Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Logs
  4. WindowsUpdate
  5. WindowsUpdate.*.etl
LogRisk: Caution

WindowsUpdate.*.etl C:\Windows\Logs\WindowsUpdate\WindowsUpdate.*.etl

ETW traces WindowsUpdate.<timestamp>.etl of the Windows Update agent; unreadable as is, Get-WindowsUpdateLog merges them into WindowsUpdate.log.

Updated on By AltF4 Formation

What it’s for

The Windows Update agent writes its traces to WindowsUpdate.<timestamp>.etl files through Event Tracing for Windows (ETW). The * in the path stands for the date, time and sequence numbers that change with every new file, so several files exist side by side. Since Windows 10 they are the only detailed record of update scanning, download and installation.

What it contains

  • Agent messages by component (Agent, DownloadManager, Handler, ComApi…) with the details of each scan: the server contacted (Windows Update, WSUS, Microsoft Update), updates detected, download queues, HRESULT error codes.
  • Binary ETW data: a text editor shows nothing useful.

Risks and best practices

  • The text WindowsUpdate.log does not exist permanently. It is generated on demand and frozen at that moment, so run the command again after each new update attempt.
  • On a machine managed by WSUS or Group Policy, look in the generated log for the server URL and for 0x8024xxxx codes; they point to network, proxy or catalog problems.
  • Copy the .etl files before a disk cleanup while a diagnosis is under way.

Useful commands

Fenêtre de terminal
# Generate WindowsUpdate.log on the current user's Desktop
Get-WindowsUpdateLog


# Choose the output file
Get-WindowsUpdateLog -LogPath 'C:\Temp\WindowsUpdate.log'


# Find failures in the generated log
Select-String -Path 'C:\Temp\WindowsUpdate.log' -Pattern 'FATAL|WARNING|0x8024[0-9a-f]{4}' | Select-Object -Last 40


# .etl files present, newest first
Get-ChildItem "$env:windir\Logs\WindowsUpdate" -Filter *.etl | Sort-Object LastWriteTime -Descending

Format

Binary ETW files (.etl). Get-WindowsUpdateLog converts them to text by merging every .etl in the folder.

Rotation and archiving

New files appear over time and Windows purges the oldest ones. Microsoft does not detail the exact rule, so archive useful .etl files before reproducing a problem.

How to read it

Generate the log with Get-WindowsUpdateLog, open the output and find the time of the attempt. Scroll up to the first line carrying a 0x8024xxxx or 0x800Fxxxx error code. Cross-check with the Microsoft-Windows-WindowsUpdateClient/Operational log (events 19 and 20) and with CBS.log for installation failures.

Report a mistake