I have been doing some research into the SharePoint ULS logs today. I'm trying to figure out what the fields in ULS logs represent. Below is a list of the fields.
Timestamp This is obvious.
Process This is name of the process that wrote the log entry (also contains a HEX Value that is probably the process id)
TID It is a HEX value, but I have no idea what it represents.
Area Very similar to Category.
Category Category
EventID Some sort of ID… can't see much to it yet
Level Type of message (Critical, High, …)
Message String message from application.
Correlation Assume this is way of ganging messages together, but I do not see it being used.
So does anyone know what TID and EventID represent?
Best Answer
TID Thread ID
EventID Event ID for internal use (undocumented)
Have a look at this blog post for more info.
Area and Category are also used for applying different filter settings so you can control how much is logged. See Central Administration under Operations, Logging and Reporting, Diagnostic logging.
As you say, Correlation is rarely used and I'm sure could be made a lot more useful. I've seen it occassionally point to another EventID.