Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. SoftwareDistribution
  4. ReportingEvents.log
LogRisk: Caution

ReportingEvents.log C:\Windows\SoftwareDistribution\ReportingEvents.log

ReportingEvents.log is a plain-text summary of Windows Update events (scan, download, install); readable without conversion, unlike the .etl traces.

Updated on By AltF4 Formation

What it’s for

Windows Update records here, in plain text, the events it also reports to the update server. You can open the file directly, with no need for Get-WindowsUpdateLog, which makes it the quickest way to see which update succeeded or failed and when.

What it contains

  • One line per event: timestamp, component (for example AutomaticUpdates or Agent), result (Success or Failure), category (synchronization, download, installation) and the title of the update concerned.
  • The 0x8024xxxx error codes tied to failures.
  • Restart-required events.

Risks and best practices

  • It lives in SoftwareDistribution: the classic Windows Update reset (renaming the folder) starts it afresh and erases the history. Copy it first.
  • It does not replace WindowsUpdate.log, which is more detailed, but it is much faster to scan for a status check on one machine.

Useful commands

Fenêtre de terminal
# Last lines
Get-Content "$env:windir\SoftwareDistribution\ReportingEvents.log" -Tail 40


# Failures only
Select-String -Path "$env:windir\SoftwareDistribution\ReportingEvents.log" -Pattern 'Failure' | Select-Object -Last 20

Format

Text file with tab-separated fields. The exact columns vary with the event.

Rotation and archiving

Microsoft documents no rotation rule. The file is recreated along with the SoftwareDistribution folder if that folder is renamed or deleted.

How to read it

Go to the end of the file, find the time of the last attempt, then the “Failure” lines. The update title and the 0x8024xxxx code give the target and the cause; continue in WindowsUpdate.log (through Get-WindowsUpdateLog) or in the WindowsUpdateClient/Operational log.

Report a mistake