I have been doing some research into the SharePoint ULS logs today. I'm trying to figure out what the fields in ULS logs represent. Below is a list of the fields.
Timestamp This is obvious.
Process This is name of the process that wrote the log entry (also contains a HEX Value that is probably the process id)
TID It is a HEX value, but I have no idea what it represents.
Area Very similar to Category.
Category Category
EventID Some sort of ID... can't see much to it yet
Level Type of message (Critical, High, ...)
Message String message from application.
Correlation Assume this is way of ganging messages together, but I do not see it being used.
So does anyone know what TID and EventID represent?
TID Thread ID
EventID Event ID for internal use (undocumented)
Have a look at this blog post for more info.
Area and Category are also used for applying different filter settings so you can control how much is logged. See Central Administration under Operations, Logging and Reporting, Diagnostic logging.
As you say, Correlation is rarely used and I'm sure could be made a lot more useful. I've seen it occassionally point to another EventID.
Some additional notes:
Area = Product (Such as SharePoint Server, Project Server, or 3rd Party Add On)
Category = Subsection of Product
EventID = Defined by the product team. So these numbers will be specific to a product
Correlation = Very helpful GUID generated by SharePoint useful when troubleshooting. SharePoint will often display a correlation ID on a web page when there is an unhandled error. You can copy and paste, or if a user sends you a screen capture, you can type this in.
Also, I highly recommend you use the ULS Viewer (http://archive.msdn.microsoft.com/ULSViewer) to filter for Correlation ID or any other field. Using the ULS Viewer, filtering for the Correlation ID will allow you to scan multiple files and put all related log entries on the screen together.