SharePoint Server Correlation ID – Get Detailed Error using PowerShell

Correlation IDs are introduced in SharePoint 2010 to uniquely identify each error encountered. Later, these correlation IDs are used as a starting point reference to get the complete error details from ULS logs during troubleshooting issues.

How to check correlation ID in SharePoint 2016?

While it’s possible to open and search ULS logs correlation IDs with notepad, There are some easy ways and tools to lookup correlation ID errors in SharePoint Server.

Here is a typical SharePoint “Sorry, something went wrong” error page with a correlation ID.

Find SharePoint Server correlation ID using PowerShell

Just get the correlation ID in SharePoint from the error page and pass it to the PowerShell cmdlet: Get-SPLogEvent. Here are some examples: Login to your SharePoint server(s), Open SharePoint 2016 management shell and replace the GUID with your correlation ID.

#Get all details of the error
Get-SPLogEvent | ?{$_.Correlation -eq "6922c76b-32f7-4e2e-af96-fbda88a77fa5"}

#Retrieve selective columns of the error 
Get-SPLogEvent | ?{$_.Correlation -eq "f53b559c-f70e-002f-694c-7d3b8b55f534"} | select Area, Category, Level, EventID, Message | Format-List

#Get sharepoint 2013 correlation id in error messages and send to file
Get-SPLogEvent | ? {$_Correlation -eq "3410f29b-b756-002f-694c-7a574ff74cab" } | select Area, Category, Level, EventID, Message | Format-List > C:\SPError.log

#Get all issues logged in the past 10 minutes
Get-SPLogEvent -starttime (Get-Date).AddMinutes(-10)

#Get Events between specific time frames
Get-SPLogEvent -StartTime "03/06/2015 18:00" -EndTime "03/06/2015 18:30" 

Find and Extract ULS LOG in Multi-Server SharePoint Farm:

Please note, All these cmdlets search for a given correlation ID on a specific SharePoint server where you run the PowerShell script. To search and extract LOG from all SharePoint Servers, matching the given correlation ID, use:

Merge-SPLogFile -path "D:\ErrorLog.txt" -Correlation "Your-error-correlation-id"

SharePoint correlation ID viewer
There are some good tools out there.

• ULS Viewer (MSDN Version), You can download it from here
• SharePoint ULS Log Viewer: You can download it from here
• SharePoint LogViewer

SharePoint 2016 correlation ID location:
Usually, ULS logs are located at 15/16 hive’s LOGs folder. E.g: “C:\Program Files\Common files\Microsoft Shared\Web Server Extensions\15\LOGS”.

SharePoint 2016 correlation ID not in the log?
ULS logs are specific to per WFE (Web Front End) server. So, In a multi-Server SharePoint farm, When users hit SharePoint 2016 sites and ended up in an error page, that can be served by any one of the front end, with the error logged in the ULS logs folder of the particular web front end. So, if SharePoint 2010 correlation id is not in log, you got query all web front end’s ULS logs with the specific correlation ID. Use the below method of querying SQL Server to get the error details regardless of the server.

Query SQL Server Database for a specific correlation ID:
In SharePoint 2016, searching correlation id error can also be done by querying the Logging database. It’s usually with a name: WSS_Logging unless you change it! Query from ULSTraceLog view as:

SELECT [MachineName], 
    [Area],
    [Category],
    [Level],
    [EventId],
    [Message],
    [CorrelationId] 
FROM ULSTraceLog 
WHERE [CorrelationId] = '39C29F9C-6890-D07A-0D7C-5A3A7AB7BFF5'