How To Use PowerShell To Get Detailed Information about Correlation IDs in SharePoint 2010

SharePoint 2010 you are given a unique Correlation ID for errors that can be used in helping you search for these errors in the SharePoint ULS Logs.

However, I hate searching ULS Logs sure I can use ULS Viewer to help me track down my problem via filters, however why use that when you have PowerShell.

Follow these steps below, which will search the ULS logs for the Correlation ID and pipe it out into detailed columns with information relevant to the error.

1.  Log into your SharePoint or CA server doesn’t matter just as long as you can access the SharePoint 2010 Management Shell for your farm.
2.  Bring up SharePoint 2010 Managment Shell
3.  Next Type:  Get-SPLogEvent | ?{$_.Correlation -eq “correlation id of the error”} | ft Category, Message -Autosize
4.  Hit Enter

It might take a few minutes for PowerShell to grab the ULS logs and search for the Correlation ID.
You should then be presented with two columns (Category and Message) with detailed information about the error.  This should help you narrow down the problem.  This also eliminates having to open up all your ULS log files and searching or loading them up in ULS viewer.  It’s alot quicker and proficent in my opinion.

For a much clearner/readable output type this in step 3:

Get-SPLogEvent | ?{$_.Correlation -eq “correlation id of the error”} | select Area, Category, Level, EventID, Message | Format-List

If you would like to pipe it out to a text file do this:

Get-SPLogEvent | ?{$_.Correlation -eq “correlation id of the error”} | select Area, Category, Level, EventID, Message | Format-List > c:\CorrelationID.log

======================================================================

Other Option Using The DataBase

VIEW - ULS TraceLog

There is a DataBase name called WSS_Logging  and a  VIEW called ULSTraceLog

You need to query the view using CorrelationID as the where condition like below

Use wss_logging

Select * from ULSTracingLog where

CorrelationId='e19484f7-c1c5-4085-bf75-7a69be4fdf12'.

NOTE: Some times View may not be created because of timer job is not created.

We need to run the timer job as below

Central Administration: Monitoring > Review Job Definitions >

Enable the "Diagnostic Data Provider: Trace Log" and set every 5 minutes and click ok and then again come to the same place click "Run Now" then go and check the database the view will be created.