locked
What is the best way to interpret the sharepoint logs in the 12 hive? RRS feed

  • Question

  • Hi,

    So very often people suggest that the answer to an error or something going wrong in sharepoint is to check the logs.

    Sometimes i do this - almost never do i get any useful info.

    This makes me think that i dont really know how to interpret them - so i am wondering:

    • How do you go about analysing the logs for sharepoint?
    • Do you use any special tools? (logparser maybe)
    • Do you look at all of them and aggregate the info or just the log edited when the error is raised - if so how do you easily find this log out of the minor haystack of logs? Is it always the last one by date/time modified?

     

    Thanks,

    • Edited by Mike Walsh FIN Wednesday, March 16, 2011 9:11 AM in your opinion removed from Title
    Wednesday, March 16, 2011 9:05 AM

Answers

  • Different people will give you different information here, but here are my own thoughts: -

    1. People suggest looking at these for a reason.  These logs will capture EVERYTHING, depending on the level that they've been set too.  If you're supporting a user, looking into problems with new installations, or any other myriad of problems, something will be captured here.
    2. I don't use any logs personally.  Just ctrl-f for time stamps or specific keywords around the time that my incident occured
    3. Again, think about what you're asking to support.  I've just taken a look at my latest log and its called 'SHAREPOINT-20110316-1147.log' Look at the name '20110316' refers to the date, in reverse, with the subsequent '1147' being the time the last item was appended to the log.  You'll get one of these for each day.
    4. My log has the following headers "Timestamp, Process, TID, Area, Category, EventID, Level, Message, Correlation", which contains information for one entry.  Just make sure you turn off wordwrap or it'll look very jumbled

    Overall, I think you need to approach these analytically.  Just looking at them and expecting a problem to be instantly solved isn't realistic.  Look for specifics, and take the mindset that if the log doesn't give you an immediate idea, it will more often than not give you a lead of what to look at,

    I hope that helps, but let me know if you hae any more questions.


    Steven Andrews | SharePoint Professional | http://www.twitter.com/backpackerd00d | https://baron72.wordpress.com/
    Wednesday, March 16, 2011 11:59 AM
    Answerer

All replies

  • Different people will give you different information here, but here are my own thoughts: -

    1. People suggest looking at these for a reason.  These logs will capture EVERYTHING, depending on the level that they've been set too.  If you're supporting a user, looking into problems with new installations, or any other myriad of problems, something will be captured here.
    2. I don't use any logs personally.  Just ctrl-f for time stamps or specific keywords around the time that my incident occured
    3. Again, think about what you're asking to support.  I've just taken a look at my latest log and its called 'SHAREPOINT-20110316-1147.log' Look at the name '20110316' refers to the date, in reverse, with the subsequent '1147' being the time the last item was appended to the log.  You'll get one of these for each day.
    4. My log has the following headers "Timestamp, Process, TID, Area, Category, EventID, Level, Message, Correlation", which contains information for one entry.  Just make sure you turn off wordwrap or it'll look very jumbled

    Overall, I think you need to approach these analytically.  Just looking at them and expecting a problem to be instantly solved isn't realistic.  Look for specifics, and take the mindset that if the log doesn't give you an immediate idea, it will more often than not give you a lead of what to look at,

    I hope that helps, but let me know if you hae any more questions.


    Steven Andrews | SharePoint Professional | http://www.twitter.com/backpackerd00d | https://baron72.wordpress.com/
    Wednesday, March 16, 2011 11:59 AM
    Answerer
  • That's very handy thanks.
    Tuesday, April 5, 2011 12:40 PM