View diagnostic logs using PowerShell in SharePoint

In this post I have discussed about Merge-SPLogFile and Get-SPLogEvent in both versions SharePoint 2010 and 2013.

 

Cmdlet	Description	Purpose
Get-SPLogEvent	Reads/queries ULS trace logs.	Trace Log Querying and Filtering
Merge-SPLogFile	Combines trace log files from all farm servers into a single file in local machine.	Trace Log Merging

 

 

Merge-SPLogFile

Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. You can run this command from PowerShell.

This will be very much helpful if you are working in multiserver environment. As SharePoint maintains log entries in each server, by using this command you can pull them in a single file.

You can filter based on various criteria like StartTime, EndTime, Process, Area, Category, EventID and Message etc.

 

If you are a Server Administrator than its great that you have shell admin rights to troubleshoot.

 

Let’s see how these cmdlets will be helpful.

 

So we got an error. Open SharePoint Management Shell(run as administrator) in any SharePoint server of the farm.

Run the Merge-SPLogFile cmdlet. Using the correlation ID we got from our error above, we have something that looks like this:

 

Merge-SPLogFile -Path ".\error.log" -Correlation "5ca5269c-8de5-4091-3f1b-f179af4d5121"

 

We can then open our log file with ULS Viewer and see the specific exception:

 

See More for more filtered result:

Syntax given in Technet

 

Merge-SPLogFile -Path <String> [-Area <String[]>] [-AssignmentCollection <SPAssignmentCollection>] [-Category <String[]>] [-ContextFilter <String[]>] [-Correlation <Guid[]>] [-EndTime <DateTime>] [-EventID <String[]>] [-ExcludeNestedCorrelation <SwitchParameter>] [-Level <String>] [-Message <String[]>] [-Overwrite <SwitchParameter>] [-Process <String[]>] [-StartTime <DateTime>] [-ThreadID <UInt32[]>]

 

Below are some cmdlets of Merge-SPLogFile which will be useful:

 

Example 1: Merge log of last hour

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite

------------------------------------------

Example 2: Merge log of last hour

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search

------------------------------------------

Example 3: Merge the log data of level High

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High

------------------------------------------

Example 4: Merge the log data based on a Correlation ID

Merge-SPLogFile –Path “S:\SPLogs\MergedLogs.log” –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite

------------------------------------------

Example 5: Merge the log data within filtered time (USA Local)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" - EndTime "06/09/2008 16:15"

------------------------------------------

Example 6: merge the log data for all user names that have a contoso\user or Contoso/user format.

Merge-SPLogFile -Overwrite -Path d:\2.log –ContextFilter “user=contoso?user”

 

Get-SPLogEvent

One of the quick & awesome ways to do this is to simply hook up a PowerShell console (SharePoint 2010 Management Shell) and then just write the following command (replace the <GUID> with the Correlation Id ):

Get-SPLogEvent | ?{$_Correlation -eq "<GUID>" }

 

You might want to be more precise and get more specific details out of your query, then you can try something like this:

Get-SPLogEvent | ?{$_.Correlation -eq "<GUID>"} | select Area, Category, Level, EventID, Message | Format-List > C:\mylog.log

 

 

Hope this will be helpful !!!

 

 

For more information about viewing SharePoint logs using Get-SPLogEvent, see TechNet Articles

View and filter log events by using Windows PowerShell

View and export diagnostic logs by using the Windows PowerShell Out-GridView cmdlet

 

Powershell Cmdlets with ULS Logging

http://msdn.microsoft.com/en-us/library/office/ff595318(v=office.14).aspx

Search Crawl error: Value does not fall within the expected range

You would have face some kind of strange issue of Search Service application that a site collection not getting crawled. After some analysis you will found that crawl getting failed throwing error "The SharePoint item being crawled returned an error when requesting data from the web service" in crawl log.

See below Message, how it will be shown in crawl log:

sts4://abc.domain.in/siteurl=sites/hr/siteid={0e3cb5f6-5591-4b35-9335-26f6e48f6788}

The SharePoint item being crawled returned an error when requesting data from the web service.  (The item was deleted because it was either not found or the crawler was denied access to it.

- Error from SharePoint site: Value does not fall within the expected range.)

WHY?

Ohh.. Now the question is why we getting this issue? Well our SharePoint Farms are dependent on Organization's Active Directory(AD). When ever new user gets added there they can access SharePoint and whats happen when they separated from organization?

When AD guys make any account disable their user information will not get update in Site collection's content database. On permanent deletion of account in AD that account automatically marked as deleted in userinfo table and removed from user taxonomy. So here is the point if that not marked as deleted in SharePoint Userinfo table, that becomes orphaned user. Crawl service will not be able to crawl such orphaned account as metadata and get failed.  

Solution:

The solution I have demonstrated below is using MSSQL database query.

1. Connect your database server in SQL server Management studio(ssms)
2. Point particular content DB your site collection resides
3. Open new query window 

Look at site ID given in log, use that to retrieve information of orphaned user. Use below mentioned queries one after another to check and update database.(Before running in Production please test it in UAT or Pilot Environment first).


*Replace below used site I'd with your sitecollection ID, check log or PowerShell script for this.

SYNTAX:

use SITE_WSS_CONTENT_Z

-- Find List of Orphaned User

Select tp_login, tp_Title, tp_systemid, tp_deleted from UserInfo where tp_SiteID='0E3CB5F6-5591-4B35-9335-26F6E48F6788' and len(ltrim(rtrim(tp_systemid))) <25 and tp_deleted = 0 order by tp_Login

--Check Status of the user in UserInfo Table

Select * from UserInfo where tp_SiteID='0e3cb5f6-5591-4b35-9335-26f6e48f6788' and tp_Login=domain\ripon.k

--Update User Info table of mentioned login

Update UserInfo set tp_deleted=tp_ID where tp_SiteID='0e3cb5f6-5591-4b35-9335-26f6e48f6788' and tp_Login=domain\ripon.k

Now below query should display null record. If it is so, your issue resolved.

use SITE_WSS_CONTENT_Z

-- Find List of Orphaned User

Select tp_login, tp_Title, tp_systemid, tp_deleted from UserInfo where tp_SiteID='0E3CB5F6-5591-4B35-9335-26F6E48F6788' and len(ltrim(rtrim(tp_systemid))) <25 and tp_deleted = 0 order by tp_Login