Where are the WSUS logs?

[Saket]

I need to check the WSUS logs? Can anybody tell me where I can find them?

[Lawrence Garvin [MVP]]

"Saket" <u55779@uwe> wrote in message news:9e3ba836e4c4b@uwe...

>I need to check the WSUS logs? Can anybody tell me where I can find them?

For the server: C:\Program Files\Update Services\Logfiles
and the Application Event Log

For the client:
C:\Windows\WindowsUpdate.log
C:\Windows\SoftwareDistribution\ReportingEvents.log
and the Application Event Log

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

[Saket via WinServerKB.com]

Hi Lawrence,

Thanks so much for the reply. I have 2 questions for you. I would be really
grateful if you could answer them .

1) I looked at the C:\Program Files\Update Services\Logfiles\change file.
That has some considerable number of logs. But the problem is that it doesn't
mention the IP address of any of the computers it updates. So do you think I
can find the logs in the database(WID) that it uses?

2) The application Event logs a few events like 13051/13052 etc. So, is
there a documentation somewhere which lists down all the event ids associated
with WSUS. I have checked the Operations guide/Deployment guide and I
couldn't find it.

Thanks,
Saket

Lawrence Garvin [MVP] wrote:
>>I need to check the WSUS logs? Can anybody tell me where I can find them?
>
>For the server: C:\Program Files\Update Services\Logfiles
> and the Application Event Log
>
>For the client:
> C:\Windows\WindowsUpdate.log
> C:\Windows\SoftwareDistribution\ReportingEvents.log
> and the Application Event Log
>

--
Message posted via http://www.winserverkb.com

[Lawrence Garvin [MVP]]

"Saket via WinServerKB.com" <u55779@uwe> wrote in message
news:9e4514d957e5d@uwe...

> 1) I looked at the C:\Program Files\Update Services\Logfiles\change file.
> That has some considerable number of logs. But the problem is that it
> doesn't
> mention the IP address of any of the computers it updates. So do you think
> I
> can find the logs in the database(WID) that it uses?

That log is not designed to record information about target computers
updated. That log only reports changes to the *server* (e.g. update
approvals, configuration changes, etc.)

To get information about the target computers:
[a] the Current status is displayed in the Administrative User Interface
(you'll need to modify the displayed columns list to include the Last
Reported Date and/or Last Contact Date). That display also provides access
to all of the basic inventory attributes captured by the WUAgent and
reported to the WSUS Server (such as InstalledOS, IP Address, etc.)
[b] run a Computer Detailed Status report
[c] review the WindowsUpdate.log on each individual client. Basic inventory
information is logged at service startup.

> 2) The application Event logs a few events like 13051/13052 etc. So, is
> there a documentation somewhere which lists down all the event ids
> associated
> with WSUS. I have checked the Operations guide/Deployment guide and I
> couldn't find it.

Those eventIDs are generated by the Health Monitoring service, and generally
the error text in the log entry is the nutshell of what the issue is. Almost
always those Health Monitoring errors are caused by an improper
configuration of the IIS environment post-installation of WSUS; sometimes
they're caused by actual issues -- like WSUS3SP1's failure to recreate the
selfupdate v-dir after an upgrade.

The basic documentation on the Health Monitoring service is found in the
"Managing WSUS 3.0 SP1 from the Command Line" section of the Operations
Guide at http://technet.microsoft.com/en-us/library/dd939838(WS.10).aspx and
the "Health Monitoring in WSUS 3.0 SP2" section of the Operations Guide at
http://technet.microsoft.com/en-us/library/dd939853(WS.10).aspx

[Saket via WinServerKB.com]

Thanks Lawrence..

Can you tell me how to delete updates from WSUS? I am out of disk space. I
tried the wsusdebugtool but that crashes for me and i dont really trust that
tool. When i decline a few updates, it doesnt remove it from the hard disk.

Can I hard delete those files from the WSUS folder itself?

--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forums.aspx/wsus/200910/1

[Lawrence Garvin [MVP]]

"Saket via WinServerKB.com" <u55779@uwe> wrote in message

news:9e5edfa09f314@uwe...

> Can you tell me how to delete updates from WSUS?

*Updates* cannot be deleted from the database, except in the case of expired
updates or non-current revisions, which can be deleted using the Server
Cleanup Wizard.

Update *files* can be deleted using the Server Cleanup Wizard provided the
update is Declined.

> Can I hard delete those files from the WSUS folder itself?

You can. If you know the correct files you wish to delete. If the files are
associated with an Approved update; however, the system may download them if
it discovers they are missing.