FolderRisk: Caution

LogFiles C:\Windows\System32\LogFiles

Folder of Windows component logs: Firewall (pfirewall.log), Srt (SrtTrail.txt), HTTPERR, WMI, SUM; content depends on enabled features.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

System32\LogFiles is a container folder: each component keeps its logs in its own subfolder. There is little to read directly, so you come here to find the subfolder of the component you are diagnosing. The content depends on which features are enabled.

What it contains

Firewall: the Windows Firewall log (pfirewall.log), present when logging is turned on.
Srt: the startup repair tool trace (SrtTrail.txt).
HTTPERR: error logs of the HTTP.sys driver, on the web server side.
WMI: ETW traces from AutoLogger sessions.
SUM: the User Access Logging (UAL) database on Windows Server.

Risks and best practices

Services write here and some subfolders have specific permissions, so do not delete the folder. Purge obsolete logs one by one, after archiving them if an audit requires it.
Verbose logging left on for a long time fills the disk. Watch this folder’s size if the firewall logs allowed connections.

Useful commands

# Size of each subfolder in MB
Get-ChildItem "$env:windir\System32\LogFiles" -Directory -Force |
    ForEach-Object { [pscustomobject]@{
        Folder = $_.Name
        MB = [math]::Round(((Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum / 1MB), 1) } }

Folder contents

Folders 4

Logs 1

Srt\SrtTrail.txtStartup Repair log: diagnosis and repairs attempted after a boot failure.

Report a mistake