20

Suppose, when you leave your computer running while it's connected to internet and after a while if your WiFi modem freezes in the middle, then there would be a "Limited or No Network connectivity" message indicated by a yellow warning sign on the "Internet access" icon in system tray.

enter image description here

Could you get a timestamp for when this actually occurred in Event Viewer or in some other way?

So far I was only able to find the Event IDs under "WLAN-AutoConfig" for when the network was actually connected and disconnected.

6 Answers 6

19

In case you just need to know when internet access was lost / restored regardless of state changes of various network devices, navigate to UTC in Event Viewer:

Applications and Services Logs/Microsoft/Windows/UniversalTelemetryClient/Operational

Look for event ID 55. It displays a friendly text "Is the Internet available:" followed by true or false.

4
  • This was great information but I was only interested in failures: "Is the Internet available: false". I couldn't create a custom view to filter only those so I decided to save events as a CSV (use Event Viewer to "Save All Events in Custom View As...") . I opened that in Excel and sorted by the text and date. Great!!! All false entries in date order :-) Aug 8, 2019 at 23:43
  • 2
    This is exactly what I was looking for. Thank you!!
    – Matthew
    Sep 11, 2019 at 0:11
  • the event log is delayed for about 1-2 mins than the actual event. this means shorter intermittent failures did not show up in this log (this is in my case). however for longer down time (> 2 mins), this is really good!.
    – ihightower
    Apr 14, 2020 at 17:59
  • how the logs are collected? if the laptop is not running, surely it is not going to collect data, when it is running, can we assume that events are logged when status change, and if there is no data when the laptop is running, it is assumed to be good? Just looking at the "is internet available: false" might be selection bias. ie. your total number of "is internet available: false" doesn't not necessarily mean you have a unstable network, maybe because you just happen to use the network more.
    – B.Mr.W.
    Feb 6, 2021 at 16:42
11

You can type at the command prompt:

netsh wlan show wlanreport

An HTML report will be generated, containing the logs of the last 3 days. In the "Summary/Wireless sessions" section, you can find informations about relevant activities.

The path to the generated report will be printed by the tool, by default it tries to write to C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html.

3
  • Welcome to Super User! Could you tell us where the HTML report is placed?
    – MMM
    Dec 4, 2019 at 12:59
  • @MMM added to the answer Jan 19, 2021 at 8:05
  • For Windows 10 only, not available on Windows 7
    – Ivan Chau
    Sep 3, 2021 at 16:12
8

In the event viewer we can enable logging of WiFi. It gives detailed logs of the signal strength of WiFi.

The complete process including screenshots is given here.

  1. Open the Windows Event viewer (eventvwr.msc) and then within the View Menu enable the Show Analytic and Debug Logs options.

  2. Navigate to the WLAN-autoconfig event log. Since we enabled the Analytic and Debug logs option, beside the Operational log we also see the Diagnostic log.

  3. The Diagnostic event log by default is not enabled, so first we have to enable it by right-clicking -> select Properties.

  4. As soon as the Diagnostics mode is enabled you should see events coming in. To enforce things a bit simply disable and enable your wireless connection using your vendor's wireless connection software or by pressing the hardware button on your laptop.

You can see when the WiFi signal is lost.

4
  • @karel , thanks for the edit. I thought the link describes it all. Apr 29, 2016 at 7:32
  • I thought so too however any answer that does not have an explanation in the body text, even a good answer, may be closed by reviewers as a link only answer, mainly because links can become unavailable over time and frequently do, while an answer that has an explanation in it is permanent.
    – karel
    Apr 29, 2016 at 7:35
  • @karel, true i agree. Apr 29, 2016 at 7:44
  • And of course now the link is dead, so thanks for the explanation.
    – jjcf89
    Jul 24, 2019 at 19:01
5

I use Windows 10, and in my event viewer under Applications and Services Logs/Microsoft/Windows/NetworkProfile/Operational I find the event IDs 10000 for connected to a network and 10001 for disconnected from a network.

1
  • OP was not asking about when a connection is made or lost, but when there are any issues with the connection. Please focus your answers on the question that is actually being asked. Jan 31, 2019 at 23:30
5

The eventlog filter would be:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-UniversalTelemetryClient/Operational">
    <Select Path="Microsoft-Windows-UniversalTelemetryClient/Operational">
      *[System[(EventID=55)]] and *[EventData[Data[@Name='State'] and (Data='false')]]
    </Select>
  </Query>
</QueryList>

@Taavik led me to the correct log and id, but you have to get fancy to pull just failures.

To put that in Task Manager, you have to create an event trigger, create a custom event, switch to the XML tab, enable editing, and paste it in there. They give you a little notice that you're on your own if you break anything at this point.

Note that I have occasional times when the internet goes out and in within a second or two within the log, so a short delay and recheck would be a good idea.

2
  • Why put in Task Manager?
    – Alex78191
    Mar 29, 2021 at 23:55
  • 2
    @Alex78191 It's often useful to trigger something, like a failover link or alert, when the network link fails. Mar 31, 2021 at 10:52
3

I checked a handful of event logs in Windows 10 and tested this by disconnecting and reconnecting my wifi and seeing which events popped up. I haven't verified that these are perfectly correlated with wifi disconnections, but it's been useful for my purposes:

Applications and Services Logs\Microsoft\Windows\WLAN-AuutoConfig\Operational (Events 2002 and 2010 occur when wifi disconnections AND connections)

Applications and Services Logs\Microsoft\Windows\Windows Firewall With Advanced Security\Firewall (Events 8003 and 11004 occur for disconnections; 8000, 8001, 11000, 11001, 11005, and 11010 occur for connections)

1
  • For the WLAN-AutoConfig event log I have 8001 for connecting to a wifi network, and 8003 for disconnecting from a wifi network. I see no 2002 or 2010 events in my log. I'm using Windows 10. Dec 31, 2018 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.