Using ULS Viewer to Monitor and Filter SharePoint 2013 Logs

If you’re trying to troubleshoot an error in your SharePoint 2013 environment and you’ve been struggling to find the error in the logs, you’re going to love this free utility from Microsoft that lets you quickly and easily monitor your SharePoint 2013 trace logs. Today I’ll introduce you to ULS Viewer, I’ll show you how to download it, and I’ll share some configuration tips.

What Is ULS Viewer?

ULS Viewer is a free utility created by Microsoft that runs on your SharePoint server and connects to the log files that are created by SharePoint 2013. It actually works on previous versions of SharePoint just as well as it does on 2013. You can download and run ULS Viewer on the SharePoint server, or it can run on your workstation and connect to the SharePoint logs from across the network.

When run on a SharePoint server, ULS Viewer can automatically connect to the SharePoint logs on the local server. If you run it from your workstation, it takes just a couple of extra steps to connect from across the network. You can also connect to more than one server to get a look at the bigger picture. All in all, ULSViewer is a great utility for any SharePoint administrator.

The only catch is that the software is offered with no support. If it doesn’t work for you for some reason, Microsoft isn’t going to put in effort to resolve your issues with it. That said, it works for most people; even if you do run into problems with it you may be able to get a fix for it from the user community.

Downloading the ULS Viewer

Lucky you can download the ULSViewer from Microsoft for free. If you’re looking for installation steps, there’s not much to it. Just download it and run the executable.

Running the ULS Viewer on a Single SharePoint Server

If you have a single server farm, you can go straight to the server and run ULSViewer from there. Just move the ULSViewer executable to the server and run it.

Running ULS Viewer from Your Workstation

This is where the ULS Viewer really shines. Since you’re able to connect across servers, you can see all of the logs from all of your SharePoint servers in real time without having to collate or switch between RDP sessions!

• Move the ULS Viewer executable to your workstation and start it.
• From the main window of ULS Viewer, select File, then Open from ULS.

• Provide the path to the ULS logfiles for your SharePoint server.

• Repeat for each server that you want to monitor. Each servers ULS logs will show up as a new tab.

• Click File >> Save Workspace to make it easy to connect to your servers in the future.

You’ll now be connected to your SharePoint servers and will start getting real time updates to all of your SharePoint 2013 events.

ULS Viewer Configuration Tips

Here’s how I use ULS Viewer to get a really fast look into what’s going on in the SharePoint logs.

Use Notifications to Get Popups or to Watch for Specific Events

Notifications can be used to give you a popup notification when a specific event occurs.

If you’re looking away or don’t have the window active, your notifications window will give you a popup that indicates you have new events.  The notifications window is collected from all open tabs.

• Click the Show Notifications button to turn on the processing so that items you’ve set in your notifications filter will be added to your notifications list.
• Click Notifications List to see the current list of events that have been added to your notifications list.
• Use the Clear button on the notifications list to clear it. This doesn’t actually remove the events from the logs, just your notifications list.

You can choose many different filtering options for your notification list. The default adds only critical events to your notifications list, but you could very easily include only notifications from a specific product, category, or correlation ID by choosing Tools >> Notification Filters from the menu.

Applying Filters to Your Logs

Just like the filters that you can add to the notifications tab, you can apply filters to any of the tabs in your workspace.

Available keys to filters on are Time, Process, Thread, Product, Category, EventID, Level, Correlation, Message and Server. You can use the operation tab column to specify Equals, Not Equals, Contains, Not Contains, a Regex Match, or Greater or Less than a specific time. Then you can set your value to compare in your filter. Finally, you can specify whether your filtering conditions have to match all of your rules or whether being “true” on even a single condition means will apply the filter.

Using the Correlation Filter

On each open tab, you can add a correlation tree that lists all of the correlation ID in a tree view and lets you quickly scan through just the correlation IDs. Find the correlation ID you’re looking for and select it to get all of the events that have that same ID. This is a really fast way to find out what’s going on with a repeatable error that you or one of your users is experiencing. To enable the correlation ID tree, you can click the Correlation ID Tree View icon from the toolbar menu.

If you prefer to always have the correlation ID tree view enabled, you can make it enabled by default from the Tools >> Options menu.

Close What You’re Not Using

Running the ULS Viewer does take up some resources, so you should close out your sessions when you’re not using them anymore.

If you forget to close out your sessions, you’ll get a notice at the two-hour mark to let you know that your session should be closed out, and if you’re still using it to close out the tabs and re-open them.