using SPDiag to monitor large IIS and ULS Logs from more then one Machine

Hello @all,

last time I need to figure out some performance issue in a SharePoint farm. The main problem I had is: how to review logfiles with a size of more then 1 GB and more? Using log parser for IIS logs and using ULSlogparser for ULS logs is ok but it requires many steps manually.

It should exist a tool to compare all log files (IIS, Eventlogs, ULS Logs) and need to sync the IIS UTC time with the ULS local server time. Does such a tool exist?

The answer is simple: YES, use SPDiag it's part of the SharePoint administration Tool Kit v3. (Link to download x86, download x64)

Requirement for the complete Feature set of SPDiag:


Important Tip:
SPDiag require a SQL Server. But SPDiag supports only Windows Authentication. In case you are using SQL Authentication you need install a dummy sql server and point SPDiag to the Dummy SQL server. In that case you can also compare ULS and IIS log. But we need to exclude the SQL server Logs in the Scope button:


Create a New Project and the given Project name creates a new Database on your SQL Server:


How do reduce the size of Logs which are not important?

1. Step: focus on the time your issue happening: set your Time Frame


2. Step: Using Query like "Show me long running Pages where Time-Take > 50 ms". So you get a list of pages.

In my case the slowest request the accessing the SharePoint ConfigurationDB, now you can focus on that single request target and SQL DB.

3. Step: check how many times the URL was called on this day?

In my case in the last 24 h the Central Administration was called the first time. Means the Application pool need to compile the webapplication a first time which slow down the request time. As solution you can use a warm up script. start the warmup script a short time after the application tool was recycled.

Tip: choose Performance logs on Farm Level like this: Show long running Request inside the whole Farm (in cause you are using NLB it's very nice):


An other important query is: show me all Bad Request: Important in kind you want to identify Security Issue or pages which run into an Error and the Issue happens only sometimes. "Bad Request where Http RC is not equal 200"


Attention: In case you have many server and large log files it looks like that SPDiag runs over 5 minutes and you think it hang BUT if you look at the upper right side then you see a time displayed. In case the application hang the time should not change/counting.


Additionally take a look on the SPDiag Log file is growing?


If it's increase then is SPDiag still collection data from all server which you have defined in your Scope, so it does not hang. In large defines time frames and many servers then the SPDiag log can run to a size larger then 10 GB.

So be careful.



Comments (1)

  1. Topics about Microsoft » using SPDiag to monitor large IIS and ULS Logs from more the says:

    PingBack from

Skip to main content