locked
How do use Correlation IDs effectively. What percentage of time is the Correlation ID in the Log? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All,

    When I receive an error with a correlation ID, I am frequently unable to find a log entry with that correlation ID. 

    So if you use Correlation ID's to solve problems please share your knowledge. When you read about Correlation ID's they sound like a super tool to solve problems, but when I attempt to find them (using text editor, ULSviewer, powershell) I usually cannot find the offending correlation id.

    Jie Lei  posted that "The correlation id will only be logged if the related feature want to output something to the ULS log. If this is not implenmented in the feature, then nothing will be logged."  A reply later he said "all OOB features should support logging of Correlation IDs'".

    What I would like is:

    A: Acknowledgement that I am not crazy "e.g. Greg you are not crazy, I have the same experience"

    B: Solution to logging Correlation IDs:  Here is what I configured or changed so that most (all) correlation ID's were findable in the logs.

    C:  Example of effective use:  Now that they are all in the logs, here is an example of how I use them to solve problems.

    I will be grateful for three answers (A, B and C)  that I can apply in my work.  I will then speak of you glowingly at every opportunity :-)

    Thanks,


    Greg

     

     

     

    Tuesday, January 31, 2012 8:54 PM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    1. Gotta love the ULS Viewer for stuff like this: http://ulsviewer.codeplex.com/

    2. Don't trust the entire correlation Id, when I'm searching I sometimes leave a space or something at the end, so at this point I always whack off the last couple digits of the correlation Id.

    3. It's never failed me so far, but every once in a while correlation IDs will show up on one server and not the other within the farm.

    4. Generally I use ULS for real time diagnostics of any issues with the farm, so I filter it way down to just the "Unexpected" events so that I can be someone proactive if someone has an issue and do some research before I get the call/e-mail about it.

     

     

    • Proposed as answer by SharePointSurfer Wednesday, February 1, 2012 2:05 AM
    • Marked as answer by Seven M Monday, February 6, 2012 9:07 AM
    Tuesday, January 31, 2012 9:01 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    I was a bit curious about this, so I went back and did some research on my systems; basically I'm paranoid.... All my logging is set pretty high, so anything happens - it gets logged.

    Check your logging setting in SharePoint, make sure you haven't set it too high for your needs, believe me, everything gets trapped and handled, but you may have told SharePoint not to bother writing certain things out to a file.  diagnostic logging can be found unter the monitoring section in CA ( /_admin/metrics.aspx )

    I would start by selecting all the boxes and use the "reset to default" option and see if your events are now being saved to the logs on the disk.

    you can also use PowerShell on each WFE to try to find the correlation ID once you've reset the logging:

    Get-SPLogEvent | ?{$_.Correlation -eq ""} | ft Category, Message -Autosize

    As for the whole proposed answer/marked answer thing - from what I've seen if someone proposes an answer to your question and it sits for a couple of days the mods go in and do a blanked approve, so if you ask other questions and a proposed answer doesn't meet your needs then you really have to be on top of it or the mods will close it out assuming you're just not coming back.  Believe me though, I've seen some "marked as answered" responses that have left me scratching my head as well....

    • Marked as answer by GregoryF Wednesday, February 8, 2012 7:21 PM
    Wednesday, February 8, 2012 3:31 PM

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    1. Gotta love the ULS Viewer for stuff like this: http://ulsviewer.codeplex.com/

    2. Don't trust the entire correlation Id, when I'm searching I sometimes leave a space or something at the end, so at this point I always whack off the last couple digits of the correlation Id.

    3. It's never failed me so far, but every once in a while correlation IDs will show up on one server and not the other within the farm.

    4. Generally I use ULS for real time diagnostics of any issues with the farm, so I filter it way down to just the "Unexpected" events so that I can be someone proactive if someone has an issue and do some research before I get the call/e-mail about it.

     

     

    • Proposed as answer by SharePointSurfer Wednesday, February 1, 2012 2:05 AM
    • Marked as answer by Seven M Monday, February 6, 2012 9:07 AM
    Tuesday, January 31, 2012 9:01 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Well that's a little depressing....  "It's never failed me so far" -  Does that mean 100% of the time that your receive a correlation ID you can find it in the SPLOGS?

    So you leave ULS viewer running live in a window and keep your eyes on it?

    Thanks for your response. 


    Greg

     

     

    Gregory Frick
    Tuesday, January 31, 2012 10:35 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    yes, I am able to find the correlation Ids.

    Generally my morning consists of coming into work, starting up a couple of remote sessions and kicking off the ULS on the WFEs and CA.   I go grab some coffee and when I come back I see if we have any "unexpected" issues.  SharePoint is nothing if not consistent, usually it's always erroring out or else it is solid.  After that I just run through the event logs to make sure there's nothing too terrible and check my e-mails for any issues reported during the night.  If all goes well, I minimize the windows and forget about SharePoint operations/maint for the day and move on to other work.  All said and done it's probably 20 minutes when there are no issues.

     

    Wednesday, February 1, 2012 3:56 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All,

    This question isn't really answered.  The fact is not all of my correlation ids that are presented on error dialogs are in the Logs.  I am not sure why and I was hoping for clarification.

    One post I found was that all oob features should generate correlation ids and they should be visible in the log.  But I attempted to Create a site from a solution from in a different site collection and I received an error with a corresponding correlation ID.

    A search of the error log for the correlation id came up empty. So I scratch my head and wonder why a correlation id is not in the log.  I suppose saving a site as a template and then using that solution on another site collection could be viewed as a NON OOB solutions since the template is technically a solution.

    Still it would be comforting to have this demystified.

    ieDaddy - I do appreciate your response (and all your other responses) but it is not actually an answer to my question.  It is interesting that this was proposed as an answer by SharePointSurfer and Marked as an Answer by Steven M.  

    Greg

    Gregory Frick

    Wednesday, February 8, 2012 2:18 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    I was a bit curious about this, so I went back and did some research on my systems; basically I'm paranoid.... All my logging is set pretty high, so anything happens - it gets logged.

    Check your logging setting in SharePoint, make sure you haven't set it too high for your needs, believe me, everything gets trapped and handled, but you may have told SharePoint not to bother writing certain things out to a file.  diagnostic logging can be found unter the monitoring section in CA ( /_admin/metrics.aspx )

    I would start by selecting all the boxes and use the "reset to default" option and see if your events are now being saved to the logs on the disk.

    you can also use PowerShell on each WFE to try to find the correlation ID once you've reset the logging:

    Get-SPLogEvent | ?{$_.Correlation -eq ""} | ft Category, Message -Autosize

    As for the whole proposed answer/marked answer thing - from what I've seen if someone proposes an answer to your question and it sits for a couple of days the mods go in and do a blanked approve, so if you ask other questions and a proposed answer doesn't meet your needs then you really have to be on top of it or the mods will close it out assuming you're just not coming back.  Believe me though, I've seen some "marked as answered" responses that have left me scratching my head as well....

    • Marked as answer by GregoryF Wednesday, February 8, 2012 7:21 PM
    Wednesday, February 8, 2012 3:31 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi ieDaddy,

    I just reproduced the problem in hopes that the error would reveal which category I should increase the logging level on.  (Diagnostic logging page in Central Admin).  The error does not indicate the category that the error falls in (there are 20 top level categories and they each have sub categories). The error also does not indicate the level of criticality associated with the error.  I will increase the Least Critical event to report in the trace log to "Unexpected". My criticality choices are not entirely clear what they mean  (None, Unexpected, Monitorable, High, Medium, Verbose) .  http://technet.microsoft.com/en-us/library/ee748656.aspx provides a table describing event and trace log levels.  However the level of criticality is not clear to me from that table. For example I can leave it blank or I can select None and I am not sure of the difference.   If I select none and refer to the table in technet then None would mean that the "Least Critical event to report in the trace log  would be  = No trace logs are written"  How can I include trace events where no trace logs are written?  Alright it is starting to make sense  "Unexpected = critical". So unexpected is the most severe and verbose is the least severe (even though verbose means to me "same level more detail").

    Ok so my next test is to select 'em all and set the trace to Verbose and reproduce my problem and then search my trace log for the correlation ID. 

    It seems then that inorder to find all your correlation ids in the SharePoint Logs (trace logs) you would need to set the level of criticality at Verbose.  I suppose it also means that if my level of criticality is set to Unexpected and I cannot find a log entry for the correlation ID in an error message then the error must not be an Unexpected (Critical) error.

    The error that prompted this line of inquiry was an generated when I tried to create a site based on a site template (solution) that I downloaded from another site collection.   Though I was unable to create a site based on the template the error was not considered critcal (unexpected).

    So I just duplicated the problem and when I opened the log up in Notepad I could search for the correlation ID (just a part of it since I don't know how to copy it from error when silverlight is installed).  Most of the lines in the log file corresponding to the correlation id are verbose and one is medium. 

    Alright now I am cooking with gas.  I searched with notepad to find the first instance of hte correlation ID, I copied it. Opened the log file in the ULS Viewer and I used find and pasted in the Correlation ID. I also modified the filter and pasted in the correlation ID and I was able to see all the lines witht that correlation ID. 

    ieDaddy thanks for coming back and responding again.  You helped me work through it.

    Greg

     

    Gregory Frick

    Wednesday, February 8, 2012 8:22 PM