Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

View diagnostic logs in SharePoint 2013

Published: October 16, 2012

Summary: Learn to view and filter log events by using Windows PowerShell, and view and export diagnostic logs by using the Out-GridView cmdlet.

Applies to:  SharePoint Foundation 2013 | SharePoint Server 2013 

You can use data from the Unified Logging Service (ULS) logs in SharePoint 2013 to troubleshoot problems in the farm. The ULS logs can collect data at varying levels depending on the logging settings. You can use Windows PowerShell to filter the data, display it in various ways, and output the data to a data grid with which you can filter, sort, group, and export data to Excel 2013.

For more information, see Configure diagnostic logging in SharePoint 2013. For more information about viewing SharePoint 2013 reports and logs, see View reports and logs in SharePoint 2013.

In this article:

Before you begin

For more information about viewing SharePoint 2013 reports and logs, see View reports and logs in SharePoint 2013.

note Note:

Because SharePoint 2013 runs as websites in Internet Information Services (IIS), administrators and users depend on the accessibility features that browsers provide. SharePoint 2013 supports the accessibility features of supported browsers. For more information, see the following resources:

View and filter log events by using Windows PowerShell

You can use Windows PowerShell to view and filter log events. You cannot view or filter log events by using the SharePoint Central Administration website.

To view and filter log events by using Windows PowerShell

  1. Verify that you have the following memberships:

    • securityadmin fixed server role on the SQL Server instance.

    • db_owner fixed database role on all databases that are to be updated.

    • Administrators group on the server on which you are running the Windows PowerShell cmdlets.

    An administrator can use the Add-SPShellAdmin cmdlet to grant permissions.

    note Note:

    If you do not have permissions, contact your Setup administrator or SQL Server administrator to request permissions. For additional information about Windows PowerShell permissions, see Add-SPShellAdmin.

  2. On the Start menu, click All Programs.

  3. Click Microsoft SharePoint 2013 Products.

  4. Click SharePoint 2013 Management Shell.

  5. At the Windows PowerShell command prompt, type the following command:

    • All trace events:

      Get-SPLogEvent
      
    • By level:

      Get-SPLogEvent | Where-Object {$_.Level -eq "Information" }
      
    • By area:

      Get-SPLogEvent | Where-Object {$_.Area -eq <Area>}
      

      Where <Area> is the value of the Area property.

    • By category:

      Get-SPLogEvent | Where-Object {$_.Category -eq <Category>
      

      Where <Category> is the value of the Category property.

    • By event ID:

      Get-SPLogEvent | Where-Object {$_.EventID -eq <EventID>}
      

      Where <EventID> is the value of the EventID property.

    • By message text:

      Get-SPLogEvent | Where-Object {$_.Message -like "<string>"}
      

      Where <string> is the string found in the event message.

    • By process:

      Get-SPLogEvent | Where-Object {$_.Process -like "<Process>"}
      

      Where <Process> is the value of the Process property.

    By default, the command retrieves data from the default ULS log folder. To view and filter trace events that are on shared folder on a network, use the Directory parameter of the Get-SPLogEvent cmdlet.

    To view more details about each trace event, use the Format-List cmdlet at the end of the command. For example,

    Get-SPLogEvent | Where-Object {$_.Area -eq "SharePoint Foundation"} | Format-List
    

For more information, see Get-SPLogEvent.

note Note:

We recommend that you use Windows PowerShell when performing command-line administrative tasks. The Stsadm command-line tool has been deprecated, but is included to support compatibility with previous product versions.

View and export diagnostic logs by using the Windows PowerShell Out-GridView cmdlet

Windows PowerShell provides a powerful and easy-to-use feature that displays tabular data resulting from Windows PowerShell commands in a filterable, searchable data grid in a separate window. You can use this grid to view log events and to perform the following operations on the data:

  • Sort the data by any column.

  • View the data in groups.

  • Filter the data by Level, Area, Category, Message, Event ID, or Timestamp.

  • Search the data for any string.

  • Export raw or sorted or filtered data to a spreadsheet.

note Note:

The Out-GridView cmdlet cannot be used with cmdlets that use the Format verb. The Out-GridView cmdlet receives objects whereas the cmdlets that use the Format verb return only formatted text.

You can view a subset of the data by using the Where-Object cmdlet that filters and passes the results to the Out-GridView cmdlet. For example, Get-SPLogEvent | Where-Object {$_.Area -eq "SharePoint Foundation"} | Out-GridView.

If the grid is displaying more than several hundred rows, it might run slowly, especially if performing complex filtering operations. For faster performance, export the data to Excel 2013.

To view and filter diagnostic logs by using Windows PowerShell

  1. Verify that you have the following memberships:

    • securityadmin fixed server role on the SQL Server instance.

    • db_owner fixed database role on all databases that are to be updated.

    • Administrators group on the server on which you are running the Windows PowerShell cmdlets.

    An administrator can use the Add-SPShellAdmin cmdlet to grant permissions.

    note Note:

    If you do not have permissions, contact your Setup administrator or SQL Server administrator to request permissions. For additional information about Windows PowerShell permissions, see Add-SPShellAdmin.

  2. On the Start menu, click All Programs.

  3. Click Microsoft SharePoint 2013 Products.

  4. Click SharePoint 2013 Management Shell.

  5. At the Windows PowerShell command prompt, type the following command:

    Get-SPLogEvent | Out-GridView
    
  6. To sort columns, click the column header.

  7. To search for a specific string, type the string in the Filter box. Search is performed over all columns and rows. To clear the search, click X.

  8. To filter data on only one criterion, type the following in the Search box: <property name>:<value>. For example, to search for all log entries raised by SharePoint Foundation 2013, type the following: Area:SharePoint Foundation. To clear the filter, click X.

  9. To filter data by using more than one criterion or by using criteria with "contains, begins with, ends with" or other methods:

    1. Click Add criteria button.

    2. Click the check box for the properties that you want to filter on, and then click Add.

    3. Click contains to change to a different filter method. The methods that are available are contains, does not contain, starts with, equals, does not equal, ends with, is empty, and is not empty.

    4. Type a value in the text box.

    5. Repeat steps "c" and "d" for each property that you selected in step "b".

    6. When all the filtering criteria are specified, the data that satisfies the criteria will appear.

    7. To clear a specific filter, click the X button.

    8. To clear all the filters, collapse the query view and then click the Clear All button.

To export grid data to a spreadsheet

  1. Select the rows that you want to export. You can select multiple rows by using SHIFT+DRAG to select a block of rows, CTRL+CLICK to select specific rows, or CTRL+A to select all rows.

    You can also filter and sort the results before you copy the data into a spreadsheet. When you sort or filter data, only the resulting viewable data is copied over.

  2. Copy the selected rows by using CTRL+C.

  3. Open the spreadsheet workbook page, and then paste the copied rows into it by using CTRL+V.

For more information, see Out-GridView (http://go.microsoft.com/fwlink/p/?LinkId=181248) and Out-GridView Revisited (http://go.microsoft.com/fwlink/p/?LinkId=181249).

note Note:

We recommend that you use Windows PowerShell when performing command-line administrative tasks. The Stsadm command-line tool has been deprecated, but is included to support compatibility with previous product versions.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.