An even better way to get the real SharePoint error from the ULS logs

In a previous post, Get the Real SharePoint Error using the ULS Logs, I explained how to find the necessary information in the ULS log files to help determine the cause of an error. My process involved logging into your farm servers and searching the ULS log files for the correlation ID that is supplied with the error SharePoint gives you. This process is tedious and is basically impossible in multiserver farms since you are not sure on which server the errors exist.

Since then I’ve learned about a very powerful SharePoint PowerShell cmdlet that should be referenced at the top of every ULS log file. I assure you it will greatly simplify the process for collecting ULS logs given a correlation ID so much that you will go out and run it on every SharePoint (2010 and 2013) farm you see.

With the Merge-SPLogFile cmdlet, you solve the problem of figuring out which server has the log with the exception because this cmdlet reaches out and collects the ULS logs from all the servers in the farm! You can then review the log file to see the events as they happened in the order they happened on the server that they happened. And it gets better: you can use the -Correlation parameter and collect only the events with your exception’s correlation ID. In other words, Merge-SPLogFile will collect all events that match your correlation ID from all servers in your farm and saves the events to a custom ULS log file that you can then use to document and reference the error.

Let’s see how it works with SharePoint 2013.

So we got an exception when browsing to our site. Thankfully we are a SharePoint administrator and have local administrator and Shell Admin access to the farm.

We break out a SharePoint Management Shell, depending on the version of Windows:

• In Windows Server 2008 (R2): Start, All Programs, Microsoft SharePoint [Version] Products, SharePoint [Version] Management Shell, where [Version] is either 2010 or 2013 depending on whichever you have installed.
• In Windows Server 2012: Hopefully it's pinned in your Start Menu, otherwise you can type “SharePoint 2013 Management Shell” in the Start Menu and it will appear (SharePoint 2010 is not supported on Windows 2012).

For both shortcuts, right click and Run as Administrator.

The SharePoint Management Shell will open and you can run the Merge-SPLogFile cmdlet. Using the correlation ID we got from our error above, we have something that looks like this:

Merge-SPLogFile -Path ".\error.log" -Correlation "5ca5269c-8de5-4091-3f1b-f179af4d5121"

We can then open our log file with ULS Viewer and see the specific exception:

Merge-SPLogFile is available in SharePoint 2010 and SharePoint 2013.