Phenquestions
When Microsoft rolls an update for Windows 10, the upgrade process creates tons of log files in every step. These log files are useful for analysis if there is any Upgrade problem. While it may not find it easy to analyze, its a gold mine for IT admins. In this post, we will discuss the Log files that are created when you upgrade to a new version of Windows. We have also included when or in which phase these log files are created.
Log files created when you upgrade Windows 10
Here are some terminologies you would see in the list below:
- Down-Level: It is the first phase of the Upgrade process, and since this phase runs on the source OS, upgrade errors are not typically seen except in the log files. It also ensures that the Windows setup source and the destination drive are accessible.
- OOBE: Out of the box experience.
- Rollback: Its when the setup decides to go back to the initial stage.
- Dumps: Its an extremely useful file where all the debugging information is written when the computer stops unexpectedly because of a Stop error (also known as a “blue screen,” system crash, or bug check) or during a Windows Upgrade process.
Below is the list of log files, their location, why are they created, and when you should use these log files. While they are meant for IT admins, anyone who is interested can do their bit of analysis.
| Log file | Phase: Location | Description | When to use |
| setupact.log | Down-Level: $Windows.~BT\Sources\Panther | List of set up actions to be taken during the downlevel phase. | It contains all the down-level failures and starting point for rollback investigations. Without it, failures would be stuck forever. |
| OOBE: $Windows.~BT\Sources\Panther\ UnattendGC | It contains the unattended setup experience and contains details about actions during the OOBE phase. | Investigating rollbacks that failed during OOBE phase and operations . Error Code 0x4001C, 0x4001D, 0x4001E, 0x4001F. | |
| Rollback: $Windows.~BT\Sources\Rollback | It includes instructions for rollback. | Investigating generic rollbacks - 0xC1900101. | |
| Pre-initialization (prior to downlevel): Windows | Contains information about initializing the setup. | If the setup fails to launch. | |
| Post-upgrade (after OOBE): Windows\Panther | Instructions to follow during the installation. | The log helps to investigate post-upgrade related issues. | |
| setuperr.log | Same as setupact.log | Data about setup errors during the installation. | Review all errors encountered during the installation phase. |
| miglog.xml | Post-upgrade (after OOBE): Windows\Panther | List of items migrated during the installation. | Identify post upgrade data migration issues. |
| BlueBox.log | Down-Level: Windows\Logs\Mosetup | Information on what will be communicated between the setup.exe and Windows Update. | Use during WSUS and WU down-level failures or for 0xC1900107. |
| Supplemental rollback logs: Setupmem.dmp setupapi.dev.log Event logs (*.evtx) | $Windows.~BT\Sources\Rollback | Additional logs collected during rollback. | Setupmem.dmp: Created when there is an OS bug. Setupapi: When Windows fails to install on the device - 0x30018 Event logs: Generic rollbacks (0xC1900101) or unexpected reboots. |
List of Log files are created when the upgrade is successful or failure
For every event, there is a log file generated. In fact, Log files are created even for an upgrade fails, and computer restarts for the second time or when there is a rollback. Here is the list:
Log files created when an upgrade is successful
- C:\Windows\Panther\Setupact.log
- C:\Windows\panther\setuperr.log
- C:\Windows\inf\setupapi.app.log
- C:\Windows\inf\setupapi.dev.log
- C:\Windows\panther\PreGatherPnPList.log
- C:\Windows\panther\PostApplyPnPList.log
- C:\Windows\panther\miglog.xml
Log files created when an upgrade fails during installation before the computer restarts for the second time
- C:\$Windows.~BT\Sources\panther\setupact.log
- C:\$Windows.~BT\Sources\panther\miglog.xml
- C:\Windows\setupapi.log
- [Windows 10:] C:\Windows\Logs\MoSetup\BlueBox.log
Log files created when an upgrade fails during installation after the computer restarts for the second time
- C:\Windows\panther\setupact.log
- C:\Windows\panther\miglog.xml
- C:\Windows\inf\setupapi.app.log
- C:\Windows\inf\setupapi.dev.log
- C:\Windows\panther\PreGatherPnPList.log
- C:\Windows\panther\PostApplyPnPList.log
- C:\Windows\memory.dmp
Log files created when an upgrade fails, and then you restore the desktop
- C:\$Windows.~BT\Sources\panther\setupact.log
- C:\$Windows.~BT\Sources\panther\miglog.xml
- C:\$Windows.~BT\sources\panther\setupapi\setupapi.dev.log
- C:\$Windows.~BT\sources\panther\setupapi\setupapi.app.log
- C:\Windows\memory.dmp
The following log files are created when an upgrade fails, and the installation rollback is initiated:
- C:\$Windows.~BT\Sources\Rollback\setupact.log
- C:\$Windows.~BT\Sources\Rollback\setupact.err
Read more about them on Microsoft here and here.
We hope this post was informative enough to make you aware of the type of log files, memory dumps, location of those files which are not easy to find.
