19

Windows 7 frequently plays the usb/new device connection/disconnection sound. It happens both when the computer is idle and under load. All usb device connections have been checked (though I can't rule out a bad cable yet). I thought a good way to track down the issue would be to wait for the sound and then check the log file for the latest connected/disconnected device. I just need to know which log file has this information.

Edit: I'm going to leave the answer accepted, however the issue persists. I get that sound seemingly randomly throughout the day. Anyone else have any ideas?

Improve this question
2

6 Answers 6

Reset to default
17

try using USBLogView

Improve this answer
1
  • Nice program, does not actually read any windows usb log files (because they don't exist in windows), but does log usb events that happen after the program is opened, useful program though, thanks for posting it.
    – Moab
    Dec 11, 2011 at 18:53
20

There IS a log file of all device connections and disconnections, in %SystemRoot%\inf\setupapi.dev.log . It is semi-readable text. It contains reports for all devices, not just USB.

Open it in Notepad (or Notepad++ or vi or ex or...), scroll to the bottom, and note that the output for each new device is separated from the previous by a couple of blank lines. The most recent will be at the end. There are timestamps.

If the text doesn't tell you what device(s) are trying to connect, then look for lines like this:

 dvi:      Searching for hardware ID(s):
 dvi:           usb\vid_1532&pid_0021&rev_0200&mi_00
 dvi:           usb\vid_1532&pid_0021&mi_00

and search on the web for vendor ID 1532; then, from likely-looking pages, product ID 0021 (the revision code and the rest of the strings don't matter).

n.b.: There are a large number of sites out there that try to provide this information. Many of them offer driver downloads. Do not download any drivers from anywhere except a) Microsoft update or b) the web site of the company that made your device.

Improve this answer
4
  • I have to wonder why the downvote on this. The file I mentioned definitely exists and contains information as I described. I would appreciate hearing specifically what the complaint is.
    – Jamie Hanrahan
    Sep 24, 2015 at 14:00
  • 3
    Didn't downvote. But here's a thing: on my Win10 laptop, that file doesn't log all plug/unplug events. Just tried with a USB stick on all my USB ports. Only the very first such event in a session seems to be recorded.
    – StackzOfZtuff
    Jan 27, 2016 at 11:18
  • 1
    @StackzOfZtuff Haven't investigated this on Windows 10. It may be that it is only logging the events that require finding the right .INF file and driver. Once a given device instance has been configured successfully, the right driver is known for that session, so the log isn't updated. Thank you for the report - this is news to me!
    – Jamie Hanrahan
    Jan 28, 2016 at 14:55
  • This ended up helping me, I think.. I've been dealing with a continual device disconnect alert, and it definitely isn't USB related. I found a Delete Device entry multiple times for the system print spooler that I think may be the culprit. Thanks for the info!
    – CXL
    Jan 28, 2016 at 15:58
4

In case anyone stumbles upon this and needs a solution for Windows 8 or greater, like I did here. I found that using EventGhost (free and open source) worked for me on Windows 8.1.

Improve this answer
3
  • 1
    Well, it sort of worked... EventGhost is the only tool I could find that could detect a device connection, but all it tells me is: System.DeviceRemoved [u'\\\\?\\DISPLAY#ACR0091#5&efbe89a&0&UID519#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}'] and unfortunately I have no idea how to get anything useful out of that :)
    – Josh
    Sep 20, 2015 at 23:22
  • 3
    Looks like it's your monitor. us.driverscollection.com/Search/Monitor%5CACR0091 Shows it's an Acer B273HU
    – Royal2000H
    Sep 23, 2015 at 19:23
  • Awesome! In that particular case I suspected so, but in general I had no idea how to interpret the data from eventghost. Thanks for pointing out how and where to look it up!
    – Josh
    Sep 23, 2015 at 20:55
3

These type of event don't always get registered. However, if it is a system event that IS registered by the OS itself, it would be in your Event Viewer under either Custom Views\Administrative Events or Windows Logs\System or possibly Windows Logs\Application depending on the type of events: hardware, drivers, etc.

Now if its done by an application, such as ImgBurn revving up the optical drive to read/rip or write/burn something, it would be strongly dependent on the developer/vendor and if they have chosen to register events and to what extent. If they do register events, they would appear under Applications and Services Logs generally corresponding to the applications name.

Finally, if you KNOW the type of event you are trying to capture, you can create a custom view report under event viewer and set the event level, source it either by log (predefined) or by source to specific element (much more granular), and even if you want to add keyword (use only if you know the event name you are trying to capture). Do what you need to do after you create that and go back and see what it captured for you.

Hope that helps.

Improve this answer
6
  • 1
    The problem is that I can't find an event. The sound is standard, the one which sounds anytime any device connected. Doesn't Windows control the process?
    – Dims
    Aug 31, 2013 at 20:21
  • Not generally. The drive spins, optical drive scanning, and so on are generally managed by the drive's controller. The system rarely cares what's going on. However, that being said, the OS needs to recognize if the drive is READY for example, or is it EJECTED, or is it BUSY, so these events are checked but usually as part of a function, so they may not necessarily register them as an event. The only condition I can think of off the top of my head would be the DMA status of a drive, even that could be controller based check.
    – GµårÐïåñ
    Aug 31, 2013 at 20:25
  • This is external device, connected by USB. Can it be ignored by Windows too?
    – Dims
    Aug 31, 2013 at 20:44
  • More than likely yes. However, since it is USB and uses the BUS and the driver for hardware allocation, the system will be involved in "detecting" it and checking its status as active/inactive. However, it doesn't actually consider those checks events and throw a particular message for it, just part of the driver and system I/O check, unless the driver is non-generic and the manufacturer chose to implement event handling, it won't show up.
    – GµårÐïåñ
    Sep 1, 2013 at 10:08
  • Ok, so event viewer is useless tool for detecting system problems with drivers. Because it can work or it can not work -- one can't rely on it... Pity!
    – Dims
    Sep 1, 2013 at 18:06
1

Another quick (but not much reliable) way to find out all USB Devices (ever inserted) list in regedit :

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

And for specifically USB Flash Drives:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
Improve this answer
0

I don't have the rep to post this as a comment on the original reply by @imaximchuk, but USBLogView works on Windows 10 as of version 1.20.

I have a similar issue with something connecting and disconnecting constantly, and USBLogView worked for me on Windows 10 (10.0.16299)... almost. Sadly, it only logged USB Mass Storage Device events, not all USB events.

I tried EventGhost (the URL has changed to http://www.eventghost.net because they somehow lost access to the .com address) and yes, it shows EVERYTHING!

As noted above, it's a bit cryptic, so you'll have to do some searching to figure out what it is. In my case, yep, another monitor. No idea why it started doing it out of the blue. On to the next mystery (why the hell it's happening.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .