文章作者：Jean-Baptiste 执笔
Hervé Schauer顾问
信息来源：邪恶八进制信息安全团队（
www.eviloctal.com）
金州注释：文本版本为邪恶八进制首先发布，故标明来源邪恶八进制。
Windows log files
Jean-Baptiste March and
Hervé Schauer Consultants
Copyright 2005 Hervé Schauer Consultants
Revision History
June 2005
Initial version.
List of Tables
1. Task Scheduler service
2. IPSEC Services / IPSEC Policy Agent service
3. DNS Client service
4. DHCP Client service
5. Windows Time service
6. Cluster service
7. Windows Image Acquisition (WIA) service
8. Windows setup
9. Software updates
10. Domain Controller promotion
11. Security Account Manager
12. Local Security Authority
13. Netlogon
14. File Replication Service
15. Group Policy
16. Internet Information Services (IIS)
17. Routing and Remote Access service
18. WMI (Windows Management Instrumentation)
19. Miscellanous
1. Windows services
1.1. Task Scheduler service
1.2. IPSEC Services / IPSEC Policy Agent service
1.3. DNS Client service
1.4. DHCP Client service
1.5. Windows Time service
1.6. Cluster service
1.7. Windows Image Acquisition (WIA) service
1.1. Task Scheduler service
The Task Scheduler service uses a log file, SchedLgU.txt. The location of this file is specified in the LogPath registry value:
Key: HKLM\SOFTWARE\Microsoft\SchedulingAgent
Value: LogPath (REG_SZ)
Default value: %SystemRoot%\SchedLgU.txt (W2K, WXP), %SystemRoot\Tasks\SchedLgU.txt (W2K3)
Table 1. Task Scheduler service
Filename Service or program Windows version Description
%systemroot%\SchedLgU.txt Task Scheduler service W2K, WXP Logfile of running scheduled jobs
%systemroot%\tasks\SchedLgU.txt Task Scheduler service W2K3 Logfile of running scheduled jobs
1.2. IPSEC Services / IPSEC Policy Agent service
The PolicyAgent service supports logging in a file named oakley.log, empty by default. To enable logging, the following
registry value must be set to 1:
Key: HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley
Value: EnableLogging (REG_DWORD)
The IPSEC Services services (Windows 2000) also recognizes the following registry value, which, when set to 1, supports
additional logging in a ipsecpa.log file:
Key: HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent
Value: Debug (REG_DWORD)
Table 2. IPSEC Services / IPSEC Policy Agent service
Filename Service or program Windows version Description
%systemroot%\Debug\oakley.log IPSec Services service W2K, WXP, W2K3 Log of the IPSec Services service
%systemroot%\Debug\ipsecpa.log IPSEC Policy Agent service W2K Log of the IPSEC Policy Agent service
1.3. DNS Client service
The DNS Client service does not log by default. However, if a file named %systemroot%\system32\dnsrslvr.log is
manually created, this file is used by the service to log debug information:
C:\WINDOWS\system32\>echo "" > dnsrslvr.log
In Windows XP and Windows Server 2003, NTFS write permissions for the NETWORK SERVICE SID must be explictly given:
C:\WINDOWS\system32\>cacls dnsrslvr.log /E /G "NETWORK SERVICE":W
Table 3. DNS Client service
Filename Service or program Windows version Description
%systemroot%\system32\dnsrslvr.log Dnscache service W2K, WXP, W2K3 DnsCache service debug log
1.4. DHCP Client service
A file named %systemroot%\system32\asyncreg.log can be manually created to enable logging of dnsapi functions:
C:\WINDOWS\system32\>echo "" > asyncreg.log
In Windows XP and Windows Server 2003, NTFS write permissions for the NETWORK SERVICE SID must be explictly given:
C:\WINDOWS\system32\>cacls asyncreg.log /E /G "NETWORK SERVICE":W
Table 4. DHCP Client service
Filename Service or program Windows version Description
%systemroot%\system32\asyncreg.log Dhcp Client service W2K, WXP, W2K3 Dhcp Client service debug log
1.5. Windows Time service
As documented in the #816043 Microsoft knowledge base article, the Windows Time service supports logging in a text file.
The FileLogName registry value must be explictly added:
Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config
Value: FileLogName (REG_SZ)
Table 5. Windows Time service
Filename Service or program Windows version Description
W32time.log (user-configurable filename) Windows Time service W2K, WXP, W2K3 Windows Time service debug log
1.6. Cluster service
Table 6. Cluster service
Windows
Filename Service or program Description
version
%systemroot%\Cluster\cluster.log
%systemroot%\system32\LogFiles\Cluster\clcfgsrv.log Cluster Service Cluster Service service
W2K3
%systemroot%\system32\LogFiles\Cluster\clusocm.log service log files
%systemroot%\system32\LogFiles\Cluster\cluscomp.log
Cluster optional Cluster optional
%systemroot%\clusocm.log W2K
component component log
1.7. Windows Image Acquisition (WIA) service
Table 7. Windows Image Acquisition (WIA) service
Filename Service or program Windows version Description
%systemroot%\wiadebug.log
%systemroot\Sti_Trace.log Windows Image Acquisition (WIA) service WXP WIA service error log
%systemroot%\wiaservc.log
2. Windows setup
Table 8. Windows setup
Service or Windows
Filename Description
program version
W2K, WXP,
%systemroot%\setupact.log Windows setup Windows installation log
W2K3
W2K, WXP,
%systemroot%\setuperr.log Windows setup Windows Installation errors log
W2K3
W2K, WXP,
%systemroot%\repair\setup.log Windows setup Windows Installation log
W2K3
W2K, WXP,
%systemroot%\setupapi.log Windows setup .inf files installation log
W2K3
%systemroot%\updspapi.log update.exe W2K, WXP, .inf files installation log
Service or Windows
Filename Description
program version
W2K3
W2K, WXP,
%systemroot%\comsetup.log COM+ COM+ setup log
W2K3
W2K, WXP,
%systemroot%\Debug\NetSetup.log Windows Windows domain configuration change log
W2K3
%systemroot%\Debug\Configure Your
Server.log Configure Your Log of administrative actions realized using
W2K3
%systemroot%\Debug\cysui.log Server wizard the Configure Your Server wizard
%systemroot%\Debug\cysui.XXX.log
Unattended
%systemroot%\Wsdu.log WXP, W2K3 Dynamic update log
installation
3. Software updates
Table 9. Software updates
Service or Windows
Filename Description
program version
W2K, WXP, Detailed list of software update
%systemroot%\Windows Update.log Windows Update
W2K3 managed by Windows Update
Automatic Updates
%systemroot%\WindowsUpdate.log WXP, W2K3
service
W2K, WXP,
%systemroot%\svcpack.log update.exe Service Pack installation log
W2K3
W2K, WXP,
%systemroot%\spuninst.log update.exe Service Pack installation log
W2K3
W2K, WXP,
%systemroot%\KBXXXXXX.log update.exe Software update installation log
W2K3
W2K, WXP,
%systemroot%\KBXXXXXXUninst.log update.exe Software update uninstallation log
W2K3
W2K, WXP,
%systemroot%\UpdateRollupPackage.log update.exe Update Rollup Package installation log
W2K3
W2K, WXP,
%systemroot%\spslprm.log update.exe Software update slipstreaming log
W2K3
W2K, WXP,
%systemroot%\cabbuild.log update.exe Software update log
W2K3
Service or Windows
Filename Description
program version
W2K, WXP,
%systemroot%\spupdsvc.log spupdsvc.exe Software update log
W2K3
%systemroot%\system32\spupdsvc.log spupdsvc.exe W2K Software update log
%systemroot%\system32\spupdw2k.log spupdsvc.exe W2K Software update log
%systemroot%\Xpsp1hfm.log update.exe WXP Windows XP pre-SP1 hotfixes log
Catalog file
%systemroot%\system32\CatRoot2\dberr.txt WXP, W2K3 Catalog file registrations log
registrations
4. Active Directory domain controllers
4.1. Domain Controller promotion (dcpromo.exe)
4.2. Security Account Manager (SAM)
4.3. Local Security Authority (LSA)
4.4. Netlogon
4.5. File Replication Service
4.1. Domain Controller promotion (dcpromo.exe)
The dcpromo.exe program is used to promote or demote an Active Directory domain controller. When dcpromo is used, log
files are generated.
Table 10. Domain Controller promotion
Filename Service or program Windows version Description
%systemroot%\Debug\DCPROMO.LOG
%systemroot%\Debug\dcpromoui.log dcpromo.exe W2K, W2K3 dcpromo.exe log
%systemroot%\Debug\dcpromoui.XXX.log
%systemroot%\Debug\dcpromohelp.log dcphelp.exe W2K, W2K3 dcphelp.exe log
%systemroot%\Debug\csv.log csvde.exe W2K, W2K3 csvde.exe log
4.2. Security Account Manager (SAM)
When the SamLogLevel registry value is present and set to 1, the SAM creates a sam.log file:
Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: SamLogLevel (REG_DWORD)
The sam.log file is used to log account lockout related events.
Table 11. Security Account Manager
Filename Service or program Windows version Description
%systemroot%\debug\sam.log SAM WXP, W2K3 SAM log file
4.3. Local Security Authority (LSA)
In Windows Server 2003, both the Kerberos authentication package and KDC service can be configured to log debug
information, in a file named lsass.log.
To enabled logging in a file, the LogToFile registry value must be set to 1:
Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value: LogToFile (REG_DWORD)
Content: 1 (to enable logging)
Then, the KerbDebugLevel registry value must be added and configured to specify what kind of Kerberos events must be
logged:
Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value: KerbDebugLevel (REG_DWORD)
The following list gives the common debug values that must be used to build a binary mask specified in KerbDebugLevel:
Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000
In the Troubleshooting Kerberos errors document, Microsoft recommends to set the KerbDebugLevel value to
0xc0000043 for typical debugging work.
In Windows Server 2003, the KDC service can also be configured to log debugging information, by adding the
KdcDebugLevel registry value:
Key: HKLM\SYSTEM\CurrentControlSet\Services\Kdc
Value: KdcDebugLevel (REG_DWORD)
The common debug values for KdcDebugLevel are:
Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000
Use Extended Errors: 0x10000000
The KdcExtraLogLevel registry value can be added for extra KDC logging:
Key: HKLM\SYSTEM\CurrentControlSet\Services\Kdc
Value: KdcExtraLogLevel (REG_DWORD)
Default value: 0x2
The following extra log levels are defined:
Audit SPN unknown errors: 0x1
Log detailed PKINIT1 errors: 0x2
Log all KDC errors with KLIN information: 0x4
Table 12. Local Security Authority
Filename Service or program Windows version Description
%systemroot%\system32\lsass.log LSA W2K3 Kerberos authentication package debugging
%systemroot%\system32\lsass.log KDC service W2K3 KDC service debugging
4.4. Netlogon
The Netlogon service can be configured to log debugging information to a log file, named netlogon.log.
As documented in the #109626, the DbFlag registry value can be added and set to a binary mask (typically, 0x2080FFFF for
Windows 2000 and Windows Server 2003):
Key: HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: DbFlag (REG_DWORD)
Table 13. Netlogon
Filename Service or program Windows version Description
%systemroot%\Debug\Netlogon.log Netlogon service W2K, W2K3 Netlogon service debug log
4.5. File Replication Service
Table 14. File Replication Service
Windows
Filename Service or program Description
version
File Replication Service File Replication Service events during
%systemroot%\Debug\NtFrsApi.log W2K, W2K3
service promotion and demotion
File Replication Service
%systemroot%\Debug\NtFrs_xxxx.log W2K, W2K3 File Replication Service log
service
5. Group Policy
Table 15. Group Policy
Windows
Filename Service or program Description
version
Group Policy Object W2K, WXP, Group Policy Object Editor
%systemroot%\Debug\UserMode\gpedit.log
Editor W2K3 (Core-specific entries)
Group Policy Object W2K, WXP, Group Policy Object Editor
%systemroot%\Debug\UserMode\gptext.log
Editor W2K3 (CSE-specific entries)
W2K, WXP,
%systemroot%\security\logs\winlogon.log Group Policy Group Policy Security CSE log
W2K3
W2K, WXP, Group Policy Folder Redirection
%systemroot%\debug\usermode\fdeploy.log Group Policy
W2K3 CSE log
W2K, WXP,
%systemroot%\debug\usermode\appmgmt.log Group Policy Software Installation CSE log
W2K3
Security Configuration W2K, WXP,
%systemroot%\security\logs\scepol.log LSA API log used by GPO
Engine W2K3
Security Configuration W2K, WXP, Security settings implemented
%systemroot%\security\logs\scesetup.log
Engine W2K3 during setup log
6. Internet Information Services (IIS)
During the installation of IIS 5.0, IIS 5.1 and IIS 6, events are logged in the iis5.log or iis6.log.
By default, Internet services (HTTP, FTP, SMTP, NNTP) log requests in files stored under the LogFiles directory.
Table 16. Internet Information Services (IIS)
Service or Windows
Filename Description
program version
%systemroot%\iis5.log IIS 5 W2K IIS 5.0 installation log
IIS 5.1 and IIS 6.0
%systemroot%\iis6.log IIS 5.1, IIS 6 WXP, W2K3
installation log
W2K, WXP,
%systemroot%\system32\LogFiles\W3SVCX\ IIS HTTP service IIS HTTP service access log
W2K3
W2K, WXP,
%systemroot%\system32\LogFiles\MSFTPSVCX\ IIS FTP service IIS FTP service access log
W2K3
%systemroot%\system32\LogFiles\HTTPERR\httperrX.log http.sys driver WXP SP2, W2K3 http.sys driver error log
7. Routing and Remote Access service
Tracing for the RRAS service is typically enabled using netsh (set tracing command in the ras context). For each RRAS
component that supports tracing, a registry key is stored under the Tracing key:
Key: HKLM\SOFTWARE\Microsoft\Tracing
For each component, file logging is enabled when the EnableFileTracing registry value is set to 1 and when a tracing mask
is specified in the FIleTracingMask value.
Log files are named after the name of registry keys under the Tracing key. For instance, the NETSHELL.LOG file contains
tracing for the NETSHELL component.
Table 17. Routing and Remote Access service
Service or Windows
Filename Description
program version
%systemroot%\tracing\BAP.LOG
%systemroot%\tracing\conftsp.LOG
%systemroot%\tracing\EAPOL.LOG
%systemroot%\tracing\IASACCT.LOG
%systemroot%\tracing\IASNAP.LOG
%systemroot%\tracing\IASRAD.LOG
%systemroot%\tracing\IASSAM.LOG
%systemroot%\tracing\IASSDO.LOG
%systemroot%\tracing\IASSVCS.LOG
%systemroot%\tracing\IGMPv2.LOG
%systemroot%\tracing\IPMGM.LOG W2K, WXP, Routing and Remote Access service
RRAS service
%systemroot%\tracing\IPNATHLP.LOG W2K3 tracing files
%systemroot%\tracing\IPRouterManager.LOG
%systemroot%\tracing\KMDDSP.LOG
%systemroot%\tracing\NDPTSP.LOG
%systemroot%\tracing\NETMAN.LOG
%systemroot%\tracing\NETSHELL.LOG
%systemroot%\tracing\PPP.LOG
%systemroot%\tracing\RASBACP.LOG
%systemroot%\tracing\RASCCP.LOG
%systemroot%\tracing\RASCHAP.LOG
%systemroot%\tracing\RASDLG.LOG
Service or Windows
Filename Description
program version
%systemroot%\tracing\RASEAP.LOG
%systemroot%\tracing\RASIPCP.LOG
%systemroot%\tracing\RASIPHLP.LOG
%systemroot%\tracing\RASMAN.LOG
%systemroot%\tracing\RASPAP.LOG
%systemroot%\tracing\RASSPAP.LOG
%systemroot%\tracing\RASTAPI.LOG
%systemroot%\tracing\RASTLS.LOG
%systemroot%\tracing\Router.LOG
%systemroot%\tracing\RTM.LOG
%systemroot%\tracing\tapi32.LOG
%systemroot%\tracing\tapisrv.LOG
%systemroot%\tracing\Wlpolicy.LOG
%systemroot%\tracing\WZCTrace.LOG
8. WMI (Windows Management Instrumentation)
The WMI framework manage several log files. The Logging Directory registry value specifiy the directory where these files
are stored:
Key: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM
Value: Logging Directory (REG_SZ)
Default value: %SystemRoot%\system32\WBEM\Logs
The Logging registry value can be set to 0 (logging disabled), 1 (errors only) or 2 (verbose logging):
Key: HKLM\SOFTWARE\Microsoft\WBEM\CIMOM
Value: Logging (REG_DWORD)
These registry values can be modified in the Logging tab of the WMI Control MMC snapin.
Table 18. WMI (Windows Management Instrumentation)
Service or Windows
Filename Description
program version
W2K, WXP,
%systemroot%\system32\wbem\logs\setup.log WMI MOF files compilation log
W2K3
%systemroot%\system32\wbem\logs\WinMgmt.log WMI W2K, WXP, WinMgmt.exe log
Service or Windows
Filename Description
program version
W2K3
W2K, WXP,
%systemroot%\system32\wbem\logs\wbemcore.log WMI WMI error messages log
W2K3
Trace information and error messages for
W2K, WXP,
%systemroot%\system32\wbem\logs\FrameWork.log WMI the provider framework and the Win32
W2K3
Provider.
W2K, WXP,
%systemroot%\system32\wbem\logs\wbemess.log WMI Log entries related to events
W2K3
W2K, WXP, Trace information for the WMI proxy
%systemroot%\system32\wbem\logs\wbemprox.log WMI
W2K3 server
W2K, WXP, Compilation details from the MOF
%systemroot%\system32\wbem\logs\Mofcomp.log WMI
W2K3 compiler
W2K, WXP, Error messages related to the
%systemroot%\system32\wbem\logs\wmiadap.log WMI
W2K3 AutoDiscoveryAutoPurge (ADAP) process
Management data and events from
W2K, WXP,
%systemroot%\system32\wbem\logs\wmiprov.log WMI WMI-enabled Windows Driver Model
W2K3
(WDM) drivers
Trace messages from the Event Log
%systemroot%\system32\wbem\logs\ntevt.log WMI W2K, W2K3
Provider
W2K, WXP, Trace information and error messages for
%systemroot%\system32\wbem\logs\Dsprovider.log WMI
W2K3 the Directory Services Provider
%systemroot%\system32\wbem\logs\WMIC.LOG WMI WXP, W2K3 wmic.exe errors log
9. Miscellanous
Table 19. Miscellanous
Windows
Filename Service or program Description
version
Log file for the
SamChangePasswordUser2
W2K, API (used by the Change
Security Accounts
%systemroot%\Debug\PASSWD.LOG WXP, Password dialog box
Manager (SAM) service
W2K3 available after the
Control-Alt-Delete
sequence)
%systemroot%\Debug\UserMode\userenv.log Winlogon W2K, User environment settings
Windows
Filename Service or program Description
version
WXP, debugging
W2K3
%systemroot%\system32\LogFiles\Shutdown\ShutD System State Data WXP,
System shutdown log
own_XXX.xml Feature W2K3
WXP,
%systemroot%\Pfirewall.log Windows firewall Windows firewall log
W2K3
Distributed Transaction MS DTC service installation
%systemroot%\DtcInstall.log W2K3
Coordinator service log
W2K,
Terminal Services
%systemroot%\tsoc.log Terminal Services WXP,
installation log
W2K3
