GSX Blog

Technical Case Study: How to track SharePoint Log using GSX Monitor

Posted by Arnaud Buonaccorsi on Thu, Jul 24, 2014

SharePoint has many cool features but it is never enough for your end-users. This is why companies develop applications and web parts so frequently. SharePoint has a lot of nice tools to debug applications: a dashBoard for developers, trace logs, Visual Studio extensions for Windows SharePoint Services,etc.

How to debug new SharePoint Applications?

In order to debug SharePoint applications developers have 2 options: the SharePoint Logs also known as Unified Logging Service (ULS) and the Development Dashboard. The Development Dashboard is a portal that measures performance allowing the developers to retreive deep dive information to fix issues on a specific application.
By mixing both info coming from the ULS and the dashboard, you can have a better understanding on what should be fixed in your application and the impact of your application on your SharePoint environment.

Trace logs can give you important information to debug a lot of particular issues. The trace logs have the following columns:

  • Timestamp — Date and time of the event
  • Process — Process that generated the log entry
  • TID — Thread ID
  • Area — Area of the event
  • Category — The category of the Area of the event
  • Message — Actual error message
  • Correlation — The correlation ID

When an error occurs, an administrator can use the correlation ID to track down all of the events in the trace logs which are linked to the application where the problem occurred. Just below you have an error message return by SharePoint in your browser. You can see it returning the correlation ID.

Let’s start with practice!

So in our case we have deployed a Webpart. This Webpart is working well and has been tested during a few months. However we would like to make sure it does not return errors.

This is why we are going to use GSX log scanning to track errors.

First we are going to retrieve the GUI or Correlation ID of our application.

To do this use the Powershell command: Get-SPWebApplication | Select DisplayName, Id

Then you must discuss with your development team to know if they implement custom logging for your application. If it is the case you will be able to track your own "Category ID" based on the "Product Name". So it will be easier.

Now we are going to ask GSX Monitor to send us errors or warnings related to this Correlation ID. To do this the process is very straightforward:

Edit your server configuration, go into the log section, use Regex to look for your keywords:

Our Regex will be like this:

  • If you don't have custom logging, try to search based on Correlation ID (7edf6de7-1867-4dcd-99fd-347c2157a66c) message in category High or Medium:
    • .*(High|Medium).*7edf6de7-1867-4dcd-99fd-347c2157a66c.*
  •  If you have custom logging like me you can use something like this:
    • .*GSX Upgrade to Exchange.*(Medium|High).*

NB: my product is "GSX Upgrade to Exchange" and my category is "Medium and High" (they could be upgrade, post, pre, deploy…or whatever.)
GSX is going to scan your logs regularly, it will track any errors related to your new application. If something occurs you will be notified by email. After several times you will be able to have an overview of the stability of this application in GSX Analyzer (yes GSX Analyzer gathers all alerts from GSX Monitor).

Don't forget that you can execute a script in the alert profile. So you can disable your Webpart if you receive a critical alert or a good reason to disable it.
By tracking alerts this way you can be proactive and detect any issues before the new application impacts your live environment.
TIPS: If you need to extract ASAP all error messages from a specific correlation ID you can use a command like this:
get-splogevent | ?{$_.Correlation -eq "CORRELATION ID"} | select Area, Category, Level, EventID, Message |Format-List
More tips and tricks will come very soon therefore do not hesitate to share some your experience or any your experiment any other issues you experience, I can focus on covering them in upcoming articles.

describe the image

Ask for your SharePoint free trial now!

Tags: GSX Monitor, Regex, SharePoint Monitoring, Microsoft SharePoint, SharePoint Log, Product tips