日志文件Log files

适用范围Applies to

  • Windows 10Windows 10

备注

这是 400 级主题, (高级) 。This is a 400 level topic (advanced).
有关本文中的完整主题列表,请参阅解决 Windows 10 升级错误See Resolve Windows 10 upgrade errors for a full list of topics in this article.

在升级过程的每个阶段中会创建多个日志文件。Several log files are created during each phase of the upgrade process. 必须使用这些日志文件才能解决升级问题。These log files are essential for troubleshooting upgrade problems. 默认情况下,包含这些日志文件的文件夹隐藏在升级目标计算机上。By default, the folders that contain these log files are hidden on the upgrade target computer. 若要查看日志文件,请配置 Windows 资源管理器查看隐藏的项目,或使用工具自动收集这些日志。To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. 最有用的日志是 setupact.logThe most useful log is setupact.log. 根据 Windows 安装程序阶段,日志文件位于不同的文件夹中。The log files are located in a different folder depending on the Windows Setup phase. 回想一下,你可以从扩展代码确定阶段。Recall that you can determine the phase from the extend code.

备注

另请参阅Windows 错误报告部分,帮助找到错误代码和日志文件。Also see the Windows Error Reporting section in this document for help locating error codes and log files.

下表介绍了某些日志文件以及如何使用它们进行疑难解答:The following table describes some log files and how to use them for troubleshooting purposes:


日志文件Log file阶段:位置Phase: Location描述Description使用时间When to use
setupact.logsetupact.log下层:Down-Level:
$Windows.~BT\Sources\Panther$Windows.~BT\Sources\Panther
包含有关下层阶段期间安装程序操作的信息。Contains information about setup actions during the downlevel phase. 所有下层发生故障并调查回滚的起点。All down-level failures and starting point for rollback investigations.
这是用于诊断安装程序问题的最重要日志。This is the most important log for diagnosing setup issues.
OOBE:OOBE:
$Windows.~BT\Sources\Panther\UnattendGC$Windows.~BT\Sources\Panther\UnattendGC
包含有关 OOBE 阶段期间操作的信息。Contains information about actions during the OOBE phase.调查在 OOBE 阶段期间失败的回滚和操作 - 0x4001C、0x4001D、0x4001E、0x4001F。Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.
回滚:Rollback:
$Windows.~BT\Sources\Rollback$Windows.~BT\Sources\Rollback
包含有关回滚期间操作的信息。Contains information about actions during rollback.调查通用回滚 - 0xC1900101。Investigating generic rollbacks - 0xC1900101.
预初始化(在下层之前):Pre-initialization (prior to downlevel):
WindowsWindows
包含有关初始化安装程序的信息。Contains information about initializing setup.如果安装程序无法启动。If setup fails to launch.
升级后(在 OOBE 之后):Post-upgrade (after OOBE):
Windows\PantherWindows\Panther
包含有关安装期间安装程序操作的信息。Contains information about setup actions during the installation.调查升级后的相关问题。Investigate post-upgrade related issues.
setuperr.logsetuperr.log与 setupact.log 相同Same as setupact.log包含有关安装期间安装程序错误的信息。Contains information about setup errors during the installation.查看在安装阶段期间遇到的所有错误。Review all errors encountered during the installation phase.
miglog.xmlmiglog.xml升级后(在 OOBE 之后):Post-upgrade (after OOBE):
Windows\PantherWindows\Panther
包含有关安装期间已迁移内容的信息。Contains information about what was migrated during the installation.确定升级后的数据迁移问题。Identify post upgrade data migration issues.
BlueBox.logBlueBox.log下层:Down-Level:
Windows\Logs\MosetupWindows\Logs\Mosetup
包含有关 setup.exe 和 Windows 更新之间的通信的信息。Contains information communication between setup.exe and Windows Update.在 WSUS 和 WU 下层故障期间使用或用于 0xC1900107。Use during WSUS and WU down-level failures or for 0xC1900107.
补充回滚日志:Supplemental rollback logs:
Setupmem.dmpSetupmem.dmp
setupapi.dev.logsetupapi.dev.log
事件日志 (\*.evtx)Event logs (\*.evtx)
$Windows.~BT\Sources\Rollback$Windows.~BT\Sources\Rollback回滚期间收集的其他日志。Additional logs collected during rollback. Setupmem.dmp:如果在升级过程中检查操作系统错误,安装程序将尝试提取小型转储。Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.
Setupapi:设备安装问题 - 0x30018Setupapi: Device install issues - 0x30018
事件日志:通用回滚 (0xC1900101) 或意外重新启动。Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.

日志项目结构Log entry structure

setupact.log 或 setuperr.log (位于 C:\Windows) 包括以下元素:A setupact.log or setuperr.log entry (files are located at C:\Windows) includes the following elements:

  1. 日期和时间 - 2016-09-08 09:20:05。The date and time - 2016-09-08 09:20:05.
  2. 日志级别 - 信息、警告、错误、致命错误。The log level - Info, Warning, Error, Fatal Error.
  3. 日志记录组件 - CONX、MOUPG、PANTHR、SP、IBSLIB、MIG、DISM、CSI、CBS。The logging component - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS.
    • 日志记录组件 SP(安装程序平台)、MIG(迁移引擎)和 CONX(兼容性信息)对于解决 Windows 安装程序错误尤其有用。The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors.
  4. 消息 - 操作成功完成。The message - Operation completed successfully.

请参阅以下示例:See the following example:

日期/时间Date/Time 日志级别Log level 组件Component 消息Message
2016-09-08 09:23:50,2016-09-08 09:23:50, 警告Warning MIGMIG 无法替换对象 C:\Users\name\Cookies。Could not replace object C:\Users\name\Cookies. 不能删除目标对象。Target Object cannot be removed.

分析日志文件Analyze log files

以下说明适用于 IT 专业人员。The following instructions are meant for IT professionals. 另请参阅本指南中的升级错误代码部分,以熟悉结果代码扩展代码Also see the Upgrade error codes section in this guide to familiarize yourself with result codes and extend codes.


若要分析 Windows 安装程序日志文件,请执行以下操作:To analyze Windows Setup log files:

  1. 确定 Windows 安装程序错误代码。Determine the Windows Setup error code. 如果未成功执行升级过程,Windows 安装程序应返回此代码。This code should be returned by Windows Setup if it is not successful with the upgrade process.
  2. 根据错误代码的扩展代码部分,确定要调查的日志文件的类型和位置。Based on the extend code portion of the error code, determine the type and location of a log files to investigate.
  3. 在文本编辑器(例如记事本)中打开日志文件。Open the log file in a text editor, such as notepad.
  4. 使用 Windows 安装程序错误代码的结果代码部分,在文件中搜索结果代码并找到代码最后一次出现的位置。Using the result code portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. 或者,搜索下面的步骤 7 中所述的中止和 " " " 放弃文本字符串。Alternatively search for the "abort" and abandoning" text strings described in step 7 below.
  5. 若要查找结果代码最后一次出现的位置:To find the last occurrence of the result code:
    1. 滚动到文件底部并在最后一个字符后单击。Scroll to the bottom of the file and click after the last character.
    2. 单击编辑Click Edit.
    3. 单击查找Click Find.
    4. 键入结果代码。Type the result code.
    5. 方向下选择向上Under Direction select Up.
    6. 单击查找下一个Click Find Next.
  6. 当你找到结果代码最后一次出现的位置时,在文件中从此位置向上滚动几行,并查看在生成结果代码之前失败的进程。When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code.
  7. 搜索以下重要的文本字符串:Search for the following important text strings:
    • Shell application requested abortShell application requested abort
    • Abandoning apply due to error for objectAbandoning apply due to error for object
  8. 本部分中出现的 Win32 解码错误。Decode Win32 errors that appear in this section.
  9. 记下本部分中观察到的错误的时间戳。Write down the timestamp for the observed errors in this section.
  10. 在其他日志文件中搜索有关匹配这些时间戳或错误的其他信息。Search other log files for additional information matching these timestamps or errors.

例如,假设错误的错误代码是 0x8007042B - 0x2000D。For example, assume that the error code for an error is 0x8007042B - 0x2000D. 从 setuperr.log 文件中搜索“8007042B”将显示以下内容:Searching for "8007042B" reveals the following content from the setuperr.log file:

缩短以下文本中的几行以增强可读性。Some lines in the text below are shortened to enhance readability. 将每一行开头的日期和时间(例如 2016-10-05 15:27:08)缩短到分钟和秒钟,将较长文本字符串的证书文件名缩短到“CN”。The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN."


setuperr.log 内容:setuperr.log content:

27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Error                  Gather failed. Last error: 0x00000000
27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]

第一行指示文件 C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN] 中有错误 0x00000570(如下所示):The first line indicates there was an error 0x00000570 with the file C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN] (shown below):

27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]

错误 0x00000570 是 Win32 错误代码,对应于:ERROR_FILE_CORRUPT:文件或目录已损坏,无法读取。The error 0x00000570 is a Win32 error code corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable.

因此,Windows 安装程序会失败,因为它无法迁移损坏的文件 C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN]Therefore, Windows Setup failed because it was not able to migrate the corrupt file C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN]. 此文件是本地系统证书,可以安全删除。This file is a local system certificate and can be safely deleted. 在 setupact.log 文件中搜索其他详细信息,在与 setuperr.log 中的行具有相同时间戳的位置中找到了阶段“Shell application requested abort”。Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. 我们怀疑此文件导致升级失败,上述内容证实了这一点:This confirms our suspicion that this file is the cause of the upgrade failure:


Setupact.log 内容:setupact.log content:

27:00, Info                   Gather started at 10/5/2016 23:27:00
27:00, Info [0x080489] MIG    Setting system object filter context (System)
27:00, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
27:00, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
27:00, Info            SP     ExecuteProgress: Elapsed events:1 of 4, Percent: 12
27:00, Info [0x0802c6] MIG    Processing GATHER for migration unit: <System>\UpgradeFramework (CMXEAgent)
27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Info            SP     ExecuteProgress: Elapsed events:2 of 4, Percent: 25
27:08, Info            SP     ExecuteProgress: Elapsed events:3 of 4, Percent: 37
27:08, Info [0x080489] MIG    Setting system object filter context (System)
27:08, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
27:08, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
27:08, Info            MIG    COutOfProcPluginFactory::FreeSurrogateHost: Shutdown in progress.
27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened-
27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object.
27:08, Error                  Gather failed. Last error: 0x00000000
27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
27:08, Info                   Leaving MigGather method
27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C


setupapi.dev.log 内容:setupapi.dev.log content:

>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
>>>  Section start 2019/09/26 20:13:01.623
      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
     ndv: Install flags: 0x00000000
     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
     ndv:      Search options: 0x00000081
     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
     dvi:      {Build Driver List} 20:13:01.643
     dvi:           Searching for hardware ID(s):
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
     dvi:                pci\ven_8086&dev_8c4f&cc_060100
     dvi:                pci\ven_8086&dev_8c4f&cc_0601
     dvi:           Searching for compatible ID(s):
     dvi:                pci\ven_8086&dev_8c4f&rev_04
     dvi:                pci\ven_8086&dev_8c4f
     dvi:                pci\ven_8086&cc_060100
     dvi:                pci\ven_8086&cc_0601
     dvi:                pci\ven_8086
     dvi:                pci\cc_060100
     dvi:                pci\cc_0601
     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
     sig:                Key      = lynxpointsystem.inf
     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
     sig:                Success: File is signed in catalog.
     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
     dvi:           Created Driver Node:
     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
     dvi:                Section      - Needs_ISAPNP_DRV
     dvi:                Rank         - 0x00ff2001
     dvi:                Signer Score - WHQL
     dvi:                DrvDate      - 04/04/2016
     dvi:                Version      - 10.1.1.18
     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.699
     ndv:      Searching currently installed INF
     dvi:      {Build Driver List} 20:13:01.699
     dvi:           Searching for hardware ID(s):
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
     dvi:                pci\ven_8086&dev_8c4f&cc_060100
     dvi:                pci\ven_8086&dev_8c4f&cc_0601
     dvi:           Searching for compatible ID(s):
     dvi:                pci\ven_8086&dev_8c4f&rev_04
     dvi:                pci\ven_8086&dev_8c4f
     dvi:                pci\ven_8086&cc_060100
     dvi:                pci\ven_8086&cc_0601
     dvi:                pci\ven_8086
     dvi:                pci\cc_060100
     dvi:                pci\cc_0601
     dvi:           Created Driver Node:
     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
     dvi:                InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
     dvi:                Section      - Needs_ISAPNP_DRV
     dvi:                Rank         - 0x00ff2001
     dvi:                Signer Score - WHQL
     dvi:                DrvDate      - 10/03/2016
     dvi:                Version      - 10.1.1.38
     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.731
     dvi:      {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
     dvi:           Default installer: Enter 20:13:01.735
     dvi:                {Select Best Driver}
     dvi:                     Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
     dvi:                     Selected Driver:
     dvi:                          Description - Intel(R) QM87 LPC Controller - 8C4F
     dvi:                          InfFile     - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
     dvi:                          Section     - Needs_ISAPNP_DRV
     dvi:                {Select Best Driver - exit(0x00000000)}
     dvi:           Default installer: Exit
     dvi:      {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
     ndv:      Currently Installed Driver:
     ndv:           Inf Name       - oem1.inf
     ndv:           Driver Date    - 10/03/2016
     ndv:           Driver Version - 10.1.1.38
     ndv: {Update Device Driver - exit(00000103)}
!    ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
!    ndv: No devices were updated.
<<<  Section end 2019/09/26 20:13:01.759
<<<  [Exit status: FAILURE(0xC1900101)]


此分析表明,通过删除 C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN] 文件可解决 Windows 升级错误。This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18[CN] file. 注意:在此示例中,未缩短的完整文件名是 C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f。Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.

面向 IT 专业人员的 Windows 10 常见问题Windows 10 FAQ for IT professionals
Windows10 企业版系统要求Windows 10 Enterprise system requirements
Windows10 规范Windows 10 Specifications
Windows10 IT 专业人员论坛Windows 10 IT pro forums
使用 DISM 或系统更新准备工具修复 Windows 更新错误Fix Windows Update errors by using the DISM or System Update Readiness tool