The dreaded Correlation ID! It is fine when you have a few servers in your farm. However, if you manage a huge farm finding the error can be time-consuming. Instead of searching every server in the farm logs to match the correlation ID, the Merge-SPLogfile cmdlet allows an admin to create one logfile from the correlation ID. The cmdlet will search every server in the farm, match the correlation ID, and make one single log file.

The correlation ID is not an error number or code. Simply, it’s a GUID (globally unique identifier) that’s automatically generated for every request that the SharePoint server receives. It’s unique to each request, not each error. However, when an error occurs, the error message contains the correlation ID that was valid for the request at the time. The correlation ID is meant to be used to help a SharePoint Admin trace what was happening at the time of an error. It is only valuable as an interactive tool to help the Admin track down your error. An Admin uses the correlation ID as “breadcrumbs” to retrace requests or processes in the SharePoint Unified Logging System (ULS) to find what leads up to and causes a problem. If SharePoint gets an error that it can’t identify while working on that task, it posts an “Unexpected error has occurred” message and includes the correlation ID.

Here is an example:

Merge-SPLogfile –Path “C:\SP2013\ErrorLogs\mergedlogs.log” –Correlation 725a2a9e-db7a-f069-f64d-26103e083a40

When you receive the Correlation ID from a user outside the twenty-minute window, you need to provide a general start time/date and end time/date. In this example, the user tells me that the Correlation ID was received around 1 pm to 3 pm today.

Here is an example:

Merge-SPLogfile –Path “C:\SP2013\ErrorLogs\mergedlogs.log” –Correlation 725a2a9e-db7a-f069-f64d-26103e083a40 -StartTime “03/18/2016 13:00” –EndTime “03/18/2016 15:00”

You can use a tool such as ULSViewer to look at this data and filter out the requests you don’t need to see. Questions? Contact us!