How to Collect Diagnostic Logs in Windows

There are many different types of diagnostic logs in Windows. Each log is to diagnose a specific component. The Windows Update client creates the Windows Update ETL or Windows Update log files, the Component-Based Servicing uses “cbs.log”, and the DISM tool writes to “dism.log”, etc.

This post tells you how to collect various diagnostic logs in Windows.

Collecting Diagnostic Logs

CBS and DISM Logs

The CBS log is used by Component Based Servicing (TrustedInstaller.exe), which is responsible for applying updates and features. Every update you install or every component you remove or repair (using DISM or PowerShell) is recorded in the CBS.log. Additionally, the System File Checker (Sfc.exe) logs the repair operations in CBS.log. The CBS.log file is located here:

C:\Windows\Logs\CBS\

The DISM log is created when you run the DISM.exe console tool. It contains the summary of events that occurred when running a DISM command. The DISM.log file is located here:

C:\Windows\Logs\DISM\

When DISM installs or repairs a component or feature, it logs the details into CBS.log as well. Hence it’s recommended to collect both CBS and DISM logs for analysis.

Collecting the CBS and DISM logs

To collect the CBS and DISM logs so you can share them with someone, follow these steps:

1. Open the folder “C:\Windows\Logs\“
2. Select the two folders, namely, CBS and DISM.
3. Right-click on the selection, and click Send to → Compressed (zipped) folder.
   
   If you’re using Windows 11, click “Show more options” in the right-click menu, and click Send to → Compressed (zipped) folder. Alternatively, you can click on the “Compress to ZIP file” option in the fast context menu.
   
4. Click Yes when you see the following prompt:
   
   Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?

That’s it. The Zip file is saved to your desktop.