I use this often enough I thought I’d write a quick post about it.  Basically, whenever an issue occurs on SharePoint we get a nice friendly error message with a correlation ID, which is great for troubleshooting the issues assuming that we have a nice timeframe for when the issue occurred.  We can quickly open the ULS Viewer, locate the correct log file, and filter for the correlation ID.   Unless of course we don’t have a time frame or we run a large farm, then it becomes more of a biblical “seek and ye shall find” approach.

That is where the beauty of PowerShell comes in.  There is a great command called Get-SPLogEvent which allows us to access the ULS logs through PowerShell and returns results from a Unified Logging Service (ULS) trace log.

Now, this is a great tool in general for being able to write monitoring scripts for SharePoint by using the following:

Get-SPLogEvent -MinimumLevel "Error"

Use the StartTime and EndTime flags and you can basically monitor your system every couple of minutes and if an Error level item is returned you can send yourself an email using the Send-MailMessage command.

However, what inspired this post is that I yet again received an e-mail with a screenshot of a friendly SharePoint error page telling me “An unexpected error has occurred.” (Do we every have an expected error?).  So, logging into the server and firing up my handy PowerShell windows I can use the following to find the specific Correlation ID in the ULS to quickly diagnose the issue.

Bring up the SharePoint 2010 Management shell on your server and enter the following:

Get-SPLogEvent | ?{$_.Correlation -eq "Correlation ID of Error"} | ft Category, Message -Autosize

Substituting the “Correlation ID of Error” string for the GUID in your screenshot.

If you want more detail than just the Category  and Message, just select the additional fields:

Get-SPLogEvent | ?{$_.Correlation -eq "Correlation ID of Error"} | select Area, Category, Level, EventID, Message | Format-List

and if you want to pipe it into a file so you can email it off to your SharePoint support group (because sometimes in large organizations there is more than just one person responsible for the SharePoint farm) you can use this to create a file:

Get-SPLogEvent | ?{$_.Correlation -eq "Correlation ID of Error"} | select Area, Category, Level, EventID, Message | Format-List > c:\SPCorrelationErr.log

And just like that, easy ways to extract the information you are looking for to help troubleshoot your SharePoint farm.