Saturday, August 25, 2018

QUERYING SHAREPOINT LOG FILES USING GET-SPLOGEVENT AND MERGE-SPLOGFILE

While working with SharePoint we need to query the SharePoint log files to check exact nature and cause of error. SharePoint logs provide us vital information to resolve with any issue. SharePoint provides us correlation id to get the details about the issue, but it is difficult some times to go and check the log files and manually find the error in log and get the cause, as log files are huge sometimes.
To resolve this we have some PowerShell cmdlets which enables us to search in the SharePoint log files. Some of them are Get-SPLogEvent and Merge-SPLogFile.

Get-SPLogEvent

We can use Get-SPLogEvent to query log files when either single server farm in place or we have knowledge on which server the error gets logged.So Get-SPLogEvent will query the logs in the same server where PowerShell command gets executed.

Get-SPLogEvent| ?{ $_.Correlation -eq [CORRELATION ID] }| select Area, Category, Level, EventID, Message | Format-List > [FILE PATH]
Get-SPLogEvent| ?{ $_.Correlation -eq “29b5c483-c48b-4ef2-b4b3-f5e29f635d31” }| select Area, Category, Level, EventID, Message | Format-List > C:\mergelog\log.txt

Merge-SPLogFile


Merge-SPLogFile enables us to query log files when we have multi-server farm  and we do not have idea where exactly the error got logged. i.e. timer service is running on four servers and the current timer request is served by Server1 then error get logged on server1.

Merge-SPLogFile -Path [FILE PATH] -Correlation [CORRELATION ID]
Merge-SPLogFile -Path C:\mergelog\log.txt -Correlation 29b5c483-c48b-4ef2-b4b3-f5e29f635d31

References


https://docs.microsoft.com/en-us/powershell/module/sharepoint-server/merge-splogfile?view=sharepoint-ps
http://cecildt.blogspot.com/2012/10/sharepoint-2010using-merge-splogfile-to.html

No comments: