I briefly talked about log correlation IDs in two previous posts (More on Correlation IDs in SharePoint 2010 and The SharePoint 2010 Developer Dashboard), and am also including a bit from yet another post (Diagnostic Logging Enhancements in SharePoint 2010). When you get to an error page in SharePoint 2010, you are now presented with a Correlation ID. Basically, this is just expanding upon Wictor Wilén’s post here: Working with SharePoint 2010 Correlation ID in PowerShell and code. I basically just want to flesh these out a bit, and ways to get at the errors you are looking for.
Using our Boston Area SharePoint Users Group website as an example – we don’t have search configured yet on the new site, however, we have the search box available currently (we’ll fix it, I swear!). Running a search produces the following error message:
Straight, and to the point. While about as useless as your regular everyday SharePoint error, you get a pretty icon, but, more importantly, you get a correlation ID. Now, let’s see what we get using the Get-SPLogEvent PowerShell command mentioned in Wictor’s article…
So, I am running the following command –
1: Get-SPLogEvent | ?{$_.Correlation -eq "41e7b6f1-ac66-4a16-87c0-18a85ad13f21"} | ft Category, Message -Autosize
2:
And it’ll take a few moments, as it has a LOT of log entries to run through…
So, let’s take a step back. Now, this is NOT SUPPORTED BY MICROSOFT, at least as far as I know. So, don’t do it. ever. really. They’ll find you. This may change however once the RTM copy hits the shelves, and it is available at Target stores world-wide. Once it is released, then we’ll be able to find out all of what is and what is not supported.
But let’s say, for the sake of argument, I want to find those log entries fast, and, as luck would have it, I am also the resident SQL DBA, so, I have access to the SharePoint databases on the farm’s SQL server.
Take a look at the WSS_Logging database. Specifically, at the ULSTraceLog view. Notice in there, that there is a column named CorrelationId? Well kids, that means we can do a direct SQL search for it, in addition to the handy PowerShell Get-SPLogEvent command, as well as the code-based approach Wictor outlined in his post!
1: SELECT *
2: FROM WSS_Logging.dbo.ULSTraceLog
3: WHERE CorrelationId = '41e7b6f1-ac66-4a16-87c0-18a85ad13f21'
4:
5:
This, as you may notice if you also try, this will take a few moments, depending on the size of your logs, but, what I have noticed, is that it runs far quicker than the Get-SPLogEvent PowerShell command.
So, in short, if you need a completely unsupported way to quickly get to your logs by using your CorrelationId, there is a faster way than viewing and searching through the ULS text logs on the file system, or using the Get-SPLogEvent PowerShell cmdlet.
I have not run actual timing tests on these, these are just from personal experience. Maybe one day I will get around to that…
Technorati Tags:
SharePoint,
SharePoint Foundation Server 2010,
Microsoft SharePoint Server 2010 Beta 2,
Microsoft SharePoint Server 2010,
SharePoint Foundation Server,
PowerShell,
Correlation ID,
CorrelationId,
Error,
SQL Server,
WSS_Logging,
ULSTraceLog,
ULS Logs,
Tracing,
Debug,
Debugging,
Get-SPLogEvent,
TSQL,
T-SQL,
SQL
Geoff Varosky's Blog 