Troubleshooting ULS Logs

Blog Post created by on Oct 13, 2014

Products: SharePoint 2007, 2010, 2013


You can use data from the Unified Logging Service (ULS) logs in SharePoint to troubleshoot problems in the farm. The ULS logs can collect data at varying levels depending on the logging settings, which can be set/changed here:


Central Administration > Monitoring > Reporting > Configure Diagnostic Logging.


Logs are located at %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\<VERSION>\LOGS and have the file name SERVER-DATE-TIME.log

Rather than collecting every log file from every Web Front End server, you should run the command listed here (How to aggregate ULS logs for Nintex Support ) to gather the log files from each WFE server, at the specified time. Ideally, the command should be set for 15 minutes either side of when the issue occurred. The command can be executed on any of the farm servers and will generate one single file on the C:/ drive of the server it is executed on.


Once the log file is generated, it can be opened in a tool such as Notepad. From here, you can use Ctrl + A to copy all of its content into Excel.

A filter can then be added to the top row:


After this, you can then add a filter to the "Area" column, to show only Nintex Workflow/ Nintex Forms/ Nintex Live errors:


You can now check the filtered file for any related Nintex errors, noting the date/time of the error.


Next, remove filter from Area, and change filter on Category to “Workflow Infrastructure” if you are looking for Nintex Workflow related errors – Note that in SharePoint 2013, this is called “Legacy Workflow Infrastructure” instead.



Again, check filtered errors, noting date/time.


If you are still not able to find any unrelated errors, review the following Levels of errors for anything relevant, using a filter on only that column:

- Unexpected

- Critical


If you still don’t find anything relevant in the log, Verbose logging may need to be enabled to drill down to the issue. You can configure diagnostic logging to record verbose-level events. This means that SharePoint records every action that it takes. Verbose-level logging can quickly use drive space and affect drive and server performance. You can use verbose-level logging to record more detail when you are making critical changes and then reconfigure logging to record only higher-level events after you make the change.


Other ULS log reviewing tools are available such as ULS Viewer, or NotePad ++, however I find the filtering and speed of Excel more desirable when troubleshooting large amounts of data.


I hope this helps!