SharePoint logs are very useful for performance analysis, troubleshooting and monitoring compliance with service level agreements.
The Unified Logging System (ULS) is responsible for keeping an eye on SharePoint and generating the logs. It reports the events to three different locations: SharePoint trace logs, Windows Event log and SharePoint logging database. All this three kinds of logs can be configured through SharePoint Central Administration or PowerShell.
SharePoint trace logs are plain old text files and can be open with any kind of text edit tools, and the diagnostic log throttling and log file location can be configured. There is a very useful column correlation ID recorded in the log, which is a globally unique identifier GUID assigned to each conversation a user or process with SharePoint. It helps you to hunt down the issues when the problem occurred. And here we suggest using ULSViewer tool to view the trace log, which is a windows application for viewing SharePoint ULS logs more easily, supporting filtering and searching.
SharePoint 2010 also writes logs to Windows Event logs; it can be viewed by Windows Event Viewer.
In addition to the file logs, ULS also writes logs to the logging database. It contains all logging information for every server in the farm and collects all the information from many different locations and writes them all to a single database. For example, it includes Timer Jobs, Site Inventory and Search Crawl. Microsoft not recommend to view the log directly from the database, so how we consume the logging database, firstly we can open SharePoint Central Administration to view some of the useful report generated based on the logging database, such as Web Analytics Reports, administrative reports and slow page reports. Secondly we can use Microsoft Business Connectivity Services (BCS) external content types and lists to expose the content from the logging database. Thirdly, we can write customized code to pop up the specific content from the database to SharePoint list or somewhere else.
Audit log is another important kind of log in SharePoint 2010; it can be used for tracking which users have taken what kind of actions on documents, items, lists, libraries and sites. All this information is stored in the logging database table dbo.AuditData. We can view the reports through audit log reports in the site collection administration under site action.
