How to find SharePoint uls log details based on correlation id using PowerShell

This PowerShell SharePoint tutorial explains, how to find uls log details based on Correlation ID from ULS Logs in SharePoint 2013/2016 using PowerShell.

This command will be very much helpful if you are working with multiple servers that are load balanced. Usually, the logs file will be too big, and to get log details for a particular Correlation ID is difficult for multiple servers.

Whenever any error occurs on any SharePoint page, SharePoint through an error saying Something went wrong, and then it will display a correlation id. Let us first understand what is a correlation id in SharePoint?

What is SharePoint correlation id?

If some error occurred in a page or site in SharePoint, most of the time SharePoint returns a unique GUID as “correlation ID”. As a SharePoint developer, you can take the correlation Id and search in the logs to get more information about the request.

SharePoint maintains logs in different areas. So it is very difficult to find what exactly the error is. But SharePoint provides an id which is known as correlation ID which is nothing but a GUID that is assigned to each conversation a user does or a SharePoint process does.

A site collection administrator can take the correlation id and search in the trace log to know where exactly the error occurred.

Just to remember for each entry in the trace log it contains a Correlation ID. A SharePoint administrator can view ULS logs using PowerShell with the correlation ID to track more information about the request.

Even administrators can use SharePoint LogViewer to retrieve logs from in SharePoint 2013/2010/2016. But normally your local SharePoint administrator will not be able to retrieve logs in SharePoint online.

Also, that entry contains the correlation id and some meaningful error message.

The correlation ID is exposed when an error page is displayed, and throughout the trace logs.

The correlation ID is not an error number or code. Simply, it’s a GUID (globally unique identifier) that’s automatically generated for every request that the SharePoint server receives. It’s unique to each request, not each error. However, when an error occurs, the error message contains the correlation ID that was valid for the request at the time.

The correlation ID is meant to be used to help a SharePoint Admin trace what was happening at the time of an error. It is only valuable as an interactive tool to help the Admin track down your error. An Admin uses the correlation ID as “breadcrumbs” to retrace requests or processes in the SharePointUnified Logging System (ULS) to find what leads up to and causes a problem.

If SharePoint gets an error that it can’t identify while working on that task, it posts an “Unexpected error has occurred” message and includes the correlation ID. The correlation ID can help find out what happened but doesn’t identify what happened.

A correlation ID in SharePoint is like a unique GUID generated at the time of a request in SharePoint. Each correlation ID is unique to each request on a SharePoint farm.

PowerShell Script to Find ULS Log details based on Correlation ID in SharePoint

Below is the PowerShell command which will pick the error details for the particular Correlation ID from all the servers to a single place.

You can run the PowerShell command using Windows PowerShell ISE or using Visual Studio Code.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"
Merge-SPLogFile -Path "E:\Bijay\TempError.txt" -Correlation ff3a479d-8e3b-a03f-6251-ce47ef2463c6 -Overwrite

Make sure you have write access to the E:\Bijay\ folder.

Once you run the command, it will pull the logs from all the servers and it will write in the text file.

Similarly, also you can use get-splogevent command to retrieve logs based on the correlation id.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"}

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

Get-SPLogEvent -StartTime YYYY-MM-DDTHH:mm:ss | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

You can also use the below command if you are trying in your local system rather in load balancer servers.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "da80689d-e397-70c8-65fd-34a7bc8a5446"} | select Area, Category, Level, EventID,Message | Format-List > E:\errorlog.txt

Merge-SPLogFile in SharePoint 2010/2013/2016

Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. You can run this command from PowerShell.

This will be very much helpful if you are working in a multi-server environment. As SharePoint maintains log entries in each server, by using this command you can pull them in a single file.

You can filter based on various criteria like StartTime and EndTime, Process, Area, Category, EventID, and Message etc.

Below is the full syntax according to Microsoft.

Merge-SPLogFile -Path <String> [-Area <String[]>] [-AssignmentCollection <SPAssignmentCollection>] [-Category <String[]>] [-ContextFilter <String[]>] [-Correlation <Guid[]>] [-EndTime <DateTime>] [-EventID <String[]>] [-ExcludeNestedCorrelation <SwitchParameter>] [-Level <String>] [-Message <String[]>] [-Overwrite <SwitchParameter>] [-Process <String[]>] [-StartTime <DateTime>] [-ThreadID <UInt32[]>]

Below are some example which will be helpful:

Example-1:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite

Example-2:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search

Example-3: (merges the log data of level High or higher)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High

Example-4: (merges based on a Correlation ID)

Merge-SPLogFile –Path "S:\SPLogs\MergedLogs.log" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite

Example-5: (Based on Time)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" – EndTime "06/09/2008 16:15"

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file

While working with Merge-SPLogFile PowerShell command, you might come across an error as Cmdlet did not return any records in the log file. Check your time range or filters.

We run the below PowerShell cmdlet to get SharePoint error details from ULS logs.

Merge-SPLogFile –Path "E:\SPLogs\MergedLogs.txt" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite
Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file
merge sp log file with correlation id

Below is the solution you can try to solve the issue.

Open your SharePoint 2013 Central Administration and then click on Monitoring. Then on the Monitoring page click on “Configure diagnostic logging” in the Reporting section.

This will open the Diagnostic Logging page. Then check the checkboxes like below are click on OK.

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file
merge-splogfile correlation id

You may like following SharePoint tutorials:

I hope this will be helpful to find SharePoint uls log details based on a correlation id using PowerShell. We also saw how to fix the error Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file in SharePoint 2013.

>