21

I know that there is the event log, but that's not where it stops. There are logs for MSI executables, device logs, setup and installation, performance logs, and so on. It's probably quite a long list; however, where can I find such an exhaustive list of what Windows logs?

By preference it would be handy to have a list that goes further than just what's on by default; as to know what each logger does, which ones are not on by default, which ones can('t) be turned of, ...

Do you know of any such list? Anyone up for building such a list?

|improve this question
  • 1
    In addition to any answer, one can use powershell to write their own events to the event log, so any created script or in-house Windows application can write to the event log. It's important to remember that 'Windows' is not doing the logging in most cases, but it's up to the individual application to do log its own events. – MDMoore313 Jun 12 '13 at 14:07
19

Centralized Log Locations

  • %WINDIR%\System32\config or %WINDIR%\System32\winevt\Logs
    Contain most of the event logs accessible from the Event Viewer.

  • %WINDIR%\Logs
    Contains a lot of textual log files.

Microsoft Security Essentials

  • %PROGRAMDATA%\Microsoft\Microsoft Antimalware\Support
    Runtime Logs

  • %PROGRAMDATA%\Microsoft\Microsoft Security Client\Support
    Installation Logs

Temporary Installation and Windows Defender Logs

  • %WINDIR\Temp\*.log
    Contains information about MSI installations as well as for Windows Defender starting / scanning.

  • %AppData%\Local\Temp\*.log
    Contains information about MSI installations ran in the context of the current user.

Windows Installation Logs

  • %AppData%\Local\Microsoft\Websetup (Windows 8)
    Contains details about the web setup phase of Windows 8.

  • %AppData%\setupapi.log (Windows XP and earlier)
    Contains information about device and driver changes and important system changes, like installation of service packs and hotfixes.

  • %SYSTEMROOT%\$Windows.~BT\Sources\Panther\*.log,xml
    Contains information about setup actions, errors, structure, SIDs and early setup devices. When the installation is rolled back, these files will contain rollback information.

  • %WINDIR%\PANTHER\*.log,xml
    Contains information about setup actions, errors, structure, SIDs and later setup devices.

  • %WINDIR%\INF\setupapi.dev.log
    Contains information about Plug and Play devices and driver installations.

  • %WINDIR%\INF\setupapi.app.log
    Contains information about the installations of applications.

  • %WINDIR%\Performance\Winsat\winsat.log
    Contains performance test results.

Windows Time Service

  • To enable logging of the Windows Time Service:

    w32tm /debug /enable /file:"C:\time-service.log" /entries:1000 /size:10485760

  • To disable logging of the Windows Time Service run:

    w32tm /debug /disable

Windows Update

  • %WINDIR%\WindowsUpdate.log
    Contains all events related to Windows Update

  • %WINDIR%\SoftwareDistribution\ReportingEvents.log
    Contains events related to software update status reports.

Deployment Image Service and Management Tool (DISM)

  • %WINDIR%\Logs\DISM\dism.log
    Contains information about events that happen when interacting with the Windows image.

Component-Based Servicing (CBS)

  • %WINDIR%\Logs\CBS\CBS.log
    Contains information about events that happen when interacting with Windows components and features.
|improve this answer
  • 1
    +1 We could build up such a list because I doubt if one exists. – Tamara Wijsman Jun 26 '12 at 12:43
-1

I think you are asking for the impossible. There are numerous log sections within the Windows Event Log, accessed by Windows and non-Windows applications and services alike, and it differs from one Windows version to the next. On top of that, there are numerous other logging options, including text (e.g. .log) files and in the Windows Internal Database.

The list would be vast and varied, and would depend on the particular OS you have and how it is configured.

|improve this answer
  • 1
    @TomWijsman - Substitute 'impossible' for 'Unlikely, difficult to be comprehenisve'. And Windows Server is part of the Windows family you included in your tags. – CJM Jun 26 '12 at 15:50
  • Agreed, although getting together a basic list should already be a good start to have the most trivial logs to look at. Most likely when you're using something very specific, like on Windows Server, you'll have the event log or more specific logs to look at; which is most likely mentioned in documentation. – Tamara Wijsman Aug 15 '12 at 14:16
-2

Run 

wevtutil el

at the command prompt.

C:\Users\rvlan500\Desktop>wevtutil el /?
List the names of all logs.

Usage:

wevtutil { el | enum-logs }

Example:

The following example lists the names of all logs.

wevtutil el

C:\Users\rvlan500\Desktop>
|improve this answer
  • 2
    Welcome! How about some expansion on your answer? How does this help answer the question? Why would someone run it? How is this not just the standard Event log stuff? – Ƭᴇcʜιᴇ007 Jul 17 '13 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.