Using Get-SPLogEvent to retrieve logs based on correlation id

As an administrator, one of the most common tasks I get is to troubleshoot “unexpected errors”. While the ULS log viewer is very handy, the log files are very large and tedious to go through (especially in a live environment).

Most errors in SharePoint come with a correlation ID. As long as you have this, you can locate more details about the error in the ULS logs.

A handy way to find an error that just occurred based on correlation ID is to use the following powershell command:

get-splogevent -starttime (get-date).addminutes(-20) | where-object { $_.correlation -eq “b66db71a-3257-4470-adf9-5c01dc59ecb3” } | fl message > c:\errors.txt

This will output all errors from within the last 20 minutes with correlation id b66db71a-3257-4470-adf9-5c01dc59ecb3. The output is written to c:\errors.txt.

Browsing the text file shows the following output:
Message : Leaving Monitored Scope (SiteAndWebCache.DoesUserHavePermission). Exe
cution Time=25.0330698454692

Message : SQL Query Count The SQL queries performed during this operation.

Message : Unknown SPRequest error occurred. More information: 0x80070002

Message : Data adapter failed during OnLoad: The form cannot run the specified
query. The list could not be found.

Tags: ,

Trackbacks/Pingbacks

  1. Read SharePoint log files. « W0ut SharePoint and .NET - May 31, 2012

    […] More info can be found here : http://www.mysharepointadventures.com/2011/08/175/ […]

  2. Using Get-SPLogEvent to retrieve logs based on correlation id | My SharePoint Adventures | Useful Stuff... - November 13, 2013

    […] Using Get-SPLogEvent to retrieve logs based on correlation id | My SharePoint Adventures. […]

  3. Troubleshooting: Sharepoint Deployments and Powershell « El TecnoBaúl de Kiquenet - August 13, 2014

    […] More info can be found here : http://www.mysharepointadventures.com/2011/08/175/ […]

Leave a Reply

%d bloggers like this: