As an administrator, one of the most common tasks I get is to troubleshoot “unexpected errors”. While the ULS log viewer is very handy, the log files are very large and tedious to go through (especially in a live environment).

Most errors in SharePoint come with a correlation ID. As long as you have this, you can locate more details about the error in the ULS logs.

A handy way to find an error that just occurred based on correlation ID is to use the following powershell command:

get-splogevent -starttime (get-date).addminutes(-20) | where-object { $_.correlation -eq “b66db71a-3257-4470-adf9-5c01dc59ecb3” } | fl message > c:\errors.txt

This will output all errors from within the last 20 minutes with correlation id b66db71a-3257-4470-adf9-5c01dc59ecb3. The output is written to c:\errors.txt.

Browsing the text file shows the following output:
Message : Leaving Monitored Scope (SiteAndWebCache.DoesUserHavePermission). Exe
cution Time=25.0330698454692

Message : SQL Query Count The SQL queries performed during this operation.

Message : Unknown SPRequest error occurred. More information: 0x80070002

Message : Data adapter failed during OnLoad: The form cannot run the specified
query. The list could not be found.