Windows 更新日志文件Windows Update log files

适用于:Windows 10Applies to: Windows 10

下表介绍了 Windows 更新创建的日志文件。The following table describes the log files created by Windows Update.

日志文件Log file 位置Location 描述Description 何时使用When to Use
windowsupdate.logwindowsupdate.log C:\Windows\Logs\WindowsUpdateC:\Windows\Logs\WindowsUpdate 从 Windows 8.1 开始一直到 Windows 10,Windows 更新客户端使用 Windows 事件跟踪 (ETW) 来生成诊断日志。Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs. 如果在运行 Windows 更新 (WU) 时收到一条错误消息,则可使用 Windowsupdate.log 日志文件中包含的信息对此问题进行故障排除。If you receive an error message when you run Windows Update (WU), you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.
UpdateSessionOrchestration.etlUpdateSessionOrchestration.etl C:\ProgramData\USOShared\LogsC:\ProgramData\USOShared\Logs 从 Windows 10 开始,更新 Orchestrator 负责处理通过 Windows 更新下载和安装各种更新类型的顺序。Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. 还会将事件记录到这些 etl 文件中。And the events are logged to these etl files. 当你看到有更新可用,但未触发下载时。When you see that the updates are available but download is not getting triggered.
已下载更新,但未触发安装时。When Updates are downloaded but installation is not triggered.
已安装更新,但未触发重新启动时。When Updates are installed but reboot is not triggered.
NotificationUxBroker.etlNotificationUxBroker.etl C:\ProgramData\USOShared\LogsC:\ProgramData\USOShared\Logs 从 Windows 10 开始,通知 toast 或横幅由该 NotificationUxBroker.exe 触发。Starting Windows 10, the notification toast or the banner is triggered by this NotificationUxBroker.exe . 用于检查其工作情况的日志便是此 etl。And the logs to check its working is this etl. 当你想要检查是否触发了通知,或者无需重新启动或更新可用性等等时。When you want to check whether the Notification was triggered or not for reboot or update availability etc.
CBS.logCBS.log %systemroot%\Logs\CBS%systemroot%\Logs\CBS 此日志用于了解服务堆栈中的更新安装部分。This logs provides insight on the update installation part in the servicing stack. 用于对与 WU 安装相关的问题进行故障排除。To troubleshoot the issues related to WU installation.

生成 WindowsUpdate.logGenerating WindowsUpdate.log

若要合并 WU 跟踪文件(.etl 文件)并转换为单个可读的 WindowsUpdate.log 文件,请参阅 Get-WindowsUpdateLogTo merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see Get-WindowsUpdateLog.


运行 Get-WindowsUpdateLog cmdlet 时,会创建 WindowsUpdate.log 文件的副本作为静态日志文件。When you run the Get-WindowsUpdateLog cmdlet, an copy of WindowsUpdate.log file is created as a static log file. 它不会作为旧的 WindowsUpate.log 进行更新,除非再次运行 Get-WindowsUpdateLogIt does not update as the old WindowsUpate.log unless you run Get-WindowsUpdateLog again.

Windows 更新日志组件Windows Update log components

WU 引擎具有不同的组件名称。The WU engine has different component names. 下面是 WindowsUpdate.log 文件中出现的一些最常见的组件:The following are some of the most common components that appear in the WindowsUpdate.log file:

  • AGENT - Windows 更新代理AGENT- Windows Update agent
  • AU - 自动更新正在执行此任务AU - Automatic Updates is performing this task
  • AUCLNT - AU 与已登录用户之间的交互AUCLNT- Interaction between AU and the logged-on user
  • CDM - 设备管理器CDM- Device Manager
  • CMPRESS - 压缩代理CMPRESS- Compression agent
  • COMAPI - Windows 更新 APICOMAPI- Windows Update API
  • DRIVER - 设备驱动程序信息DRIVER- Device driver information
  • DTASTOR - 处理数据库事务DTASTOR- Handles database transactions
  • EEHNDLER - 用于评估更新适用性的表达式处理程序EEHNDLER- Expression handler that's used to evaluate update applicability
  • HANDLER - 管理更新安装程序HANDLER- Manages the update installers
  • MISC - 常规服务信息MISC- General service information
  • OFFLSNC - 在无网络连接的情况下检测可用的更新OFFLSNC- Detects available updates without network connection
  • PARSER - 分析表达式信息PARSER- Parses expression information
  • PT - 将更新信息同步到本地数据存储PT- Synchronizes updates information to the local datastore
  • REPORT - 收集报告信息REPORT- Collects reporting information
  • SERVICE - 启动/关闭自动更新服务SERVICE- Startup/shutdown of the Automatic Updates service
  • SETUP - 安装新版本的 Windows 更新客户端(如果可用)SETUP- Installs new versions of the Windows Update client when it is available
  • SHUTDWN - 关机时安装功能SHUTDWN- Install at shutdown feature
  • WUREDIR - Windows 更新重定向程序文件WUREDIR- The Windows Update redirector files
  • WUWEB - Windows 更新 ActiveX 控件WUWEB- The Windows Update ActiveX control
  • ProtocolTalker - 客户端-服务器同步ProtocolTalker - Client-server sync
  • DownloadManager - 创建和监视有效负载下载DownloadManager - Creates and monitors payload downloads
  • Handler、Setup - 安装程序处理程序(CBS 等)Handler, Setup - Installer handlers (CBS, and so on)
  • EEHandler - 评估更新适用性规则EEHandler - Evaluating update applicability rules
  • DataStore - 在本地缓存更新数据DataStore - Caching update data locally
  • IdleTimer - 跟踪活动调用,停止服务IdleTimer - Tracking active calls, stopping a service


查找特定区域中的问题时,许多组件日志消息非常有用。Many component log messages are invaluable if you are looking for problems in that specific area. 但是,如果不通过筛选排除不相关的组件(以便可以专注于重要的内容),这些消息可能毫无用处。However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important.

Windows 更新日志结构Windows Update log structure

Windows 更新日志结构分为四个主要标识:The Windows update log structure is separated into four main identities:

  • 时间戳Time Stamps
  • 进程 ID 和线程 IDProcess ID and Thread ID
  • 组件名称Component Name
  • 更新标识符Update Identifiers
    • 更新 ID 和修订号Update ID and Revision Number
    • 修订 IDRevision ID
    • 本地 IDLocal ID
    • 不一致的术语Inconsistent terminology

以下各部分将讨论 WindowsUpdate.log 的结构。The WindowsUpdate.log structure is discussed in the following sections.

时间戳Time stamps

时间戳表示发生日志记录的时间。The time stamp indicates the time at which the logging occurs.

  • 消息通常按时间顺序排列,但可能存在例外情况。Messages are usually in chronological order, but there may be exceptions.
  • 同步过程中的暂停可能表示有网络问题,即使扫描成功也是如此。A pause during a sync can indicate a network problem, even if the scan succeeds.
  • 靠近扫描结束时的长停顿可能表示有取代链问题。A long pause near the end of a scan can indicate a supersedence chain issue.
    Windows 更新时间戳

进程 ID 和线程 IDProcess ID and thread ID

进程 ID 和线程 ID 是随机的,可能因日志而异,甚至在同一日志中因服务会话而已。The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log.

  • 前四个十六进制数字是进程 ID。The first four hex digits are the process ID.
  • 接下来的四个十六进制数字是线程 ID。The next four hex digits are the thread ID.
  • 每个组件(如 USO、WU 引擎、COM API 调用方和 WU 安装程序处理程序)都有其自己的进程 ID。Each component, such as the USO, WU engine, COM API callers, and WU installer handlers, has its own process ID.
    Windows 更新进程和线程 ID

组件名称Component name

请搜索并识别与 ID 相关联的组件。Search for and identify the components that are associated with the IDs. WU 引擎的不同部分有不同的组件名称。Different parts of the WU engine have different component names. 一些组件如下:Some of them are as follows:

  • ProtocolTalker - 客户端-服务器同步ProtocolTalker - Client-server sync
  • DownloadManager - 创建和监视有效负载下载DownloadManager - Creates and monitors payload downloads
  • Handler、Setup - 安装程序处理程序(CBS 等)Handler, Setup - Installer handlers (CBS, etc.)
  • EEHandler - 评估更新适用性规则EEHandler - Evaluating update applicability rules
  • DataStore - 在本地缓存更新数据DataStore - Caching update data locally
  • IdleTimer - 跟踪活动调用,停止服务IdleTimer - Tracking active calls, stopping service

Windows 更新组件名称

更新标识符Update identifiers

更新 ID 和修订号Update ID and revision number

同一更新在不同上下文中有不同的标识符。There are different identifiers for the same update in different contexts. 了解标识符的模式非常重要。It’s important to know the identifier schemes.

  • 更新 ID:发布时分配到给定更新的 GUID(如上一张屏幕截图中所示)Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time
  • 修订号:每次在服务中修改和重新发布给定更新(具有给定更新 ID)时都会递增的数字Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service
  • 不同更新(不是唯一的标识符)之间可重用修订号。Revision numbers are reused from one update to another (not a unique identifier).
  • 更新 ID 和修订号通常一起显示为“{GUID}.revision”。The update ID and revision number are often shown together as "{GUID}.revision." Windows 更新的更新标识符
修订 IDRevision ID
  • 修订 ID(不要与“修订号”混淆)是针对给定的服务首次发布或修改更新时生成的序列号。A Revision ID (do no confuse this with “revision number”) is a serial number that's issued when an update is initially published or revised on a given service.
  • 现有更新在修订后保持相同的更新 ID (GUID),其修订版本号递增(例如,从 100 递增到 101),但会获得与先前 ID 无关的全新修订 ID。An existing update that’s revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID.
  • 修订 ID 对于给定的更新源是唯一的,但在多个源之间并不唯一。Revision IDs are unique on a given update source, but not across multiple sources.
  • 同一更新修订对于 WU 和 WSUS 可能具有完全不同的修订 ID。The same update revision may have completely different revision IDs on WU and WSUS.
  • 同一修订 ID 可能表示 WU 和 WSUS 的不同更新。The same revision ID may represent different updates on WU and WSUS.
本地 IDLocal ID
  • 本地 ID 是由给定 WU 客户端从服务收到更新时生成的序列号Local ID is a serial number issued when an update is received from a service by a given WU client
  • 常见于调试日志中,尤其在涉及到更新信息的本地缓存(数据存储)时Usually seen in debug logs, especially involving the local cache for update info (Datastore)
  • 不同的客户端电脑会为同一更新分配不同的本地 IDDifferent client PCs will assign different Local IDs to the same update
  • 可通过获取客户端的 %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb 文件来查找客户端所使用的本地 IDYou can find the local IDs that a client is using by getting the client’s %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file
不一致的术语Inconsistent terminology
  • 有时,日志会使用不一致的术语。Sometimes the logs use terms inconsistently. 例如,InstalledNonLeafUpdateIDs 列表实际上包含修订 ID,而不是更新 ID。For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs.

  • 按窗体和上下文识别 ID:Recognize IDs by form and context:

    • GUID 是更新 IDGUIDs are update IDs
    • 更新 ID 旁显示的小整数是修订号Small integers that appear alongside an update ID are revision numbers
    • 大整数通常是修订 IDLarge integers are typically revision IDs
    • 小整数(尤其是在数据存储中)可以是本地 ID Windows 更新不一致的术语Small integers (especially in Datastore) can be local IDs Windows Update inconsisten terminology

使用 SetupDiag 工具分析 Windows 安装程序日志文件Windows Setup log files analysis using SetupDiag tool

SetupDiag 是一种诊断工具,可用于分析与 Windows 更新安装有关的日志。SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. 有关详细信息,请参阅 SetupDiagFor detailed information, see SetupDiag.