ULS Viewer, for SharePoint 2010 Troubleshooting

My friend Dan Winter posted 2009 SharePoint Toolbox Review today on his blog. Within the post, the best tool I like is the ULS Viewer. If there’s an election of SharePoint Administrator troubleshooting tools, I would vote it as the president!

So what is ULS? It stands for Unified Logging Service. Mr. Winter explained that a lot in his blog so I would not repeat. But, it is the top one thing you should look at when you want to troubleshoot some SharePoint issue. Of course, troubleshooting is not always to get the symbols, debug and trace problems… If that is indeed needed, then it may be a bug.  Most of the time, ULS log is already quite helpful. For example, sometimes I got a service error in the webpage, some errors in event log, but nothing told the exact root of the problem. Then when I looked into ULS log, it told me that the credential of the user did not work. It is really helpful.

I did a user research earlier this year, more than 75% of SharePoint Administrators had no idea about ULS log. There’re some reasons. Since the ULS log is designed mainly for product group and customer service usage, the default format is not very user friendly. The log is hard to read, and you may get overwhelming messages instead of the useful ones. Now, we have ULS Viewer to solve the problem.

For SharePoint 2010, by default, ULS log is at

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS

You can check the directory and try to read those logs. I was quite used to that, with notepad:)

ULS Viewer can be used in different modes. The log can be read from log files, real time ULS log, or even clipboard. Here’s some examples:

On a machine running SharePoint 2010, run ULS Viewer. Click File, Open From, then choose ULS (This could also be done by simply press Ctrl+U). Immediately the logs will be shown in real-time. You can filter message level by click the icons in the middle. This can tell you what is going on inside SharePoint.


The best feature I love is the Toggle Correlation Tree button. In SharePoint 2010 we can use correlation id to trace a series of event inside SharePoint. For example, in this screenshot, my machine is trying to flush usage log. The different entries may be buried in the big ULS log file, but with correlation id you can easily track them – they shared the same id “c000006c-5b56-412b-9de1-78aae06d121f”.


Another good feature is the notifications. You can set notification level for ULS Viewer, by default it will pop up notification for Critical message. For example in this screenshot, when Health Analyzer checked my machine for a security rule, it wrote a critical message into the log. With ULS Viewer, you can quickly identify the location of the message. If there’s an exception, you can also check the detail of that.


I’m ready to throw my notepad away – ULS Viewer is the one to go with, for troubleshooting.