SharePoint Log Monitoring: a re-engineered SPDocKit feature

Over the last couple of years, SPDocKit has grown quite a bit as a tool, and SharePoint log monitoring has been an often requested feature. Now it’s finally here, refreshed and re-engineered to help you keep your SharePoint farm healthy.
sharepoint-monitoring-by-spdockit

Every SharePoint admin struggles with error logs. In SharePoint circles, you can hardly find anyone who at some point hasn’t faced an unexpected error that looks something like this: a860f0e5-156c-4094-9b85-42c1bcc87308.

What do you do after you get one of these errors? You look it up in the ULS logs, of course, aaaaand there you have it: the place where every SharePoint admin’s bottomless pit of despair starts.

So, if you’ve spent a fair amount of time troubleshooting an issue that requires searching the ULS logs for the root cause, you’ll be thrilled to learn that the SPDocKit team put forth their best efforts to develop THE utility for SharePoint log monitoring, surpassing even the ULSViewer . (I’ll explain why in a moment.)

Without further ado, I’d like to introduce the SPDocKit Event Viewer.

SharePoint log monitoring without confusion and noise

The SPDocKit Event Viewer comes with the Event Collection Service, and since I’ve made the bold statement that it surpasses the ULSViewer, I’d like to explain why I think that.

The other day, our SharePoint MVP, Toni Frankola, did some digging, and he needed to troubleshoot the UTM server. An error kept popping up. Toni then used the PowerShell script for returning results from a ULS trace log and got to the bottom of the issue rather quickly. Here’s an example of the command Toni used:

Get-SPlogevent -Starttime "10/17/2016 09:26:35" -Endtime "10/17/2016 09:26:36" | Where-object { $_.Correlation -eq "5b3bae9d-b772-902d-b5d0-4932d9336c22" }

This was only plausible because the whole scenario involved one server, which is awesome. It was a quick in-and-out showdown. But, if Toni had more than two servers, well… I’m afraid to even think about how that would have turned out.

While we’re discussing this matter, I’d like to make yet another bold statement comparing the whole situation with the movie Memento. I don’t know whether you have seen that film, but the point is that you don’t know where the hell you are, what you are doing, or how you are going to find what you are looking for.

Now, imagine that you have a SharePoint farm with numerous servers or even multiple SharePoint farms. Would you know what the fix was?

Let’s just say that Toni didn’t have the correlation ID; he only had a vague idea of what to look for. The ULS logs are not exactly search friendly, especially when you’re looking for something from a larger time frame.

Anyway, there are obviously several tools for ULS log viewing. The only real question is whether they fit your SharePoint mega-farm enterprise needs—and SPDocKit does.


The upgraded SharePoint log monitoring feature offers the following options:

  • Instead of collecting data in the database, it now uses the Lucene.net search engine library to index collected events.
  • It works in real time and collects events continuously, and the interval for each collection period is adjustable.
  •  It gathers ULS and Windows event logs from all servers across the farm or even multiple farms, however; you must connect them to the same SPDocKit database
  •  If filters data by category, source, server, message, event ID, and correlation ID.
  •  It allows you to search, filter and read the ULS logs.
  •  It filters out the noise.

SPDockit Event Viewer

The SPDocKit Event Viewer makes SharePoint diagnostics much more comprehensible and manageable. The SPDocKit team is proud to introduce this updated feature. The old SharePoint log monitoring failed to offer the badly needed search function that saves users’ precious time.

How does it work?

The team designed the SharePoint log monitoring feature to best serve the needs of a large SharePoint enterprise farm. I’ll briefly discuss how the SPDocKit Event Viewer works.

The SPDocKit installation now has several features. The default installation is the same as it has been. However, you can now choose to install the SPDocKit Event Collection Service and/or the SPDocKit Event Viewer as well. We decided on utilizing multiple features so the event collection would minimize the impact on the SharePoint farm. If you wish, you can still install all the features on a single server, but our recommendation is to separate the Event Collection Service from your farm.

The recommended setup is as follows.
  • Step one:

Install SPDocKit on one of the servers in your farm, as you normally would. Install the SPDocKit Event Viewer feature, and this is optional. For the recommended setup, do not install the SPDocKit Event Collection Service here.

  • Step two:

Connect the SPDocKit Event Viewer to the SPDocKit database.

  • Step three:

Install the SPDocKit Event Collection Service feature outside the farm. You also have the option to install the viewer application. Connect the service to the SPDocKit database. Once the configuration has been saved, the service will automatically start collecting event entries from all the farms registered in the database using the default settings.

  • Step four:

If you haven’t installed the SPDocKit Event Viewer feature described in the previous steps, you can modify the features for the SPDocKit installation or install the SPDocKit Event viewer on a separate workstation. Multiple installations are supported.

Fire up the SPDocKit Events Viewer and enter the Service Collection URL.

Select your farm and try out the new ULS search experience. Note that it may take some time for the results to show up the first time since there is no existing data in the index; some historical data will be loaded in this case.

To limit who can see the data collected please use SPDocKit Role Based Security.

Diagram shows how SPDocKit monitoring works - use the SPDocKit Event Viewer to examine and search through results.


Benefits of SharePoint log monitoring with SPDocKit:

  • Searchable index of your ULS logs
  • Fast, free text search that shows any events mentioned in a specific database when you enter the database name in the search box
  • All events are accessible in a single place
  • The Event Viewer can be used on multiple workstations
  • Enables log indexing and filtering
  • Error and correlation ID search

Learn how to configure and use SPDocKit Event Viewer in this article and video guide.


More about SPDocKit

SPDocKit is a high-quality SharePoint administration enterprise solution and a management tool built for every environment and company type. Every day, the tool helps SharePoint admins across the globe run their farms with ease.

Try SPDocKit today and discover the many benefits of automating everyday routine tasks and increasing data security and compliance.

The SPDocKit Event Viewer and the Event Collection Services we have discussed today are for use with SPDocKit, so be sure to check the pricing to find the best fit for your environment.

Thanks for reading our blog!

We’d love to connect with you at @SPDocKit on Twitter or with the hashtag #SharePointULS.

spdockit-trial