Summary

ULSViewer allows users to open a ULS log file and display its contents in a user friendly format. Users can then perform advanced functions such as filtering, sorting, highlighting, loading logs, appending logs, etc in order to single out the data that is important to the user. This information can be used to diagnose problems with machines running ULS services, or to monitor machines and the events they create in realtime.

Introduction
This article discusses the ULS Viewer tool.

Warning: The ULSViewer tool is an unsupported application that can be used to analyze ULS log files. Microsoft does not provide support for this tool. Use this tool at your own risk. Microsoft Product Support Services (PSS) cannot answer questions about the ULSViewer tool.
ULSViewer allows users with access to ULS log files to view their logs in a more user friendly interface instead of using standard log file viewers. Logs opened can be filtered, sorted, highlighted, appended, etc in order to single out the data that is important to the user. This information can be used to diagnose problems with machines running ULS services, or to monitor machines and the events they create. The ULSViewer tool runs on either 32 or 64 bit architectures of Microsoft Windows 2003 Server, Windows 2008 Server, Windows 2008 Server R2, Windows 7, Windows Vista, and Windows XP.

Features
The ULSViewer tool performs various actions against the data from ULS log files in order to better analyze it. ULSViewer allows the user to: y Highlight data of importance to the user on the fly y Bookmark log entries y Append logs to other logs in order to track trends y Hide unimportant data y Only view critical log entries by sorting data by severity y Write rules to prompt the user when certain events occur y View your data in a spreadsheet instead of the text file ULS generates y Monitor remote machines logs that are running ULS services y Open multiple logs at the same time in order to compare log files. y Open logs files from multiple machines at the same time.

Installation
To obtain the ULSViewer tool, follow these steps:
1. The following file is available for download from the MSDN Code Gallery ULSViewer site at: http://code.msdn.microsoft.com/ULSViewer

Download the ULSViewer tool now.http://code.msdn.microsoft.com/Project/Download/FileDownload.aspx?ProjectName=ULSViewer&DownloadId=7482

2.
3. 4.

In the File Download dialog box, click Save, and then save the file to your machine. When the download is completed, click Close. In the folder you saved the file, double-click ULSViewer.exe.

Usage Syntax
UlsViewer.exe [-Options] Options: file:<filename> This will open the given file in ULSViewer (You can omit the -file: and if the file exists, it will still work) ulsrt This will open the real-time ULS tracing in a tab in the ULSViewer window. realtime:<directory> This will make ULSViewer monitor a specific path for real-time ULS tracing. Running UlsViewer.exe without parameters will show the ULSViewer UI.

UI Detail
DROPDOWN MENUS - FILE Save As Saves the active log window to a file Save Workspace Saves the entire workspace including all log tabs to a file Load Workspace Loads a previous workspace from a file Open From File Opens a log file from a file on the local hard drive or any networked drive ULS Opens the current ULS log file on the machine if it is running ULS services at the time. UlsViewer will try to automatically stop process the log if running unattended for more than 2 hours to prevent memory leak. Clipboard Opens a log file if one has been placed on the clipboard through a copy action Append From File Opens a file on a local or networked drive and appends it to the end of the currently opened log file ULS Opens the current ULS log file on the machine if it is running ULS services and appends that data to the end of the currently opened log file. UlsViewer will try to automatically stop process the log if running unattended for more than 2 hours to prevent memory leak. Clipboard Takes log data from the clipboard and appends it to the end of the end of the currently opened log file Recent Recent drops down a list of the last log files that the user opened. From here, the user can click on any of these recent logs and they open in a new tab. Abort Load If the user is loading a log file, abort load stops the file from being loaded to the workspace. DROPDOWN MENUS - EDIT Sort Sorts all log data in the current tab by timestamp Entries Find Opens a prompt to search for a value in any field in the current log Find Moves to the next instance of the last value entered in the Find box. If the user has not Again used the Find function it acts as if the user had selected find Find Moves to the previous instance of the last value entered in the Find box. If the user has Previous not used the find function it acts as if the user had selected Find Goto Opens a window where the user can enter a timestamp and have it take the user to the entry in the log as close to that timestamp as it has available Next Takes the currently selected log entry and jumps to the next log entry with the same Same thread id Thread Prev Takes the currently selected log entry and jumps to the previous log entry with the same Same thread id Thread Next Takes the currently selected log entry and jumps to the next log entry with the same

Same Process Prev Same Process Next Same Correlatio n ID Prev Same Correlatio n ID Modify Filter

process id Takes the currently selected log entry and jumps to the previous log entry with the same process id Takes the currently selected log entry and jumps to the next log entry with the same correlation id

Takes the currently selected log entry and jumps to the previous log entry with the same correlation id

Opens a window for modifying the currently applied filters

Toggle Bookmar k Next Bookmar k Previous Bookmar k

o Each line contains four filter fields, in order to specify a filter the user needs to specify  FIELD This is which field in the log to look under  OPERATION Specify if the user wants the field to contain or equal the value to look for  VALUE Type the value that the user wants the filter to search for  AND/OR Specify the modifier between individual rules applied to the filter Takes the currently selected log entry and tags it as a bookmark

Moves to the next bookmark in the current log

Moves to the previous bookmark in the current log

Clear Bookmar ks

Clears all bookmark tags in the current log

DROPDOWN MENUS - FORMATTING Edit Opens a window that allows for the highlighting of entries to be modified. Default Formattin g

y y

To add a new formatting entry select ADD. Just like with the Modify Filter specify the following fields o FIELD This is which field in the log to look under o OPERATION Specify if the user wants the field to contain or equal the value to look for o VALUE Type the value that the user wants the filter to search for o AND/OR Specify the modifier between individual rules applied to the filter Then, in section two, the user can specify which colors the entries are highlighted.

y y

In section three the user can specify which portions of the entry are highlighted when the event occurs. Save/Save As/Load These three buttons allow the user to save the changes to the current configuration, save the current configuration to a file, and load a previously saved format configuration. Choose Columns Opens a window that allow user to control which columns to be shown and their width.

Clear Bookmark s

Clears all bookmark tags in the current log

DROPDOWN MENUS - TOOLS Notification Filter Opens another window that allows the user to modify which log entries will prompt an on screen notification. By default, traces with Assert and Critical level will be shown in the notification list. Options Opens another window that allows the user to control how large cache files can be, custom sounds for notifications, and if the whole row should be highlighted when using smart highlighting DROPDOWN MENUS - WINDOW Close Page Closes the current page Clear Page Deletes the contents of the current page Next Tab Switches to the next tab of log data Previous Tab Switches to the previous tab of log data New Tab Creates a new tab with all the trace entries in the current tab.

BUTTON PANNEL Starts the display of the data if the user has chosen to open a log file that is being actively written to. Pauses the display of the data from an actively written to log file. Redirects the user to the Filter By menu which can be found by navigating EDIT > MODIFY FILTER. Closes the currently open log file.

Opens the notification list. The list looks as follows...  This screen displays a list of log entries that are flagged for notifications. The user can double click on the notification and ULSViewer will take the user to the entry.  The Clear button will clear the list of notifications.  The Remove button will remove the selected notification from the screen. The Bookmark & Clear button will add bookmarks to each of the events in the notification log and clear the screen. This button will allow popup notifications when activated. If not activated it will not show the popup notifications. Allows the user to select a previously saved filter and apply it. Allows the user to select a previously saved format and apply it. Allows VerboseEx messages to be displayed in the data view. Allows verbose messages to be displayed in the data view. Allows medium messages to be displayed in the data view. Allows high messages to be displayed in the data view. Start to record incoming log file data into a new csv file. Stop recording incoming log file data into the csv file. Highlights all values in the data view that are exactly the same as the value that the mouse is hovering over. Changes the magnification of the log data. Opens a hierarchical view of the data by child/parent relationship. This data is displayed in the TREE PANEL.

Left Right

DATA DISPLAY PANEL The Data Display Panel is broken up into two different pieces, the tabbed portion and the data portion. Tabbed Portion The tabbed portion is at the top of the screen in the many colors. Each of these tabs corresponds to one log file that is open in ULSViewer. Users can switch between them by clicking on the tabs directly. Data Portion The data portion is the grid below the tabbed portion. The data portion is where all the data from each of the log entries are displayed on the screen. Each log file is broken up into fields like TimeStamp, PID, TID, Product, Category, Event ID, Level, Correlation, Message, etc.

RIGHT MOUSE BUTTON MENU In the Data Display panel additional functionality is accessed through a right mouse button menu.  Right Mouse Button Menu

New Page By This Item

Filter By This Item Filter By This Time Range

Show Errors Only Copy Export To File Static Grouping

Quick Filter

Quick Formatting

This button opens a restrict by entry window which allows for a filter to be applied on the fly. o The boxes are all populated with the selected log entry that was right clicked on. The user can now check all boxes for values that the user wants the data to be filtered by o For instance, if the user wanted to create a filter for the PID of a certain entry the user could right click on it, select New Page By This Item, then check the PID box and click OK. The new filtered data is opened in another tab This does the exact same thing as the New Page By This Item selection except that new filtered data is not opened in another tab If one item is selected this button applies a filter that removes all data that did not occur at the time of the selected entry. If multiple entries are selected then the program filters for all data that occurred between the two selected log entries Applies a filter that will only show errors that occurred in the ULS log that is open Copies the log entry onto the clipboard Exports the selected log entries to a specified file From All Groups all data in the data view panel by Time, PID, TID, Product, Category, Event, or Level From Selected Groups all the selected data in the data view panel by Time, PID, TID, Product, Category, Event, or Level Quick filter populates another menu with the values of the currently selected log entry and by selecting one of the options will filter out log entries that are not the same as the selected option. Auto Color Automatically applies a coloring scheme to the first 100 Column different distinct column values for any given column selected Clear All Quick Removes all currently applied quick formatting Formatting Format when Apply a specific selected color when a column contains {column} is the value under the mouse when the right click menu was {value} invoked

TREE VIEW The Tree panel is divided into two different areas. The top view and the data view. Top View The top view is composed on a drop down box and a refresh button. The drop down box allows the user to choose from Correlation and all customer columns available, such as Name, Site, and User. The data in the data view is then organized in parent/child relationships to each other through one of those fields. In the above example the tree view is expressing the parent/child relationships between the log entries Correlation values. Data View The data view just displays the relationships between the values chosen in the drop down box in the top view. The relationships can be expanded or retracted via the + or boxes on parent nodes. When the user clicks on a node in the tree view, the Data Display Panel is filtered to show only traces related to the selected node.

Glossary
Workspace EventId Process Correlation Thread Filter Tab ULS Clipboard The collection of all open ULS log files regardless of active tab The specific value that is tied to a certain event that occurs in a ULS system and is written in the log (Process Identification) The specific value that is tied to the product that ULS was operating under when the event was written to the log (Correlation Identification) The specific value that is tied to the event that the certain event is correlated to (Thread Identification) The specific value that is tied to the thread that spawned the portion of ULS that created the event A user generated statement that only allows certain types of events to be displayed Any one of multiple log files that are open in the workspace (Unified Logging Service) A group of services that generate reports and monitor certain services on the users machine Collection of all recent copy actions