How to View and Parse WindowsUpdate.log on Windows 10 / Windows Server 2016?

Historically, the WindowsUpdate.log plain text file has been used to analyze the operation of the Windows Update agent and service. However, the Windows Update logs in Windows 10 (Windows Server 2016/2019) are saved in the Event Tracing for Windows file format (ETW), instead of the usual text file. With such an action, the Windows developers planned to increase the performance of the logging subsystem and reduce the space occupied by the text files on the disk.

Thus, Windows Update events are no longer written in real time to the %windir%\WindowsUpdate.log file. Even though the file is still present in the root of the Windows folder, it only says that the ETW format is now used to collect WU logs.

The disadvantage of the new logging method for administrators – now you can’t quickly analyze the Windows Update Agent service, find error codes in the WindowsUpdate.log text file (see the Complete List of Windows Update Error Codes), check the WSUS agent settings and analyze the update installation history.

You can convert ETW events to the plain text WindowsUpdate.log file for more convenient analysis of update service events. To do this, use the PowerShell cmdlet – Get-WindowsUpdateLog. This cmdlet allows you to collect information from all .etl files (they are stored in C:\WINDOWS\Logs\WindowsUpdate) and create a single WindowsUpdate.log text file.

To generate the WindowsUpdate.log file and save it in the C:\PS\Logs, run the following command in the PowerShell console:

Get-WindowsUpdateLog -logpath C:\PS\Logs\WindowsUpdate.log

Copy-Item : Cannot find path 'C:\Program Files\Windows Defender\SymSrv.dll' because it does not exist. At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdateLog.psm1:56 char:5

In older Windows 10 builds, the first time you run the Get-WindowsUpdateLog cmdlet, it downloads and installs the Microsoft Internet Symbol Store. Newest versions of Windows 10 access the Microsoft Character Server in Azure online. Then the cmdlet:

1. Reads the data from all .etl files;
2. The data are converted into CSV (by default) or XML format;
3. The data from the file in an intermediate format will be converted and added to the log text file specified in the LogPath parameter (if the parameter in LogPath is not specified, WindowsUpdate.log is created on the desktop of the user running the command)

Open the log file using this PowerShell command:

Invoke-Item -Path C:\PS\Logs\WindowsUpdate.log

In some cases, in the WindowsUpdate.log file you can see such strings:

Unknown(140): GUID=53212e4cc-4321-f43a-2123-9ada0090bc12b (No Format Information found).

This means that you don’t have the Windows Symbol server installed (today you cannot download a separate Windows symbols installer, because it is automatically downloaded from the symbol store in Azure). For isolated environments, you can use the offline version of the symbol server according to the article Offline Symbols for Windows Update.

It is quite difficult to analyze the resulting WindowsUpdate.log file, because it collects data from many event sources:

• AGENT – Windows Update agent events;
• AU – automatic update;
• AUCLNT – user interaction;
• HANDLER – update installer management;
• MISC – common WU info;
• PT – synchronization of updates with local datastore;
• REPORT – reports collection;
• SERVICE – wuauserv service start/stop events;
• SETUP – installing new versions of the Windows Update client;
• DownloadManager – downloading updates to local cache using BITS;
• Handler, Setup – installer headers (CBS , etc.);
• and many others.

You can select the last 30 events from the Windows Update Agent (agent) with a simple regular expression:

Select-String -Pattern '\sagent\s' -Path C:\PS\Logs\WindowsUpdate.log | Select-Object -Last 30

You can filter events in the WindowsUpdate.log by several sources:

Select-String -Pattern '\sagent\s|\smisc\s' -Path c:\PS\Logs\WindowsUpdate.log | Select-Object -Last 50

Similarly, you can parse the text file for events by KB number, errors (FAILED, Exit Code, FATAL).

You can also generate the WindowsUpdate.log file for the remote computer or server:

Get-WindowsUpdateLog -ETLPath \\ny-srf-1\C$\windows\Logs\WindowsUpdate -LogPath C:\PS\Logs\windowsupdate-ny-srf-1.log

You can also use Event Viewer logs to analyze the operation of the Windows Update service. Expand the following Event View section: Applications and Services Logs -> Microsoft -> Windows –> WindowsUpdateClient -> Operational.