Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been doing some research into the SharePoint ULS logs today. I'm trying to figure out what the fields in ULS logs represent. Below is a list of the fields.

Timestamp This is obvious.

Process This is name of the process that wrote the log entry (also contains a HEX Value that is probably the process id)

TID It is a HEX value, but I have no idea what it represents.

Area Very similar to Category.

Category Category

EventID Some sort of ID... can't see much to it yet

Level Type of message (Critical, High, ...)

Message String message from application.

Correlation Assume this is way of ganging messages together, but I do not see it being used.

So does anyone know what TID and EventID represent?

share|improve this question
up vote 5 down vote accepted

TID Thread ID

EventID Event ID for internal use (undocumented)

Have a look at this blog post for more info.

Area and Category are also used for applying different filter settings so you can control how much is logged. See Central Administration under Operations, Logging and Reporting, Diagnostic logging.

As you say, Correlation is rarely used and I'm sure could be made a lot more useful. I've seen it occassionally point to another EventID.

share|improve this answer
Good stuff... thanks. – Jeff Jun 12 '09 at 11:37

Some additional notes:

Area = Product (Such as SharePoint Server, Project Server, or 3rd Party Add On)

Category = Subsection of Product

EventID = Defined by the product team. So these numbers will be specific to a product

Correlation = Very helpful GUID generated by SharePoint useful when troubleshooting. SharePoint will often display a correlation ID on a web page when there is an unhandled error. You can copy and paste, or if a user sends you a screen capture, you can type this in.

Also, I highly recommend you use the ULS Viewer ( to filter for Correlation ID or any other field. Using the ULS Viewer, filtering for the Correlation ID will allow you to scan multiple files and put all related log entries on the screen together.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.