Regex Expression in ULS Logs -
Using ULS Viewer to view and understand SharePoint Logs more easily-
- ULS viewer is a free ware tool that can be downloaded from https://www.microsoft.com/en-in/download/details.aspx?id=44020. This is a simple exe file that means it does not need any installation.
- Open any log file in ULS viewer.
- You can connect your ULS viewer to Live SharePoint logs as well as old ULS log files. Use Ctrl + U to connect live SharePoint Logs and Ctrl + O to connect old logs.
- Once the logs are opened you can see the logs and use different filters available for different columns.
- All the columns available in logs displayed under Field, You can choose the Operation (condition) on the field and type a value and if you want multiple conditions you can select from And/Or field.
- All the operations in Operations columns are well known, so here I will define a special operation that is Regex match operation for different columns.
- Regex Match is used to filter data dynamically on a given column.
- Select the Field where you to apply filter, in Operation select Regex match, in Value enter your formula of regex match. And click on OK.
- You will get the filtered data as per your requirements.
How to create regex match formula -
- Suppose you have this value "This is a test data" and you want to filter all that lines that contains the word test together. For this you can use contains and regex match both options.
- But Regex match becomes useful when you want to filter the that that contains the characters between some range together. Such as you want all the lines that contains characters from e to t together that means any line that contains e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t together for a number of times such as 4 times. In the above test is the correct match for this condition. And the order of the text can be any it does not means that it should be a fix order. Like test, estt, kjsl any text will satisfy this the regex match condition.
- Now the formula for this will be [e-t]{4} that means 4 continuous characters having any character between e to t in any order will satisfy the condition.
- The regex match also applies on numbers. And it is very helpful when we want to track that which thread is taking long time to response. We know that we have execution time defined the message field of ULS logs. So if we want to filter the messages that showing the execution time more then 1 second than this can be achieved through this process and formula -
- In ULS the execution time is given in mili seconds and we know that 1 sec = 1000 Mili seconds.
- As if we want to get the time more than 1 seconds than it means is that first character must b 1 to 9 and its next three characters must be 0 to 9 in any order. And the time will be written after 'Execution time=' so the formula for achieving this will be something like below -
- Execution Time=[1-9]{1}[0-9]{3}
- Here 'Execution Time=' is a constant so this will check "Execution Time=' first.
- After getting 'Execution Time=' in any value of the message field it check the first character after the mark = must be between 1 to 9 it should not be 0 as we are checking for more then 1 second. This will be done by [1-9] range of the numbers and {1} define the number of characters. That is 1 as we want to check for 1st character after the = mark.
- After getting 'Execution Time=N' here N can be any number between 1 to 9 it will check for next 3 characters that contains any combination of 0 to 9 characters. This will be done by [0-9] range of the numbers and {3} define the number of characters. That is 3 as we want to check for 3 characters after the '=N' value.
- So the result we will get is execution time that is more than 1000 mili seconds. And in this way you can make your regex formula.
This Regex match option can be used to find out the performance issues with SharePoint, Such as which thread in SharePoint is taking longer time to complete. or find other issues.
