Corey Roth [MVP]

ULS Viewer works great for finding Correlation IDs but once you start dealing with large farms, I find PowerShell works much better.  A Correlation ID is great but it doesn’t do you any good if you can’t find it in the logs.  I put this script together through the help of posts from Wictor and others.  Using Get-SPLogEvent you can find pretty much anything you need in the logs, but without the right parameters it can run very slowly.  I’ve seen some scripts try to filter Get-SPLogEvent using a | but performs the filtering after it retrieves everything from the database.  The key to using Get-SPLogEvent is to use the –StartTime parameter.  You can obviously manually type in a date / time yourself but I find it much easier to calculate it with PowerShell.  To do this use Get-Date and then call the .NET DateTime method AddMinutes().  By limiting the scope to the last five minutes or so the call will execute much faster.  Here is what it looks like.

Get-SPLogEvent -StartTime (Get-Date).AddMinutes(-5)

You can then pipe the output and compare the Correlation with the –eq parameter:

Get-SPLogEvent -StartTime (Get-Date).AddMinutes(-5) | ?{$_.Correlation -eq $CorrelationId}

The value of $CorrelationId just comes in the command line with the following statement at the beginning of the script:

Param([string] $CorrelationId)

That gets us some results for the correlation id in question.but then you really want to format them.  We’re really only interested in the Category and Message fields from the logs.  You can optionally add the Timestamp field if you need the exact date / time.  We can format the results with Format-Table (or the ft alias).

Get-SPLogEvent -StartTime (Get-Date).AddMinutes(-5) | ?{$_.Correlation -eq $CorrelationId} | ft Category, Message –AutoSize

This format the results in a table but by default it constrains the width of the data to the size of your PowerShell window.  Often the details of that exception far exceed the default width.  To mitigate that, you can use the Out-String cmdlet and a –Width parameter.  I would go with a value of 1024 but you may need a higher value like 4096.  Experiment with it as necessary. 

Get-SPLogEvent -StartTime (Get-Date).AddMinutes(-5) | ?{$_.Correlation -eq $CorrelationId} | ft Category, Message -AutoSize | Out-String -Width 1024

At this point, any entry corresponding to the Correlation ID are displayed in the PowerShell window.  However, that’s not always very readable so I usually like to output the results to a text file.  For that, I just use the old Unix style > operator and specify a filename.  Here’s what the entire script looks like together.

Param([string] $CorrelationId)
Get-SPLogEvent -StartTime (Get-Date).AddMinutes(-5) | ?{$_.Correlation -eq $CorrelationId} | ft Category, Message -AutoSize | Out-String -Width 1024 > log.txt

Save your script in a file (i.e.: GetSPLogEvent.ps1).  You can then run it pretty easily with the following command.  Just pass a GUID to the –CorrelationId parameter.

.\GetSPLogEvent.ps1 -CorrelationId "a61775bd-a46f-4353-b62c-d4db3ec6cfea”

I then take a look at the output file log.txt to see the results:

This is one of these cases where you can combine many different aspects of PowerShell to make your life easier.  Try out the script for yourself the next time you need to track down an error.