If an event or trace associated with a category occurs, but is less severe than that category's logging level, the event or trace is not written to the event log or the trace log. If an event or trace associated with a category occurs and is equally severe or more severe than that category's logging level, the event or trace is written to the event log or the trace log.

Parameters

  • Identity (Optional, System.String[]): Specifies the name(s) of the category or set of categories to set the throttle for; for example, "Unified Logging Service". If the Identity parameter is not specified, the event-throttling setting is applied to all categories in the farm. If you want to set the throttle  to more than one categories then use "," between them i.e "soap","General","Admin"

  • InputObject (Optional, System.Management.Automation.PSObject): The InputObject is pipelined to the cmdlet and can be a string in a format identical to the Identity parameter, or can be an SPDiagnosticsCategory object. The user can retrieve one or more categories from the Get-SPLogLevel cmdlet, modify the category values, and then pipeline them into the Set-SPLogLevel cmdlet.

  • **EventSeverity (Optional, System.String): **Specifies the category level to be set. The category level is any one of the following values:

    • None
    • ErrorCritical
    • Error
    • Warning
    • Information
    • Verbose

  • TraceSeverity (Optional, System.String): Specifies trace throttle to set the specified category(ies) to. The trace log files are text files that are written to the trace log path that is defined on the Diagnostic Logging Settings page on the SharePoint Central Administration site. The type must be any one of the following values:

    • None (no traces are written to the trace log)
    • Unexpected
    • Monitorable
    • High
    • Medium
    • Verbose
    • VerboseEx

Examples**:**

set-sploglevel -TraceSeverity Verbose -EventSeverity Verbose

This example sets the TraceSeverity and EventSeverity values for all categories to Verbose

Set-SPLogLevel -TraceSeverity High -EventSeverity Warning -Identity "audit"

This example sets the EventSeverity values to high and TraceSeverity value to warning for a single category(Audit).

Set-SPLogLevel -EventSeverity Verbose -Identity SOAP, General, audit, "Business Data"

This example sets the EventSeverity values to Verbose for multiple categories( Soap, General, audit, "Business Data" categories).

Set-SPLogLevel --TraceSeverity High -EventSeverity Warning -Identity "eApproval:*"

This example sets the EventSeverity values to high and TraceSeverity value to warning for all categories in the same area(eApproval is the area) .

The Clear-SPLogLevel

The Clear-SPLogLevel cmdlet resets the Windows event logging and trace logging levels for the specified categories to the default values. If the Identity parameter is not provided, all categories are affected.

Parameters

  • Identity (Optional,System.String[]): Specifies the name(s) of the category or set of categories to set the throttle for; for example, "Unified Logging Service". If the Identity parameter is not specified, the event throttling setting is applied to all categories in the farm. Providing an invalid category is a non-terminating error and will be ignored.
  • **InputObject (Optional, System.Management.Automation.PSObject):**Specifies the result of the InputObject parameter to be piped. The value can be a string in a format identical to the Identity parameter, or can be an SPDiagnosticsCategory object. The user can retrieve one or more categories from the Get-SPLogLevel cmdlet, modify their values, and then pipe the results to the Set-SPLogLevel cmdlet.

Example

Clear-SPLogLevel

This example resets the log levels for all categories to default. 

Clear-SPLogLevel -Identity "audit"

This example resets the log levels for a single category to default.

  Clear-SPLogLevel -Identity SOAP, General, audit, "Business Data"

This example resets the log levels for multiple categories(SOAP, General, audit, "Business Data") to default.

  Clear-SPLogLevel -Identity "eApproval:*"

This example resets the log levels for all categories in a single Area( eApproval area) to default.

New-SPLogFile

The New-SPLogFile cmdlet ends the current log file and starts a new log file.

Parameters:

  • **AssignmentCollection (Optional,Microsoft.SharePoint.PowerShell.SPAssignmentCollection)**Manages objects for the purpose of proper disposal. Use of objects, such as SPWeb or SPSite, can use large amounts of memory and use of these objects in Windows PowerShell scripts requires proper memory management. Using the SPAssignment object, you can assign objects to a variable and dispose of the objects after they are needed to free up memory. When SPWeb, SPSite, or SPSiteAdministration objects are used, the objects are automatically disposed of if an assignment collection or the Global parameter is not used.
    NoteNote: When the Global parameter is used, all objects are contained in the global store. If objects are not immediately used, or disposed of by using the Stop-SPAssignment command, an out-of-memory scenario can occur.

Example:

 New-SPLogFile

This example ends the current log file and starts a new log file.

New-SPUsageLogFile

The New-SPUsageLogFile cmdlet starts a new usage log file on the current server computer. The usage data in memory is flushed to the current usage log file before the new log file is created. 
Note: If you have more than one server in farm then you have to run this command on each server in order to start new usage log file

Parameters

  • **AssignmentCollection (Optional,Microsoft.SharePoint.PowerShell.SPAssignmentCollection)**Manages objects for the purpose of proper disposal. Use of objects, such as SPWeb or SPSite, can use large amounts of memory and use of these objects in Windows PowerShell scripts requires proper memory management. Using the SPAssignment object, you can assign objects to a variable and dispose of the objects after they are needed to free up memory. When SPWeb, SPSite, or SPSiteAdministration objects are used, the objects are automatically disposed of if an assignment collection or the Global parameter is not used.
    NoteNote:When the Global parameter is used, all objects are contained in the global store. If objects are not immediately used, or disposed of by using the Stop-SPAssignment command, an out-of-memory scenario can occur.

Example

  New-SPUsageLogFile​

This example terminates the current usage log file and creates a new one.