Contents<\/strong><\/p>\n The CBS log<\/strong> is used by Component Based Servicing ( The DISM log<\/strong> is created when you run the DISM.exe console tool. It contains the summary of events that occurred when running a DISM command. The DISM.log file is located here:<\/p>\n To collect the CBS and DISM logs so you can share them with someone, follow these steps:<\/p>\n That’s it. The Zip file is saved to your desktop.<\/p>\n To collect the CBS and DISM logs and automatically save them to a .zip file on your desktop, open PowerShell admin and run this command:<\/p>\n This creates the CBS.zip file on your desktop.\n<\/p><\/div>\n Windows Setup creates log files for all actions that occur during installation. If you’re experiencing problems installing Windows, check the log files to help troubleshoot the installation. The log file names and the locations are mentioned in the article\u00a0Windows setup log file locations – Windows Client<\/a>.<\/p>\n The best way to collect the setup logs is by running SetupDiag<\/strong>.\u00a0SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows 10\/11 upgrade was unsuccessful.<\/p>\n Download SetupDiag<\/strong><\/a><\/p>\n SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. or 11. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode.<\/p>\n The tool collects the setup logs and saves them into a zip file named Logs.zip on your desktop.<\/p>\n The built-in Microsoft System Information (Msinfo32.exe) tool in Windows gathers information about your computer. It displays a comprehensive view of your hardware, system components, and software environment, which you can use to diagnose computer issues. REF:<\/strong> Description of Microsoft System Information (Msinfo32.exe) Tool<\/a>.<\/p>\n You can view the list of services and drivers and their configuration, the loaded modules list, and other helpful information using MSINFO32. The MSINFO32.exe report can be generated by pressing Ctrl + S and saving the entries to an .NFO file. Make sure to run the tool as administrator.<\/p>\n For detailed information, check out the post\u00a0Generate a System Information Report using MSINFO32<\/a><\/p>\n Autoruns<\/a> (from Microsoft Sysinternals), which has the most comprehensive knowledge of auto-starting locations<\/a> of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer, and media players.\u00a0Autoruns is an excellent tool that can be used to locate and remove malware from the startup launch points on the computer.<\/p>\n Here is how to save the Autoruns log if you wish to send it to someone for analysis.<\/p>\n Farbar Recovery Scan Tool, or FRST, is a powerful tool that runs on all Windows Operating Systems. The main objective of this tool is to diagnose malware issues, but you can do much more with this tool. Both 32-bit and 64-bit versions of the Farbar Recovery Scan Tool are available. Please pick the version that matches your operating system’s bit type<\/a>.<\/p>\n Download Farbar Recovery Scan Tool (FRST64.exe) from the following link:<\/p>\n FRST64.exe doesn’t remove anything when you click “Scan”. It only scans all the launch points, services, and drivers and outputs them to the log file(s). After seeing the logs, the support technician will prepare a fixlist.txt<\/strong> file containing some directives. Then, the fixlist.txt<\/strong> script needs to be executed using the Farbar Recovery Scan Tool. Here are the instructions.<\/p>\n <\/p>\n Event logs store records of significant events on behalf of the system and applications running on the system. You can export an event log via the Event Viewer console.<\/p>\n\n
<\/a>CBS and DISM Logs<\/h2>\n
TrustedInstaller.exe<\/code>), which is responsible for applying updates and features. Every update you install or every component you remove or repair (using DISM or PowerShell) is recorded in the CBS.log. Additionally, the System File Checker (Sfc.exe<\/code>) logs the repair operations in CBS.log. The CBS.log file is located here:<\/p>\nC:\\Windows\\Logs\\CBS\\<\/pre>\n
\nCbsPersist_<timestamp>.cab<\/code>Example:CbsPersist_20221220170129.cab<\/code><\/div>\nC:\\Windows\\Logs\\DISM\\<\/pre>\n
![\"\"](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/information-icon.png\"){kind=icon}
When DISM installs or repairs a component or feature, it logs the details into CBS.log. Hence it’s recommended to collect both CBS and DISM logs for analysis.<\/em><\/p>\nCollecting the CBS and DISM logs<\/h4>\n
\n
C:\\Windows\\Logs\\<\/code>“<\/li>\n
\n![\"CBS](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/cbs-logs-collect.png\")
\nIf you’re using Windows 11, click “Show more options” in the right-click menu, and click Send to \u2192 Compressed (zipped) folder. Alternatively, click the “Compress to ZIP file” option in the fast context menu.
\n![\"CBS](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/cbs-logs-windows-11.png\")
<\/li>\n
\n![\"create](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/cbs-logs-windows-11-2.png\")
\nWindows cannot create the Compressed (zipped) Folder here. <\/em>Do you want it to be placed on the desktop instead?<\/em><\/li>\n<\/ol>\n![\"CBS](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/cbs-logs-windows-11-3.png\")
<\/p>\n<\/a>Command-line method to collect CBS and DISM logs<\/h4>\n
GCI -Path 'c:\\windows\\logs\\cbs\\*.*', 'c:\\windows\\logs\\dism\\dism.log' | Compress-Archive -destination (join-path ([environment]::GetFolderPath('Desktop')) \\CBS.zip) -update<\/pre>\n![\"powershell](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/powershell-collect-cbs-dism-logs-zip.png\")
<\/p>\n
\n<\/a>Windows Setup Logs<\/h2>\n
<\/a>System Information Tool (MSINFO32.exe) log<\/h2>\n
<\/a>Autoruns Log (.ARN)<\/h2>\n
\n
\n![\"Autoruns](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/autoruns-code-signatures.png\")
<\/li>\n<\/a>Farbar Recovery Scan Tool<\/h2>\n
https:\/\/www.bleepingcomputer.com\/download\/farbar-recovery-scan-tool\/<\/pre>\n
![\"Farbar](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png\")
<\/p>\n\n
How does it work?<\/h4>\n
\n
<\/a>Windows Event logs<\/h2>\n
![\"export](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-1.png\")
<\/p>\n