Some Windows 10 users are attempting to view the Windows 10 update log after a failed update/upgrade but have no idea where to look. On Windows 10, the Update logs are now generated using ETW (Event Tracing for Windows) as opposed to Windows 8.1 and Windows 10.
Because Windows 10 uses event tracing for the generated update logs, you will need to do go through some workarounds in order to be able to view the Windows Update logs.
Since there are a couple of ways to go around making this happen, we have listed every potential method of finding & viewing the Update Logs on Windows 10 below:
- Converting Event Tracing events to a WindowsUpdate log.
- Viewing the full Windows Update log using the Event Viewer utility.
Feel free the method that you feel most comfortable with:
Method 1: Converting the ETW traces in Powershell
If you want an easy way to store and view the Windows Update log files in an easy-to-read format, the best way to do it is to run a Powershell command in an elevated command prompt that successfully converts all ETW (Event Tracing for Windows) into a readable WindowsUpdate.log.
This should be your preferred approach if you need to get a broad overview of all your Windows Update logs instead of looking for specific logs.
If this scenario is applicable, follow the instructions below to open up an elevated Powershell menu and run a command that successfully converts any ETW traces into a readable WindowsUpdate.log:
- Press Windows key + R to open up a Run dialog box. Next, type ‘powershell’ inside the text box and press Ctrl + Shift + Enter to open up an elevated Powershell window. When you’re prompted by the UAC (User Account Control), click Yes to grant admin access.
Accessing the PowerShell window - Once you’re inside the elevated PowerShell window, type the following command and press Enter to essentially convert every event tracing event related to your Windows update log into WindowsUpdate.log file:
Get-WindowsUpdateLog
- After you run the command, wait patiently as the operation might take a couple of dozen seconds.
- Once the operation is complete, navigate to your desktop and look for the WindowsUpdateLog file that was just created.
Converting ETW’s to a Windows Update Log Note: You can either open this new file with the classic Notepad app or you can use a superior text viewer like Notepad++.
Important: Keep in mind that this is only a static log file that will NOT update itself even if new errors are logged. If you want the updated list, you need to run the command above again.
If this didn’t work for you or you’re looking for a different method of viewing the error log of Windows Update, move down to the next potential fix below.
Method 2: Read the Windows Update logs via Event Viewer
If you’re looking to investigate specific Windows Update error logs, the better approach is to use the Event Viewer utility to view every Operational entry under WindowsUpdateClient.
This method is not recommended if you’re looking to take your logs outside Event Viewer since there’s no bulk export feature, but it’s perfect for investigating and pinpointing specific events.
If you’re comfortable with reading the Windows Update logs via Event Viewer, follow the instructions below:
- Press Windows key + R to open up a Run dialog box. Next, type ‘eventvwr.msc’ inside the text box and press Enter to open up the Event Viewer utility. If you’re prompted by the UAC (User Account Control), click Yes to grant admin access.
Accessing the Event Viewer Utility via a Run box - Once you’re inside the Event Viewer utility, use the menu on the left to navigate to the following location:
Applications and Service Logs\Microsoft\Windows\WindowsUpdateClient
- After you arrive at the correct location, select the Operational tab, then move down to the center pane to view a list of every Windows Update error log.
Kevin Arrows
Kevin Arrows is a highly experienced and knowledgeable technology specialist with over a decade of industry experience. He holds a Microsoft Certified Technology Specialist (MCTS) certification and has a deep passion for staying up-to-date on the latest tech developments. Kevin has written extensively on a wide range of tech-related topics, showcasing his expertise and knowledge in areas such as software development, cybersecurity, and cloud computing. His contributions to the tech field have been widely recognized and respected by his peers, and he is highly regarded for his ability to explain complex technical concepts in a clear and concise manner.
В современных версиях Windows логи службы обновлений
wuauserv
пишутся не в текстовый файл WindowsUpdate.log, а в бинарные файлы Event Trace Log (ETL) через механизм Event Tracing for Windows (ETW). Также информация об действиях агента обновления и история установки обновлений на компьютере доступна в журнале Event Viewer. В этой статье мы рассмотрим, как просмотреть логи агента обновлений в Windows и получить историю установки обновлений на компьютере.
Содержание:
- Просмотр журнала обновлений Windows в Event Viewer
- Просмотр лога обновлений WindowsUpdate.log в Windows 10 и 11
- История установки обновлений в Windows
Просмотр журнала обновлений Windows в Event Viewer
Служба обновлений Windows пишет довольно подробный лог о всех выполненных действиях в журналы Event Viewer (eventvwr.msc). При анализе логов установки Windows администратору будут полезные следующие журналы событий:
- • Applications and Services Logs -> Microsoft -> Windows –> WindowsUpdateClient -> Operational – логи клиента WindowsUpdate (позволяет понять, когда клиент выполнял поиск обновлений и загрузил с сервера обновления новые файлы);
- • Windows Logs -> Setup — логи установки обновлений Windows из CAB и MSU файлов. Например:
Package KB5034122 was successfully changed to the Installed state.
Вы можете выбрать события из журналов загрузки и установки обновлений с помощью PowerShell командлета Get-WinEvent:
Вывести десять последних ошибок в журнале клиента Windows Update:
$filter = @{ ProviderName="Microsoft-Windows-WindowsUpdateClient"; level=1,2,3}
Get-WinEvent -FilterHashtable $filter | Select-Object -ExpandProperty Message -First 4
Вывести список последних установленных обновлений Windows:
Get-WinEvent -filterHashtable @{ LogName = 'Setup'; Id = 2 }| Format-List Message, TimeCreated, MachineName
Просмотр лога обновлений WindowsUpdate.log в Windows 10 и 11
Начиная с Windows 10, логи агента обновления Windows не пишутся в реальном времени в файл
%windir%\WindowsUpdate.log
. Если открыть этот файл, в нем будет указано, что формат лога был изменен:
Windows Update logs are now generated using ETW (Event Tracing for Windows).Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log. For more information, please visit http://go.microsoft.com/fwlink/?LinkId=518345
Вместо этого логи Windows Update пишутся в ETL-файлы в каталоге
%windir%\Logs\WindowsUpdate
. Чтобы конвертировать ETW трейсы из ETL файлов в привычный текстовый файл с логом WindowsUpdate.log, воспользуйтесь командлетом Get-WindowsUpdateLog:
Get-WindowsUpdateLog -logpath C:\Temp\WindowsUpdate.log
В старых версия ОС (Windows 10 1709- и в Windows Server 2016) для преобразования логов на компьютере должен быть открыт доступ в интернет с серверу символов Microsoft (msdl.microsoft.com).
Если доступ в интернет заблокирован, вы можете скопировать ETL файлы на компьютер с новым билдом Windows 10/11 и сгенерировать лог файл с помощью команды:
Get-WindowsUpdateLog -ETLPath "C:\Temp\WindowsUpdateETL\" -LogPath "C:\Temp\WindowsUpdate.log"
Откройте журнал Windows Update с помощью блокнота:
Notepad C:\Temp\WindowsUpdate.log
Совет. Обратите внимание, что созданный файл WindowsUpdate.log является статическим и не обновляется в реальном времени, как в предыдущих версиях Windows.
Анализировать получившийся файл WindowsUpdate.log довольно сложно, т.к. в нем собираются данные из множества источников:
- AGENT- события агента Windows Update;
- AU – автоматическое обновление;
- AUCLNT- взаимодействие с пользователем;
- HANDLER- управление установщиком обновлений;
- MISC- общая информация;
- PT- синхронизация обновлений с локальным хранилищем;
- REPORT- сбор отчетов;
- SERVICE- запуск/выключение службы wuauserv;
- SETUP- установка новых версий клиента Windows Update;
- DownloadManager – загрузка обновлений в локальных кэш;
- Handler, Setup – заголовки установщиков (CBS и т.п.);
- И т.д.
Вы можете выбрать последние 30 событий от агента обновления Windows (agent) с помощью простого регулярного выражения PowerShell, выполняющего поиск текста в файле:
Select-String -Pattern '\sagent\s' -Path C:\Temp\WindowsUpdate.log | Select-Object -Last 30
По логу WindowsUpdate.log можно понять, получает ли компьютер обновления с Windows Update или локального WSUS сервера, есть ли проблемы с доступном в Интернет, используется ли системный прокси и т.д.
История установки обновлений в Windows
В современных версиях Windows 10/11 и Windows Server 2019/2022 журнал установленных обновлений доступен в панели Settings.
Перейдите в Settings -> Update & Security -> Windows Update -> View update history (или вымолните команду
ms-settings:windowsupdate-history
).
В этом разделе отображается список всех установленных в Windows обновлений. Отсюда же можно удалить обновление, если оно вызывает проблемы.
Также вы можете получить историю установки обновлений в Windows с помощью PowerShell. Можно получить дату установки последних обновлений на компьютере через CIM класс:
Get-CimInstance win32_quickfixengineering |sort installedon -desc
Или с помощью командлета
Get-WUHistory
из модуля PSWindowsUpdate.
One of the changes in Windows 10 is to the format of the log file of Windows Update. Instead of maintaining a plain text log file like all earlier releases of Windows, the Windows Update service now writes a number of Event Tracing for Windows logs (ETL files) under the location C:\Windows\logs\WindowsUpdate\. Here is how to get the good old log file for Windows Update in Windows 10.
The *.etl files are created by the the Event Tracing subsystem for Windows (ETW). In Windows 10, Windows Update is almost active all the time since it is a service so the log file has to be maintained and written to on a nearly continuous basis. While switching to ETL files has allowed Microsoft to reduce the disk load and not impact disk I/O or operating system performance, this method makes it harder for users to easily read the log. To make matters worse, these *.etl files are cached, so their contents doesn’t become available instantly.
Microsoft is aware of this issue. To overcome it and make the Windows Update log readable, Windows 10 provides two methods to read the log. One of them is a special PowerShell cmdlet and the other one is the built-in Event Viewer tool. Let’s see how to use them.
To find the Windows Update Log in Windows 10, do the following.
- Open PowerShell.
- Type the following command at the PowerShell console:
Get-WindowsUpdateLog
- When it finishes running, the cmdlet will create the classic WindowsUpdate.log file in your Desktop folder.
You can open it with Notepad and read it to troubleshoot any issues you may be having with Windows Update such as some updates not installing, getting stuck or throwing cryptic errors.
You are done!
Alternatively, you can use Event Viewer to read the Windows Update log. Here is how.
Read Windows Update log with Event Viewer
- Press the Win + X keys or right-click the Start button and select Event Viewer in the context menu.
- In Event Viewer, go to Applications and Service Logs\Microsoft\Windows\WindowsUpdateClient\Operational.
- Select the events in the middle column of the app’s window to read the log in the details pane below.
Tip: You might be interested in reading the following article:
How to see update history in Windows 10
The Settings app includes a special page, where the installation log is displayed in a friendly view. From Update History, you can also remove certain updates.
That’s it!
Support us
Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:
If you like this article, please share it using the buttons below. It won’t take a lot from you, but it will help us grow. Thanks for your support!
Download Windows Speedup Tool to fix errors and make PC run faster
Windows Update uses Event Tracing for Windows (ETW) to generate diagnostic logs in Windows 11/10, and save them in the .etl file format. The reason why this has been done is that it reduces disk space usage as well as improves performance.
One fallout of this method is that the Windows Update logs are not immediately readable. You need to decode the .etl file, which is the format these logs are saved in.
To read the Windows Update logs in Windows 11/10, Microsoft suggests the following method:
- Download Windows Symbol Package and install them using the method outlined here. Install these symbols to say, C:\symbols.
- Download Tracefmt.exe tool by following the instructions here. Tracefmt (Tracefmt.exe) is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. Tracefmt can display the messages in the Command Prompt window or save them in a text file.
Now open a command prompt with administrative rights and create a temporary folder, named %systemdrive%\WULogs. Now copy Tracefmt.exe to this directory.
Now, Run the following commands one after the other:
cd /d %systemdrive%\WULogs
copy %windir%\Logs\WindowsUpdate\* %systemdrive%\WULogs\
tracefmt.exe -o windowsupate.log <each windows update log delimited by space> -r c:\Symbols
The method does look tedious and Microsoft has promised that they would improve things, in the final version of Windows 10. Full details can be found at KB3036646.
UPDATE: Well things have improved in Windows 11/10 now.
Use PowerShell to read Windows Update logs
The WindowsUpdate.log is still located in C:\Windows, however, when you open the file C:\Windows\WindowsUpdate.log, you will only see the following information:
Windows Update logs are now generated using ETW (Event Tracing for Windows). Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log.
In order to read the WindowsUpdate.log in Windows 10, you will need to use Windows PowerShell cmdlet to re-create the WindowsUpdate.log the way we normally view it.
So open a PowerShell window, type Get-WindowsUpdateLog and hit Enter.
BONUS INFORMATION
Windows Update Log File formatting has been improved
When Microsoft released Windows 10, it substituted the Windows Update log file date log file from a plain text to a binary file format. The Windows Update log file is typically required by Developers and IT professionals to read vital information while debugging applications. The preferred format for the Update log file is text so that it can be opened using the plain text editor, or processed using the text editing tools.
However, with Microsoft replacing with an unreadable binary format, a new PowerShell cmdlet, Get-WindowsUpdateLog, was added to format the binary file and convert to the preferred text format.
This process required users to either connect to the Microsoft Symbol Server to get the latest symbol files or they needed to download the latest Windows symbol files before running the Get-WindowsUpdateLog cmdlet. However, the process would not lead to success if the latest symbols were unavailable at the Microsoft Symbol Server at the time of connection, thus throwing formatting issues in the formatted text files.
This issue has been sorted out now
Connection to Microsoft Symbol Server not required
With the release of Windows 10 v 1709, Microsoft has improved the overall Windows update log file access. Establishing a connection to the Microsoft Symbol Server to get the symbols is no longer required. Though, users will still have to run the Get-WindowsUpdateLog PowerShell cmdlet to translate the Windows Update log from its binary format into readable text files.
Observe the screenshots and you will find that though the computer has no network connection at all (see the icon at the bottom right), the Get-WindowsUpdateLog worked successfully.
What are Symbol files
For curious minds, here is an explanation. When applications, libraries, drivers, or operating systems are linked, the linker that creates the .exe and .dll files also create a number of additional files known as symbol files.
Symbol files are identified with the extension .pdb. They hold a variety of data which are not actually needed when running the binaries, but which could be very useful in the debugging process. symbol files typically contain,
- Global variables
- Local variables
- Function names and the addresses of their entry points
- Frame pointer omission (FPO) records
- Source-line numbers
Read next: Where to look for your Windows Update History.
Anand Khanse is the Admin of TheWindowsClub.com, a 10-year Microsoft MVP (2006-16) & a Windows Insider MVP (2016-2022). Please read the entire post & the comments first, create a System Restore Point before making any changes to your system & be careful about any 3rd-party offers while installing freeware.
Looking for easy ways to find Windows Update Logs in Windows 10?
Before Windows 10, all the Windows versions used to store the update log in the form of a text document in the operating system. However, it is not the same for Windows 10 users.
In Windows 10, Windows Update Service produces .etl files instead of WindowsUpdate.log files. Accessing these log files is not as simple as it used to be in the earlier Windows versions, and if you are struggling to find them, you are in the right place.
We have listed some easy methods that will help you find Windows Update Logs in Windows 10 below.
Let’s get started.
1. Convert the ETW traces in Powershell.
The best way to convert ETW (Event Tracing for Windows) to an easy-to-read WindowsUpdate.log is by using Windows Powershell.
This method is helpful for the users who are looking to view all the Windows Update Logs instead of specific files.
Here is what you need to do:
- Right-click on the Windows icon on your taskbar and select Windows Powershell (Admin) from the list of options available. Doing so will launch elevated Powershell on your PC.
- Inside the Powershell window, type the command mentioned below and hit Enter. This will convert all ETW (Event Tracing for Windows) into a readable WindowsUpdate.log file.
Get-WindowsUpdateLog
- Now navigate to your desktop and check if a new WindowsUpdate.log was created. You can view this file in Notepad.
That’s it!
However, you must remember that this file will not update automatically, so if you need the Windows Update logs in the future, you will have to follow the process mentioned above again.
2. Try Using CleanMyPC.
When was the last time you emptied your hard drive of the junk files that have accumulated over time? If that was long ago, then now might be the right time to do so because these supposedly ‘harmless’ junk files have the potential to cause serious issues within your operating system.
The easiest way to eliminate these junk files is by using an efficient PC cleaner and if you are looking for a recommendation, we highly recommend going for CleanMyPC.
CleanMyPC is one of the most popular PC cleaners on the market. It comes with a variety of system maintenance tools that can help you maintain your computer. These tools include (but are not limited to) a Multi-Uninstaller, Speed Booster, and Registry Cleaner.
All that you need to do is install CleanMyPC on your computer and run a scan using it. The rest will be taken care of!
Try CleanMyPC Now!
3. Use the Event Viewer.
If method 1 did not work for you because you want to view specific Windows Update error logs, try using the Event Viewer. This will help you view all the operational entries under WindowsUpdateClient.
Here is how you can use the Event Viewer to view Windows Update Logs in Windows 10:
- Open a Run dialogue box by pressing Windows + R keys simultaneously on your keyboard.
- Type ‘eventvwr.msc‘ in the text field of the dialogue box and hit Enter. Doing so will launch the Event Viewer utility.
- Inside the Event Viewer utility, navigate to the location mentioned below.
Applications and Service Logs\Microsoft\Windows\WindowsUpdateClient
- Now click on the Operational tab and move down to the center pane to locate the Windows Update error log.
As simple as that.
You should now be able to view Windows Update Logs without any issues.
This brings us to the end of our guide on ways to find Windows Update Logs in Windows 10. We tried walking you through all the steps in detail and hope that one of the methods mentioned above did the trick for you. In case you still have any confusion about the methods, please let us know in the comment section below!
If this guide helped you, please share it. 🙂
-
Zainab Falak is a staff writer for Saint and an expert in Microsoft Windows, having authored more than 200 posts. She has a Bachelors in Actuarial Sciences and her passion for computers extends to exploring various aspects, from UI customization to the Windows registry and exploring error codes. Twitter
LinkedIn
View all posts