How to check the event log (if any) for network failure?

Question

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" message indicated by a yellow warning sign on the "Internet access" icon in system tray.

Could you get a timestamp for when this actually occurred in Event Viewer or in some other way?

So far I was only able to find the Event IDs under "WLAN-AutoConfig" for when the network was actually connected and disconnected.

Answer 1

In case you just need to know when internet access was lost / restored regardless of state changes of various network devices, navigate to UTC in Event Viewer:

Applications and Services Logs/Microsoft/Windows/UniversalTelemetryClient/Operational

Look for event ID 55. It displays a friendly text "Is the Internet available:" followed by true or false.

Answer 2

You can type at the command prompt:

netsh wlan show wlanreport

An HTML report will be generated, containing the logs of the last 3 days. In the "Summary/Wireless sessions" section, you can find informations about relevant activities.

The path to the generated report will be printed by the tool, by default it tries to write to C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html.

Answer 3

In the event viewer we can enable logging of WiFi. It gives detailed logs of the signal strength of WiFi.

The complete process including screenshots is given here.

1. Open the Windows Event viewer (eventvwr.msc) and then within the View Menu enable the Show Analytic and Debug Logs options.

2. Navigate to the WLAN-autoconfig event log. Since we enabled the Analytic and Debug logs option, beside the Operational log we also see the Diagnostic log.

3. The Diagnostic event log by default is not enabled, so first we have to enable it by right-clicking -> select Properties.

4. As soon as the Diagnostics mode is enabled you should see events coming in. To enforce things a bit simply disable and enable your wireless connection using your vendor's wireless connection software or by pressing the hardware button on your laptop.

You can see when the WiFi signal is lost.

Answer 4

I use Windows 10, and in my event viewer under Applications and Services Logs/Microsoft/Windows/NetworkProfile/Operational I find the event IDs 10000 for connected to a network and 10001 for disconnected from a network.

Answer 5

The eventlog filter would be:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-UniversalTelemetryClient/Operational">
    <Select Path="Microsoft-Windows-UniversalTelemetryClient/Operational">
      *[System[(EventID=55)]] and *[EventData[Data[@Name='State'] and (Data='false')]]
    </Select>
  </Query>
</QueryList>

@Taavik led me to the correct log and id, but you have to get fancy to pull just failures.

To put that in Task Manager, you have to create an event trigger, create a custom event, switch to the XML tab, enable editing, and paste it in there. They give you a little notice that you're on your own if you break anything at this point.

Note that I have occasional times when the internet goes out and in within a second or two within the log, so a short delay and recheck would be a good idea.

Answer 6

I checked a handful of event logs in Windows 10 and tested this by disconnecting and reconnecting my wifi and seeing which events popped up. I haven't verified that these are perfectly correlated with wifi disconnections, but it's been useful for my purposes:

Applications and Services Logs\Microsoft\Windows\WLAN-AuutoConfig\Operational (Events 2002 and 2010 occur when wifi disconnections AND connections)

Applications and Services Logs\Microsoft\Windows\Windows Firewall With Advanced Security\Firewall (Events 8003 and 11004 occur for disconnections; 8000, 8001, 11000, 11001, 11005, and 11010 occur for connections)