Widows Log Files (windows日志文件)

最新推荐文章于 2022-05-24 13:29:22 发布

DoveFeng

最新推荐文章于 2022-05-24 13:29:22 发布

阅读量5.1k

点赞数

分类专栏： Windows

Windows 专栏收录该内容

18 篇文章 0 订阅

订阅专栏

1.1 计划任务服务
Schedlgu.txt为计划任务服务的日志文件，可以在下面的键值指定该文件的路径
Key: HKLM/SOFTWARE/Microsoft/SchedulingAgent
Value: LogPath (REG_SZ)
Default value: %SystemRoot%/SchedLgU.txt (W2K, WXP),

%SystemRoot/Tasks/SchedLgU.txt (W2K3)
表1 计划任务服务

文件名字服务或程序 Windows版本描述
%systemroot%/SchedLgU.txt Task Scheduler service W2K, WXP Logfile of

running scheduled jobs
%systemroot%/tasks/SchedLgU.txt Task Scheduler service W2K3 Logfile of

running scheduled jobs
IPSEC Services / IPSEC Policy Agent service

PolicyAgent服务的日志文件存放在oakley.log中，默认为空。为了启用日志纪录

，需要改变下面的注册表项为1
Key: HKLM/SYSTEM/CurrentControlSet/Services/PolicyAgent/Oakley
Value: EnableLogging (REG_DWORD)
处于windows2000中的IPSEC Services也支持下面的注册表项，当被设置为1的时

候，支持附加的日志纪录在ipsecpa.log文件中
Key: HKLM/SYSTEM/CurrentControlSet/Services/PolicyAgent
Value: Debug (REG_DWORD)

表2 IPSEC Services / IPSEC Policy Agent service
文件名服务或程序 Windows版本描述
%systemroot%/Debug/oakley.log IPSec Services service W2K, WXP, W2K3 Log

of the IPSec Services service
%systemroot%/Debug/ipsecpa.log IPSEC Policy Agent service W2K Log of

the IPSEC Policy Agent service
DNS Client service
DNS Client service默认没有设置日志纪录。可以通过在%systemroot%/system32

目录下手动添加dnsrslvr.log文件，用来纪录事件日志
:/WINDOWS/system32/>echo "" > dnsrslvr.log
在Windows XP和windows server2003中，必须明显指定给 NETWORK SERVICE 账户

的写权限
C:/WINDOWS/system32/>cacls dnsrslvr.log /E /G "NETWORK SERVICE":W
表3DNS Client service

文件名服务或程序 Windows版本描述
%systemroot%/system32/dnsrslvr.log Dnscache service W2K, WXP, W2K3

DnsCache service debug log
1.4. DHCP Client service
为了启用DHCP Client service的日志纪录，需要手动在%systemroot%/system32

目录下创建asyncreg.log文件
C:/WINDOWS/system32/>echo "" > asyncreg.log
在Windows XP和windows server2003中，必须明显指定给 NETWORK SERVICE 账户

的写权限
C:/WINDOWS/system32/>cacls asyncreg.log /E /G "NETWORK SERVICE":W
表 4. DHCP Client service
文件名服务或程序 Windows版本描述
%systemroot%/system32/asyncreg.log Dhcp Client service W2K, WXP, W2K3

Dhcp Client service debug log
1.5. Windows Time service
微软知识库中#816043号文章记述了Windows Time service，支持普通文本日志。

你需要在注册表下列键值添加日志文件的名字
Key: HKLM/SYSTEM/CurrentControlSet/Services/W32Time/Config
Value: FileLogName (REG_SZ)
表5. Windows Time service
文件名服务或程序 Windows版本描述
W32time.log (user-configurable filename) Windows Time service W2K, WXP,

W2K3 Windows Time service debug log
.6. Cluster service
表 6. Cluster service
文件名服务或程序 Windows版本描述
%systemroot%/Cluster/cluster.log
%systemroot%/system32/LogFiles/Cluster/clcfgsrv.log
%systemroot%/system32/LogFiles/Cluster/clusocm.log
%systemroot%/system32/LogFiles/Cluster/cluscomp.log
Cluster Service service W2K3 Cluster Service service log files
%systemroot%/clusocm.log Cluster optional component W2K Cluster

optional component log
1.7. Windows Image Acquisition (WIA) service
表 7. Windows Image Acquisition (WIA) service
文件名服务或程序 Windows版本描述
%systemroot%/wiadebug.log
%systemroot/Sti_Trace.log
%systemroot%/wiaservc.log
Windows Image Acquisition (WIA) service WXP WIA service error log
2. Windows setup
表8 Windows setup

文件名服务或程序 Windows版本描述
%systemroot%/setupact.log Windows setup W2K, WXP, W2K3 Windows installation log
%systemroot%/setuperr.log Windows setup W2K, WXP, W2K3 Windows Installation errors log
%systemroot%/repair/setup.log Windows setup W2K, WXP, W2K3 Windows Installation log
%systemroot%/setupapi.log Windows setup W2K, WXP, W2K3 .inf files installation log
%systemroot%/updspapi.log update.exe W2K, WXP, W2K3 .inf files installation log
%systemroot%/comsetup.log COM+ W2K, WXP, W2K3 COM+ setup log
%systemroot%/Debug/NetSetup.log Windows W2K, WXP, W2K3 Windows domain configuration change log
%systemroot%/Debug/Configure Your Server.log
%systemroot%/Debug/cysui.log
%systemroot%/Debug/cysui.XXX.log
Configure Your Server wizard W2K3 Log of administrative actions realized using the Configure Your Server wizard
%systemroot%/Wsdu.log Unattended installation WXP, W2K3 Dynamic update log
3. Software updates
表 9. Software updates

Filename Service or program Windows version Description
%systemroot%/Windows Update.log Windows Update W2K, WXP, W2K3 Detailed list of software update managed by Windows Update
%systemroot%/WindowsUpdate.log Automatic Updates service WXP, W2K3
%systemroot%/svcpack.log update.exe W2K, WXP, W2K3 Service Pack installation log
%systemroot%/spuninst.log update.exe W2K, WXP, W2K3 Service Pack installation log
%systemroot%/KBXXXXXX.log update.exe W2K, WXP, W2K3 Software update installation log
%systemroot%/KBXXXXXXUninst.log update.exe W2K, WXP, W2K3 Software update uninstallation log
%systemroot%/UpdateRollupPackage.log update.exe W2K, WXP, W2K3 Update Rollup Package installation log
%systemroot%/spslprm.log update.exe W2K, WXP, W2K3 Software update slipstreaming log
%systemroot%/cabbuild.log update.exe W2K, WXP, W2K3 Software update log
%systemroot%/spupdsvc.log spupdsvc.exe W2K, WXP, W2K3 Software update log
%systemroot%/system32/spupdsvc.log spupdsvc.exe W2K Software update log
%systemroot%/system32/spupdw2k.log spupdsvc.exe W2K Software update log
%systemroot%/Xpsp1hfm.log update.exe WXP Windows XP pre-SP1 hotfixes log
%systemroot%/system32/CatRoot2/dberr.txt Catalog file registrations WXP, W2K3 Catalog file registrations log

4. Active Directory domain controllers
4.1. Domain Controller promotion (dcpromo.exe)
4.2. Security Account Manager (SAM)
4.3. Local Security Authority (LSA)
4.4. Netlogon
4.5. File Replication Service
4.1. Domain Controller promotion (dcpromo.exe)
The dcpromo.exe program is used to promote or demote an Active Directory domain controller. When dcpromo is used, log files are generated.

Table 10. Domain Controller promotion

Filename Service or program Windows version Description
%systemroot%/Debug/DCPROMO.LOG
%systemroot%/Debug/dcpromoui.log
%systemroot%/Debug/dcpromoui.XXX.log
dcpromo.exe W2K, W2K3 dcpromo.exe log
%systemroot%/Debug/dcpromohelp.log dcphelp.exe W2K, W2K3 dcphelp.exe log
%systemroot%/Debug/csv.log csvde.exe W2K, W2K3 csvde.exe log

4.2. Security Account Manager (SAM)
When the SamLogLevel registry value is present and set to 1, the SAM creates a sam.log file:

Key: HKLM/SYSTEM/CurrentControlSet/Control/Lsa
Value: SamLogLevel (REG_DWORD)

The sam.log file is used to log account lockout related events.

Table 11. Security Account Manager

Filename Service or program Windows version Description
%systemroot%/debug/sam.log SAM WXP, W2K3 SAM log file

4.3. Local Security Authority (LSA)
In Windows Server 2003, both the Kerberos authentication package and KDC service can be configured to log debug information, in a file named lsass.log.

To enabled logging in a file, the LogToFile registry value must be set to 1:

Key: HKLM/SYSTEM/CurrentControlSet/Control/Lsa/Kerberos/Parameters
Value: LogToFile (REG_DWORD)
Content: 1 (to enable logging)

Then, the KerbDebugLevel registry value must be added and configured to specify what kind of Kerberos events must be logged:

Key: HKLM/SYSTEM/CurrentControlSet/Control/Lsa/Kerberos/Parameters
Value: KerbDebugLevel (REG_DWORD)

The following list gives the common debug values that must be used to build a binary mask specified in KerbDebugLevel:

Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000

In the Troubleshooting Kerberos errors document, Microsoft recommends to set the KerbDebugLevel value to 0xc0000043 for typical debugging work.

In Windows Server 2003, the KDC service can also be configured to log debugging information, by adding the KdcDebugLevel registry value:

Key: HKLM/SYSTEM/CurrentControlSet/Services/Kdc
Value: KdcDebugLevel (REG_DWORD)

The common debug values for KdcDebugLevel are:
Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000
Use Extended Errors: 0x10000000

The KdcExtraLogLevel registry value can be added for extra KDC logging:

Key: HKLM/SYSTEM/CurrentControlSet/Services/Kdc
Value: KdcExtraLogLevel (REG_DWORD)
Default value: 0x2

The following extra log levels are defined:

Audit SPN unknown errors: 0x1
Log detailed PKINIT1 errors: 0x2
Log all KDC errors with KLIN information: 0x4

Table 12. Local Security Authority

Filename Service or program Windows version Description
%systemroot%/system32/lsass.log LSA W2K3 Kerberos authentication package debugging
%systemroot%/system32/lsass.log KDC service W2K3 KDC service debugging

4.4. Netlogon
The Netlogon service can be configured to log debugging information to a log file, named netlogon.log.

As documented in the #109626, the DbFlag registry value can be added and set to a binary mask (typically, 0x2080FFFF for Windows 2000 and Windows Server 2003):

Key: HKLM/SYSTEM/CurrentControlSet/Services/Netlogon/Parameters
Value: DbFlag (REG_DWORD)

Table 13. Netlogon

Filename Service or program Windows version Description
%systemroot%/Debug/Netlogon.log Netlogon service W2K, W2K3 Netlogon service debug log

4.5. File Replication Service
Table 14. File Replication Service

Filename Service or program Windows version Description
%systemroot%/Debug/NtFrsApi.log File Replication Service service W2K, W2K3 File Replication Service events during promotion and demotion
%systemroot%/Debug/NtFrs_xxxx.log File Replication Service service W2K, W2K3 File Replication Service log

5. Group Policy
Table 15. Group Policy

Filename Service or program Windows version Description
%systemroot%/Debug/UserMode/gpedit.log Group Policy Object Editor W2K, WXP, W2K3 Group Policy Object Editor (Core-specific entries)
%systemroot%/Debug/UserMode/gptext.log Group Policy Object Editor W2K, WXP, W2K3 Group Policy Object Editor (CSE-specific entries)
%systemroot%/security/logs/winlogon.log Group Policy W2K, WXP, W2K3 Group Policy Security CSE log
%systemroot%/debug/usermode/fdeploy.log Group Policy W2K, WXP, W2K3 Group Policy Folder Redirection CSE log
%systemroot%/debug/usermode/appmgmt.log Group Policy W2K, WXP, W2K3 Software Installation CSE log
%systemroot%/security/logs/scepol.log Security Configuration Engine W2K, WXP, W2K3 LSA API log used by GPO
%systemroot%/security/logs/scesetup.log Security Configuration Engine W2K, WXP, W2K3 Security settings implemented during setup log

6. Internet Information Services (IIS)
During the installation of IIS 5.0, IIS 5.1 and IIS 6, events are logged in the iis5.log or iis6.log.

By default, Internet services (HTTP, FTP, SMTP, NNTP) log requests in files stored under the LogFiles directory.

Table 16. Internet Information Services (IIS)

Filename Service or program Windows version Description
%systemroot%/iis5.log IIS 5 W2K IIS 5.0 installation log
%systemroot%/iis6.log IIS 5.1, IIS 6 WXP, W2K3 IIS 5.1 and IIS 6.0 installation log
%systemroot%/system32/LogFiles/W3SVCX/ IIS HTTP service W2K, WXP, W2K3 IIS HTTP service access log
%systemroot%/system32/LogFiles/MSFTPSVCX/ IIS FTP service W2K, WXP, W2K3 IIS FTP service access log
%systemroot%/system32/LogFiles/HTTPERR/httperrX.log http.sys driver WXP SP2, W2K3 http.sys driver error log

7. Routing and Remote Access service
Tracing for the RRAS service is typically enabled using netsh (set tracing command in the ras context). For each RRAS component that supports tracing, a registry key is stored under the Tracing key:

Key: HKLM/SOFTWARE/Microsoft/Tracing

For each component, file logging is enabled when the EnableFileTracing registry value is set to 1 and when a tracing mask is specified in the FIleTracingMask value.

Log files are named after the name of registry keys under the Tracing key. For instance, the NETSHELL.LOG file contains tracing for the NETSHELL component.

Table 17. Routing and Remote Access service

Filename Service or program Windows version Description
%systemroot%/tracing/BAP.LOG
%systemroot%/tracing/conftsp.LOG
%systemroot%/tracing/EAPOL.LOG
%systemroot%/tracing/IASACCT.LOG
%systemroot%/tracing/IASNAP.LOG
%systemroot%/tracing/IASRAD.LOG
%systemroot%/tracing/IASSAM.LOG
%systemroot%/tracing/IASSDO.LOG
%systemroot%/tracing/IASSVCS.LOG
%systemroot%/tracing/IGMPv2.LOG
%systemroot%/tracing/IPMGM.LOG
%systemroot%/tracing/IPNATHLP.LOG
%systemroot%/tracing/IPRouterManager.LOG
%systemroot%/tracing/KMDDSP.LOG
%systemroot%/tracing/NDPTSP.LOG
%systemroot%/tracing/NETMAN.LOG
%systemroot%/tracing/NETSHELL.LOG
%systemroot%/tracing/PPP.LOG
%systemroot%/tracing/RASBACP.LOG
%systemroot%/tracing/RASCCP.LOG
%systemroot%/tracing/RASCHAP.LOG
%systemroot%/tracing/RASDLG.LOG
%systemroot%/tracing/RASEAP.LOG
%systemroot%/tracing/RASIPCP.LOG
%systemroot%/tracing/RASIPHLP.LOG
%systemroot%/tracing/RASMAN.LOG
%systemroot%/tracing/RASPAP.LOG
%systemroot%/tracing/RASSPAP.LOG
%systemroot%/tracing/RASTAPI.LOG
%systemroot%/tracing/RASTLS.LOG
%systemroot%/tracing/Router.LOG
%systemroot%/tracing/RTM.LOG
%systemroot%/tracing/tapi32.LOG
%systemroot%/tracing/tapisrv.LOG
%systemroot%/tracing/Wlpolicy.LOG
%systemroot%/tracing/WZCTrace.LOG
RRAS service W2K, WXP, W2K3 Routing and Remote Access service tracing files

8. WMI (Windows Management Instrumentation)
The WMI framework manage several log files. The Logging Directory registry value specifiy the directory where these files are stored:

Key: HKLM/SOFTWARE/Microsoft/WBEM/CIMOM
Value: Logging Directory (REG_SZ)
Default value: %SystemRoot%/system32/WBEM/Logs

The Logging registry value can be set to 0 (logging disabled), 1 (errors only) or 2 (verbose logging):

Key: HKLM/SOFTWARE/Microsoft/WBEM/CIMOM
Value: Logging (REG_DWORD)

These registry values can be modified in the Logging tab of the WMI Control MMC snapin.

Table 18. WMI (Windows Management Instrumentation)

Filename Service or program Windows version Description
%systemroot%/system32/wbem/logs/setup.log WMI W2K, WXP, W2K3 MOF files compilation log
%systemroot%/system32/wbem/logs/WinMgmt.log WMI W2K, WXP, W2K3 WinMgmt.exe log
%systemroot%/system32/wbem/logs/wbemcore.log WMI W2K, WXP, W2K3 WMI error messages log
%systemroot%/system32/wbem/logs/FrameWork.log WMI W2K, WXP, W2K3 Trace information and error messages for the provider framework and the Win32 Provider.
%systemroot%/system32/wbem/logs/wbemess.log WMI W2K, WXP, W2K3 Log entries related to events
%systemroot%/system32/wbem/logs/wbemprox.log WMI W2K, WXP, W2K3 Trace information for the WMI proxy server
%systemroot%/system32/wbem/logs/Mofcomp.log WMI W2K, WXP, W2K3 Compilation details from the MOF compiler
%systemroot%/system32/wbem/logs/wmiadap.log WMI W2K, WXP, W2K3 Error messages related to the AutoDiscoveryAutoPurge (ADAP) process
%systemroot%/system32/wbem/logs/wmiprov.log WMI W2K, WXP, W2K3 Management data and events from WMI-enabled Windows Driver Model (WDM) drivers
%systemroot%/system32/wbem/logs/ntevt.log WMI W2K, W2K3 Trace messages from the Event Log Provider
%systemroot%/system32/wbem/logs/Dsprovider.log WMI W2K, WXP, W2K3 Trace information and error messages for the Directory Services Provider
%systemroot%/system32/wbem/logs/WMIC.LOG WMI WXP, W2K3 wmic.exe errors log

9. Miscellanous
Table 19. Miscellanous

Filename Service or program Windows version Description
%systemroot%/Debug/PASSWD.LOG Security Accounts Manager (SAM) service W2K, WXP, W2K3 Log file for the SamChangePasswordUser2 API (used by the Change Password dialog box available after the Control-Alt-Delete sequence)
%systemroot%/Debug/UserMode/userenv.log Winlogon W2K, WXP, W2K3 User environment settings debugging
%systemroot%/system32/LogFiles/Shutdown/ShutDown_XXX.xml System State Data Feature WXP, W2K3 System shutdown log
%systemroot%/Pfirewall.log Windows firewall WXP, W2K3 Windows firewall log
%systemroot%/DtcInstall.log Distributed Transaction Coordinator service W2K3 MS DTC service installation log
%systemroot%/tsoc.log Terminal Services W2K, WXP, W2K3 Terminal Services installation log

原文：http://www.hsc.fr/ressources/articles/win_log_files/index.html.en#id2510490