Wednesday, June 12, 2013

Get log entries from the SharePoint 2013 ULS using C#

Suppose you aren't happy with the accessibility of the ULS log in SharePoint 2013. Often this is what you get from users who encounter an error:

"Thanks," you say. "Could you please recreate the error and click on the technical details and copy and paste the message to me?"

When you finally get the correlation Id, you have to scour the logs to find the log entries and start tracking down the error. There are various ways to make this process easier. One way is to use some variation of the C# code below:

var ulsLogEntries = new SPULSRetriever(
      300, 1000, DateTime.Now.AddMinutes(-180)).GetULSEntries(new Guid(_correlationId));

The SPULSRetriever class is part of the Microsoft.SharePoint.Diagnostics namespace and allows you to look up log entries for a specific correlation id. There is limited SDK documentation here:

In the example above, the _correlationId variable is created earlier in the code as a string and converted to a Guid before being passed into the GetULSEntries as a parameter. The GetULSEntries method returns a collection of LogFileEntry members. The LogFileEntry members contain the properties for a single log entry.

You can then iterate through the collection and display the log entries in whatever fashion you like. An example of how you could use this is to create an application page available to the support team that allows them to input a correlation id and capture the appropriate log entries. Another possibility is just to add something to the various error pages that automatically sends the log to the support team when a user encounters an error.

Have fun! As always, let me know if you have any comments or feedback.


  1. Copying the Correlation ID from the browser is the easiest way to do so. Make sure while copying the ID at the beginning, space doesn't remain there as it will create a problem for you.

  2. great find, i was looking for something like this. I have a "report an issue" link on the suitebar, but the suitebar is not displayed on the error page, but this will help with sending issues to our SCSM, being able to put the relevant rows in the ticket without having to go back to the log file.

  3. Interesting, thanks Doug. I wonder how different ULS read techniques would compare on read performance (above C#, PowerShell Merge-SPLogFile, maybe even FINDSTR to search text files, ...)

    One of my favorite WSPs is
    because it helps junior SP admins research a correlation ID number easily. Bram did a great job on the UI and leverages PowerShell "Merge-SPLogFile" under the hood.

    Always looking for that extra speed optimization - you know? =)

  4. This will output to the screen all matching lines in the log that contain the strings you specified and that were written to the log within the last 60 minutes.seo log analyzer