Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. wbem
  5. Logs
FolderRisk: Caution

Logs C:\Windows\System32\wbem\Logs

WMI text logs (wbemcore.log, mofcomp.log, etc.): errors from the service, providers and MOF compilations.

Updated on By AltF4 Formation

What it’s for

wbem\Logs receives the text logs of the WMI infrastructure. WMI now traces its activity through ETW rather than text files, but the service, the MOF compiler and some providers still write their own logs here. It is the place to look when a WMI provider stops answering or a MOF file will not compile.

What it contains

  • wbemcore.log: log of the WMI service core.
  • mofcomp.log: results of MOF file compilations.
  • wbemprox.log, wmiprov.log and others: proxy and providers, depending on configuration.
  • The logging level is set in the Registry under HKLM\SOFTWARE\Microsoft\WBEM\CIMOM, Logging value.

Risks and best practices

  • The .log files can be archived or deleted without harming WMI, which recreates them.
  • Verbose logging left on fills the disk. Return to the default level once the diagnosis is done.
  • To see who calls what in WMI, or to spot WMI abuse, read the Microsoft-Windows-WMI-Activity/Operational log instead.

Useful commands

Fenêtre de terminal
# List the WMI logs
Get-ChildItem -Force "$env:windir\System32\wbem\Logs" | Select-Object Name, Length, LastWriteTime


# Read the end of a WMI service log
Get-Content "$env:windir\System32\wbem\Logs\wbemcore.log" -Tail 40


# Look for MOF compilation errors
Select-String -Path "$env:windir\System32\wbem\Logs\mofcomp.log" -Pattern "error" | Select-Object -Last 20


# Read WMI activity in Event Viewer (the modern tracing)
Get-WinEvent -LogName "Microsoft-Windows-WMI-Activity/Operational" -MaxEvents 20

Report a mistake