USING MERGE-SPLOGFILE TO FIND CORRELATION ID

When you are hit with a problem in SharePoint 2013 you get notified to use a correlation id to check for further details in the trace logs (ULS logs).

So you hopefully start up ULS Viewer and open up the relevant logs and search like a mad man after this specified correlation id. Sometimes you don’t find the provided correlation id in the log file you opened. Is there a easier way?

Yes and that is to use the SharePoint PowerShell command Merge-SPLogFile. According to the description of Merge-SPLogFile on Microsoft TechNet:

“Combines trace log entries from all farm computers into a single log file on the local computer.”

Let me explain how you can use this powerful command.

Basic Usage

Lets visualise a simple farm.

As the example Farm image above we have two frontend servers, application server and database server. If I wanted to consolidated the last hour of SharePoint log entries from the front-end server and application server I would open up SharePoint Management Shell on one of the servers and type the following command:

Merge-SPLogFile –Path “E:\SPLogs\MergedLogs.log” –Overwrite

Now that was a very basic example to merge the various servers log files. More parameters are available on theMicrosoft TechNet article for Merge-SPLogFile. For example Area, Category, Level, Message, StartTime, EndTime and more.

Finding Correlation ID

What the following example show is how to find the log entries for a specific correlation id:

Merge-SPLogFile –Path “S:\SPLogs\MergedLogs.log” –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite

Since the log files are merged with just the specified correlation id you can load the log file in ULS Viewer to easily view the entries. Please be aware that the log can be empty if the logging level is set to low for the SharePoint category. Just go to SharePoint Central Administration to increase the logging level.

As you can see in the image above the correlation id has 19 matching entries in the log file. Much less log entries to scroll through.

Summary

I hope this helps you on finding SharePoint errors quicker and easier. Let me know what your favourite commands and tools are for debugging SharePoint.