View diagnostic logs (SharePoint Foundation 2010)

Applies to: SharePoint Foundation 2010

You can use data from the Universal Logging System (ULS) logs in Microsoft SharePoint Foundation 2010 to troubleshoot problems in the farm. The ULS log can collect data at varying levels depending upon the logging settings. You can use Windows PowerShell to filter the data, display it in various ways, and output the data to a data grid with which you can filter, sort, group, and export data to Microsoft Excel 2010.

For more information, see Configure diagnostic logging (SharePoint Foundation 2010).

View and filter log events by using Windows PowerShell

You can use Windows PowerShell to view and filter log events. You cannot view or filter log events by using Central Administration.

To view and filter log events by using Windows PowerShell

1. Verify that you meet the following minimum requirements: See Add-SPShellAdmin.

2. On the Start menu, click All Programs.

3. Click Microsoft SharePoint 2010 Products.

4. Click SharePoint 2010 Management Shell.

5. At the Windows PowerShell command prompt, type one of the following commands:

   • All trace events:

     Get-SPLogEvent

   • By level:

     Get-SPLogEvent | Where-Object {$_.Level -eq [Information | Warning | Error | Critical | Verbose | Unexpected | Monitorable | High | Medium]}

   • By area:

     Get-SPLogEvent | Where-Object {$_.Area -eq <Area>}

     Where <Area> is the value of the Area property.

   • By category:

     Get-SPLogEvent | Where-Object {$_.Category -eq <Category>

     Where <Category > is the value of the Category property.

   • By event ID:

     Get-SPLogEvent | Where-Object {$_.EventID -eq <EventID>}

     Where <EventID> is the value of the EventID property.

   • By message text:

     Get-SPLogEvent | Where-Object {$_.Message -like "*<string>*"}

     Where <string> is the string found in the event message.

   • By process:

     Get-SPLogEvent | Where-Object {$_.Process -like "*<Process>*"}

     Where <Process > is the value of the Process property.

   Tip

   By default, the command retrieves data from the default ULS log folder. To view and filter trace events that are on shared folder on a network, use the Directory parameter of the Get-SPLogEvent cmdlet.
   To view more details about each trace event, use Format-List at the end of the command. For example, Get-SPLogEvent | Where-Object {$_.Area -eq "SharePoint Foundation"} | Format-List.

For more information, see Get-SPLogEvent.

View and export diagnostic logs by using the Windows PowerShell Out-GridView cmdlet

Windows PowerShell provides a powerful and easy-to-use feature that displays tabular data resulting from Windows PowerShell commands in a filterable, searchable data grid in a separate window. You can use this grid to view log events and to perform the following operations on the data:

• Sort the data by any column.

• View the data in groups.

• Filter the data by Level, Area, Category, Message, Event ID, or Timestamp.

• Search the data for any string.

• Export raw or sorted or filtered data to a spreadsheet.

For more information, see Out-GridView (https://go.microsoft.com/fwlink/p/?LinkId=181248) and Out-GridView Revisited (https://go.microsoft.com/fwlink/p/?LinkId=181249).

To view and filter diagnostic logs by using Windows PowerShell

1. Verify that you meet the following minimum requirements: See Add-SPShellAdmin.

2. On the Start menu, click All Programs.

3. Click Microsoft SharePoint 2010 Products.

4. Click SharePoint 2010 Management Shell.

5. At the Windows PowerShell command prompt, type the following command:

   Get-SPLogEvent | Out-GridView

6. To view the results in groups:

   1. Right-click the column header, click Show In Groups, and then click the column header for the value by which you want to group the results.

   2. To expand or collapse a specific group, click the arrow next to the group name.

   3. To remove grouping, right-click the column header, and then click Show In Groups.

7. To sort columns, click the column header.

8. To search for a specific string, type the string in the Search box. Search is performed over all columns and rows. To clear the search, click Clear All.

9. To filter data on only one criterion, type the following in the Search box: <property name>:<value>. For example, to search for all log entries raised by SharePoint Foundation 2010, type the following: Area:SharePoint Foundation. To clear the filter, click Clear All.

10. To filter data by using more than one criterion or by using criteria with “contains, begins with, ends with” or other methods:

    1. Click Query.

    2. Click Add.

    3. Click the check box for the properties that you want to filter on, and then click OK.

    4. Click contains to change to a different filter method. The methods available are contains, does not contain, starts with, equals, does not equal, ends with, is empty, and is not empty.

    5. Type a value in the text box.

    6. Repeat steps “e” and “f” for each property you selected in step “c”.

    7. When all the filtering criteria are specified, click the search button to filter the data grid.

    8. To clear a specific filter, click the X button.

    9. To clear all the filters, collapse the query view and click the Clear All button.

To export grid data to a spreadsheet

1. Select the rows that you want to export. You can select multiple rows by using SHIFT+DRAG to select a block of rows, CTRL+CLICK to select specific rows, or CTRL+A to select all rows.

   You can also filter and sort the results before you copy the data into a spreadsheet. When you sort or filter data, only the resulting viewable data is copied over.

2. Copy the selected rows by using CTRL+C.

3. Open the spreadsheet workbook page, and then paste the copied rows into it by using CTRL+V.

See Also

Concepts

Configure diagnostic logging (SharePoint Foundation 2010)
Monitoring overview (SharePoint Foundation 2010)