How To Collect ULS Log from SharePoint Farm

We can use below command to collect SharePoint ULS log from all servers in the Farm in PowerShell.

Merge-SPLogFile

--------------EXAMPLE 1-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite

This example merges the last hour of log data from all farm computers with no filtering.

--------------EXAMPLE 2-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search

This example merges the last hour of log data from the Search area.

--------------EXAMPLE 3-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area "SharePoint Foundation","Web Analytics Services"

This example merges the last hour of log data from the SharePoint Foundation and Web Analytics Services areas.

--------------EXAMPLE 4-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High

This example merges the log data of level High or higher.

--------------EXAMPLE 5-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" - EndTime "06/09/2008 16:15"

This example merges the log data for events in a particular time range, which is culture-specific to the United States.

--------------EXAMPLE 6-----------------

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Message "*permission changed*"

This example merges the log data for events with permission changed in the message text.

--------------EXAMPLE 7-----------------

Merge-SPLogFile -Overwrite -Path d:\1.log -ContextFilter "name=timer job*" -Area "*search*"

This example merges the log data for all search timer jobs.

--------------EXAMPLE 8-----------------

Merge-SPLogFile -Overwrite -Path d:\2.log -ContextFilter "user=contoso?joeuser"

This example shows how to merge the log data for all user names that have a contoso\joeuser or Contoso/joeuser format.

 

Merge-SPLogFile -Correlation {Correlation ID} -Path D:\MergedLogs.log -StartTime "11/21/2015 13:00:00" -EndTime "11/21/2015 14:00:00"

 

Reference:https://technet.microsoft.com/en-us/library/ff607721.aspx