Reading Windows logs

ICIT2LOL · Aug 21, 2022

I ran sfc /scannow and got the result in the pic yet I cannot find the reported logs any ideas please?

I searched the command line in C: drive but it tells me it cannot find them.

Fabler2 · Aug 21, 2022

That's odd. I just copy C:\Windows\Logs\CBS\CBS.log and then paste.

2022-08-21 05_59_39-CBS.log - Notepad.png

Bree · Aug 21, 2022

ICIT2LOL said:
I ran sfc /scannow and got the result in the pic yet I cannot find the reported logs any ideas please?View attachment 36985
I searched the command line in C: drive but it tells me it cannot find them.

There is a lot more recorded in CBS.log besides the SFC results. To see just those files SFC did (or could not) replace use Option Three here:

Use System File Checker (SFC) to Repair System Files in Windows 11 Tutorial

This tutorial will show you how to run the System File Checker (SFC) tool to repair missing, corrupted, and modified system files in Windows 10 and Windows 11. System File Checker (SFC) is a tool built into Windows that will check for system file corruption. The SFC /SCANNOW command scans and...

www.elevenforum.com

There is just one other type of SFC 'successful repair' result that won't appear in the above. That is when SFC just repairs permissions or ownership that were set twice. This is a trivial error that does no harm if left uncorrected. Here is an example:

Code:

2022-08-21 10:50:23, Info                  CSI    00000096 [SR] Beginning Verify and Repair transaction
2022-08-21 10:50:24, Info                  CSI    00000097 Warning: Overlap: Directory \??\C:\Windows\System32\drivers\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2022-08-21 10:50:24, Info                  CSI    00000098 Warning: Overlap: Directory \??\C:\Windows\System32\wbem\en-US\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2022-08-21 10:50:24, Info                  CSI    00000099 Warning: Overlap: Directory \??\C:\Windows\help\mui\0409\ is owned twice or has its security set twice
   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2022-08-21 10:50:25, Info                  CSI    0000009a [SR] Verify complete

To find those, search CBS.log for the word 'twice'.

x BlueRobot · Aug 21, 2022

Bree said:
To see just those files SFC did (or could not) replace use Option Three here:

I would not generally filter the CBS log just to the [SR] entries since you're going to remove some important context to the errors it managed to find and repair.

Bree · Aug 21, 2022

x BlueRobot said:
I would not generally filter the CBS log just to the [SR] entries since you're going to remove some important context to the errors it managed to find and repair.

@Brink's tutorial says it is sufficient to search for [SR] and who am I to argue with him. This finds all cases where a corrupt file has been replaced from the component store, and those where it cannot be replaced because the store copy is also corrupt, then a DISM /RestoreHealth is required before running SFC again.

x BlueRobot · Aug 21, 2022

Bree said:
@Brink's tutorial says it is sufficient to search for [SR] and who am I to argue with him.

Why? It's questionable advice.

There are many errors within the CBS log which are pretty useless unless you look at the surrounding context. Some problems may not even be logged as errors. DISM is fairly okay at repairing file corruption but more often than not it will fail as well; it isn't very good at repairing nuanced problems which are typically due to registry corruption.

@ICIT2LOL I would open a command prompt and then the following command:

Rich (BB code):

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /v EnableLog

Please post the output in your next post. It should be set to 0x1.

Brink · Aug 21, 2022

Bree said:
@Brink's tutorial says it is sufficient to search for [SR] and who am I to argue with him. This finds all cases where a corrupt file has been replaced from the component store, and those where it cannot be replaced because the store copy is also corrupt, then a DISM /RestoreHealth is required before running SFC again.

x BlueRobot said:
Why? It's questionable advice.

There are many errors within the CBS log which are pretty useless unless you look at the surrounding context. Some problems may not even be logged as errors. DISM is fairly okay at repairing file corruption but more often than not it will fail as well; it isn't very good at repairing nuanced problems which are typically due to registry corruption.

Since there are many things logged into the CBS.LOG, filtering it with "[SR]" will let you only see anything logged by SFC.

You shouldn't miss any SFC details, but it's fine to look at the whole log if wanted. It's just more work to sift through it.

ICIT2LOL · Aug 21, 2022

Ok I tried Fablers suggestion and got the logs I think I was looking at the C: drive in This PC and not the command prompt. Having said that there was a lot of stuff there I don't understand anyway but thanks for all the replies folks at least I know how to do it now.