Windows Setup Log Files and Event Logs

Windows® Setup creates log files for all actions that occur during installation. If you are experiencing problems installing Windows, consult the log files to troubleshoot the installation.

WindowsВ Setup log files are available in the following directories:

Log location before Setup can access the drive.

Log location when Setup rolls back in the event of a fatal error.

Log location of Setup actions after disk configuration.

Used to log Plug and Play device installations.

Location of memory dump from bug checks.

Location of log minidumps from bug checks.

Location of Sysprep logs.

WindowsВ Setup Event Logs

WindowsВ Setup includes the ability to review the WindowsВ Setup performance events in the Windows Event Log viewer. This enables you to more easily review the actions that occurred during WindowsВ Setup and to review the performance statistics for different parts of WindowsВ Setup. You can filter the log so as to view only relevant items that you are interested in. The WindowsВ Setup performance events are saved into a log file that is named Setup.etl, which is available in the %WINDIR%\Panther directory of all installations. To view the logs, you must use the Event Viewer included with the Windows media that corresponds to the version of the customized image that you are building.

To view the logs on a computer that does not include the corresponding kit, you must run a script from the root of the media that installs the Event Trace for Windows (ETW) provider. From the command line, type:

where D is the drive letter of the Windows DVD media.

To view the WindowsВ Setup event logs

Start the Event Viewer, expand the Windows Logs node, and then click System.

In the Actions pane, click Open Saved Log and then locate the Setup.etl file. By default, this file is available in the %WINDIR%\Panther directory.

The log file contents appear in the Event Viewer.

To Export the log to a file

From the command line, use the Wevtutil or Tracerpt commands to save the log to an .xml or text file. For information about how to use these tools, see the command-line Help. The following commands show examples of how to use the tools:

File System Event Handler Делегат

Определение

Представляет метод, обрабатывающий события Changed, Created или Deleted класса FileSystemWatcher. Represents the method that will handle the Changed, Created, or Deleted event of a FileSystemWatcher class.

Параметры

Источник события. The source of the event.

Объект класса FileSystemEventArgs, содержащий данные о событии. The FileSystemEventArgs that contains the event data.

Примеры

В следующем примере показано, как создать FileSystemWatcher для отслеживания изменений в файле (создание, удаление, переименование, изменение), происходящих на диске. The following example shows how to create a FileSystemWatcher to monitor file changes (creates, deletes, renames, changes) occurring on a disk drive. В примере также показано, как правильно получать уведомления об ошибках. The example also shows how to properly receive error notifications.

Комментарии

При создании делегата FileSystemEventHandler необходимо указать метод, обрабатывающий событие. When you create a FileSystemEventHandler delegate, you identify the method that will handle the event. Чтобы связать событие с обработчиком событий, нужно добавить в событие экземпляр делегата. To associate the event with your event handler, add an instance of the delegate to the event. Обработчик событий вызывается всякий раз, когда происходит событие, если делегат не удален. The event handler is called whenever the event occurs, unless you remove the delegate. Дополнительные сведения о делегатах обработчиков событий см. в разделе обработка и вызов событий. For more information about event handler delegates, see Handling and Raising Events.

Методы расширения

Получает объект, представляющий метод, представленный указанным делегатом. Gets an object that represents the method represented by the specified delegate.

File System Watcher Class

Definition

Listens to the file system change notifications and raises events when a directory, or file in a directory, changes.

Examples

The following example creates a FileSystemWatcher to watch the directory specified at run time. The component is set to watch for changes in LastWrite and LastAccess time, the creation, deletion, or renaming of text files in the directory. If a file is changed, created, or deleted, the path to the file prints to the console. When a file is renamed, the old and new paths print to the console.

Remarks

Use FileSystemWatcher to watch for changes in a specified directory. You can watch for changes in files and subdirectories of the specified directory. You can create a component to watch files on a local computer, a network drive, or a remote computer.

To watch for changes in all files, set the Filter property to an empty string («») or use wildcards («*.*»). To watch a specific file, set the Filter property to the file name. For example, to watch for changes in the file MyDoc.txt, set the Filter property to «MyDoc.txt». You can also watch for changes in a certain type of file. For example, to watch for changes in text files, set the Filter property to «*.txt».

There are several types of changes you can watch for in a directory or file. For example, you can watch for changes in Attributes , the LastWrite date and time, or the Size of files or directories. This is done by setting the NotifyFilter property to one of the NotifyFilters values. For more information on the type of changes you can watch, see NotifyFilters.

You can watch for renaming, deletion, or creation of files or directories. For example, to watch for renaming of text files, set the Filter property to «*.txt» and call the WaitForChanged method with a Renamed specified for its parameter.

The Windows operating system notifies your component of file changes in a buffer created by the FileSystemWatcher. If there are many changes in a short time, the buffer can overflow. This causes the component to lose track of changes in the directory, and it will only provide blanket notification. Increasing the size of the buffer with the InternalBufferSize property is expensive, as it comes from non-paged memory that cannot be swapped out to disk, so keep the buffer as small yet large enough to not miss any file change events. To avoid a buffer overflow, use the NotifyFilter and IncludeSubdirectories properties so you can filter out unwanted change notifications.

For a list of initial property values for an instance of FileSystemWatcher, see the FileSystemWatcher constructor.

Please note the following when using the FileSystemWatcher class.

Hidden files are not ignored.

In some systems, FileSystemWatcher reports changes to files using the short 8.3 file name format. For example, a change to «LongFileName.LongExtension» could be reported as «LongFil

This class contains a link demand and an inheritance demand at the class level that applies to all members. A SecurityException is thrown when either the immediate caller or the derived class does not have full-trust permission. For details about security demands, see Link Demands.

The maximum size you can set for the InternalBufferSize property for monitoring a directory over the network is 64 KB.

Copying and moving folders

The operating system and FileSystemWatcher object interpret a cut-and-paste action or a move action as a rename action for a folder and its contents. If you cut and paste a folder with files into a folder being watched, the FileSystemWatcher object reports only the folder as new, but not its contents because they are essentially only renamed.

To be notified that the contents of folders have been moved or copied into a watched folder, provide OnChanged and OnRenamed event handler methods as suggested in the following table.

Log file location	Description

Event Handler	Events Handled	Performs
OnChanged	Changed, Created, Deleted	Report changes in file attributes, created files, and deleted files.
OnRenamed	Renamed	List the old and new paths of renamed files and folders, expanding recursively if needed.

Events and Buffer Sizes

Note that several factors can affect which file system change events are raised, as described by the following:

Common file system operations might raise more than one event. For example, when a file is moved from one directory to another, several OnChanged and some OnCreated and OnDeleted events might be raised. Moving a file is a complex operation that consists of multiple simple operations, therefore raising multiple events. Likewise, some applications (for example, antivirus software) might cause additional file system events that are detected by FileSystemWatcher.

The FileSystemWatcher can watch disks as long as they are not switched or removed. The FileSystemWatcher does not raise events for CDs and DVDs, because time stamps and properties cannot change. Remote computers must have one of the required platforms installed for the component to function properly.

Note that a FileSystemWatcher may miss an event when the buffer size is exceeded. To avoid missing events, follow these guidelines:

Increase the buffer size by setting the InternalBufferSize property.

Avoid watching files with long file names, because a long file name contributes to filling up the buffer. Consider renaming these files using shorter names.

Keep your event handling code as short as possible.

Constructors

Initializes a new instance of the FileSystemWatcher class.

Initializes a new instance of the FileSystemWatcher class, given the specified directory to monitor.

Initializes a new instance of the FileSystemWatcher class, given the specified directory and type of files to monitor.

Properties

Gets a value indicating whether the component can raise an event.

(Inherited from Component) Container

Gets the IContainer that contains the Component.

(Inherited from Component) DesignMode

Gets a value that indicates whether the Component is currently in design mode.

(Inherited from Component) EnableRaisingEvents

Gets or sets a value indicating whether the component is enabled.

Gets the list of event handlers that are attached to this Component.

(Inherited from Component) Filter

Gets or sets the filter string used to determine what files are monitored in a directory.

Gets the collection of all the filters used to determine what files are monitored in a directory.

Gets or sets a value indicating whether subdirectories within the specified path should be monitored.

Gets or sets the size (in bytes) of the internal buffer.

Gets or sets the type of changes to watch for.

Gets or sets the path of the directory to watch.

Gets or sets an ISite for the FileSystemWatcher.

Gets or sets the object used to marshal the event handler calls issued as a result of a directory change.

Methods

Begins the initialization of a FileSystemWatcher used on a form or used by another component. The initialization occurs at run time.

Creates an object that contains all the relevant information required to generate a proxy used to communicate with a remote object.

(Inherited from MarshalByRefObject) Dispose()

Releases the unmanaged resources used by the FileSystemWatcher.

Releases all resources used by the Component.

(Inherited from Component) Dispose(Boolean)

Releases the unmanaged resources used by the FileSystemWatcher and optionally releases the managed resources.

Ends the initialization of a FileSystemWatcher used on a form or used by another component. The initialization occurs at run time.

Determines whether the specified object is equal to the current object.

(Inherited from Object) Finalize()

Releases the resources held by the current instance.

Serves as the default hash function.

(Inherited from Object) GetLifetimeService()

Retrieves the current lifetime service object that controls the lifetime policy for this instance.

(Inherited from MarshalByRefObject) GetService(Type)

Returns an object that represents a service provided by the Component or by its Container.

(Inherited from Component) GetType()

Gets the Type of the current instance.

(Inherited from Object) InitializeLifetimeService()

Obtains a lifetime service object to control the lifetime policy for this instance.

(Inherited from MarshalByRefObject) MemberwiseClone()

Creates a shallow copy of the current Object.

(Inherited from Object) MemberwiseClone(Boolean)

Creates a shallow copy of the current MarshalByRefObject object.

(Inherited from MarshalByRefObject) OnChanged(FileSystemEventArgs)

Raises the Changed event.

Raises the Created event.

Raises the Deleted event.

Raises the Error event.

Raises the Renamed event.

Returns a String containing the name of the Component, if any. This method should not be overridden.

(Inherited from Component) ToString()

Returns a string that represents the current object.

(Inherited from Object) WaitForChanged(WatcherChangeTypes)

A synchronous method that returns a structure that contains specific information on the change that occurred, given the type of change you want to monitor.

A synchronous method that returns a structure that contains specific information on the change that occurred, given the type of change you want to monitor and the time (in milliseconds) to wait before timing out.

Events

Occurs when a file or directory in the specified Path is changed.

Occurs when a file or directory in the specified Path is created.

Occurs when a file or directory in the specified Path is deleted.

Occurs when the component is disposed by a call to the Dispose() method.

(Inherited from Component) Error

Occurs when the instance of FileSystemWatcher is unable to continue monitoring changes or when the internal buffer overflows.

Occurs when a file or directory in the specified Path is renamed.