Enterprise log files locations

Log files are useful in diagnosing and repairing problems.  This is a list of common log files and their standard locations that I've compiled.   While this is not exhaustive, it is a pretty good list that I've found to be useful.  I may update it from time to time.  I'm also including some usage notes.

DRAC Logs  (Dell Remote Access Controller)
    Racadm getconfig –f c:\config.txt
    Racadm Getraclog > c:\raclog.txt
    Racadm Gettracelog > c:\tracelog.txt

SBS
Web Parts Settings
Gadgets are movable and can be on or off

Gadgets
    C:\Program Files\Windows Small Business Server\Data\RemoteAccessProfiles
    C:\Program Files\Windows Small Business Server\Bin\WebApp\RemoteAccess\Customization\Product\custom.xml

Log Location
   C:\ExchangeSetupLogs
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\ERRORLOG.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\DCPromo_###.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\ExtSchemaTask.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\GPOTask.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\FaxSPRouteSnapin.InstallLog
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\MoveDataPSsnapin.InstallLog
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\pop3connectorInstall
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\SBSSetup.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\FinishSetup.txt
   C:\Program Files\Windows Small Business Server\Logs \SBS\Logs\SBSHook.txt

RWW (Remote Web Workplace)
C:\Program Files\Windows Small Business Server\Logs\WebApp\RemoteAccess.log

SBS MIGRATION
Installation element        Notes
Binary Path                      %Program Files%\Windows SBS 7 Migration Preparation Tool\
Shortcut path                   Windows SBS 7 Migration Preparation Tool\
Log Path                           %Temp%\Migration Preparation Logs\
App name                        Windows SBS 7 Migration Preparation Tool

Migration answer key failure
    C:\Users\DonFunk\AppData\Local\Temp\Migration Preparation Logs\).

INTERNET ADDRESS MANAGEMENT WIZARD
    C\Program Files\Windows Small Business Server\Logs\DPCW.txt

Connect VPN wizard
    C:\Program Files\Windows Small Business Server\Logs\VPNCW.txt.

Trusted certificate
    C:\Program Files\Windows Small Business Server\Logs\TrustedCert.txt.

Fix My network wizard
    C:\Program Files\Windows Small Business Server\Logs\fncw.txt.

Cluster Logs
    %systemroot%\Cluster\cluster.log.

Active Directory
    %systemroot%\debug

This registry key has the location of the DIT file and AD LOG files.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Windows Installer
    Msiexec <misname> /l*v c:\testlog.log
        -OR-
    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
        Logging : voicewarmupx
        Debug"=dword:00000007
        v - Verbose output
        o - Out-of-disk-space messages
        i - Status messages
        c - Initial UI parameters
        e - All error messages
        w - Non-fatal warnings
        a - Start up of actions
        r - Action-specific records
        m - Out-of-memory or fatal exit information
        u - User requests
        p - Terminal properties
        + - Append to existing file
        ! - Flush each line to the log

Exchange
Diagnostic logging
2003
    1.  Open the Exchange System Manager
    2.  * Drill Down To Administrative Groups
    3.  * First Administrative Group
    4.  Servers
    5.  Find your Server e.g. Paris
    6.  Properties, Diagnostic Logging Tab
    7.  (None), Minimum, Medium, Maximum

    ESEUTIL – Place into Path statement.
    Program Files\Microsoft\Exchange Server\Bin
    Database
        D:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group\Mailbox Database.edb"
    Exporting the virtual directories.
        Exports are saved in Program Files\Microsoft\Exchange Server\V14 as a text file:
              <CASFQDN_<VDIR>_log.txt).

IIS Troubleshooting
Tools > Internet Options, choose the Advanced tab, and clear the Show friendly HTTP error messages

To see ASP errors add this to the web.config file

<system.web>
                         <customErrors mode=”Off” />
                      </system.web>

Select all Open in new window

Start>Run>inetmgr.exe -> selecting your website/application/virtual directory in the left-hand tree view, clicking on the “Error Pages” icon, clicking “Edit Feature Settings” action, and then selecting “Detailed Errors”.
OR...
Run in an elevated command line:

%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/yourapp" /section:httpErrors /errorMode:Detailed

Select all Open in new window

Return to normal when done:

%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/yourapp" /section:httpErrors /errorMode:DetailedLocalOnly

Select all Open in new window

Add the IIS tracing service:
    Server Manager, Roles, Web Server(IIS),  Add Role Services, check Web Server\Health and
    Diagnostics\Tracing (Then you can rt click under actions and click failed tracing)

Logs located in
   appcmd list site
... then ...
    %systemdrive%\inetpub\logs\FailedReqLogFiles\W3SVC<ID>

SQL LOGS
    Program Files\Microsoft SQL Server\MSSQL\Log

SCCM (System Center Configuration Manager)
    Windir%\System32\CCM\Logs
    %Windir%\SysWOW64\CCM\Logs.
    %ProgramFiles%\SMS_CCM\Logs

DDP FOR SCCM
** if you encounter problems, and you want assistance, please post the installation logs - you'll find them here:
    <SiteInstallDir>\AdminUI\XmlStorage\Extensions\bin\Deployment\Dell\PowerEdge\setup

SQL SERVER install log files
    C:\program files\microsoft SQL server\100\setup Bootstrap\log\date_random\summary_host_random.txt

WSUS (Windows Server Update Services)
    %windir%\Windowsupdate.log
How to read the log files:
    http://support.microsoft.com/kb/902093
For the server:
    C:\Program Files\Update Services\Logfiles
and the Application Event Log
For the client:
   C:\Windows\WindowsUpdate.log
    C:\Windows\SoftwareDistribution\ReportingEvents.log
and the Application Event Log

2008 Install logs

SETUP:
During installation, Shift-F10 will get you a command prompt. Plug and Play should be working, so you can copy any log files to a USB drive.

During the install, if the error happens:


Installing hotfixes, features or Windows updates:
cbs.log and (possibly) cbs.persist.log. These are limited to 50 Mb in size and are in:
    %Windir%\logs\CBS

An additional log for Windows updates is:
    %Windir%\windowsupdate.log

Two additional servicing logs are available in
    %windir%\winsxs\Poqexec.log
    %windir%\winsxs\pending.xml.bad

Sharepoint
Central Administration > Operations > Diagnostics Logging
Logs are at
    C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\LOGS

STSADM will spit logs here.
    %temp% logs
    C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Logs\Upgrade.log

SharePoint file location may need to edit – this is where the SharePoint lives
    C:\Program Filecommon files\microsoft shared\web server extensions\14\bin

Application Failures
%temp% logs

AD AND NETLOGON
Debug for net logon
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;109626

NT Replication service log Ntfrsapi.log
    %SystemRoot%\Debug folder
        Netlogon.log
        Netsetup.log
        DCPromo.log
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics
        0 is default logging and 5 is verbos

Mount the AD database
    http://technet.microsoft.com/en-us/library/cc753246(WS.10).aspx

SMTP logs
    C:\WINDOWS\system32\LogFiles\SMTPSVC1

SIM logs – For Altiris
    C:\Program Files\Dell\sysmgt\dmc\Notification Server\Logs\a.log
    C:\Documents and Settings\<Username>\Local Settings\Temp\SIM Logs\
    Program Files\Altiris\Symantec Installation Manager\Installs|Altiris\symantec.pl.xml.zip_tmp

VMWARE
List logs old then a day
cd /; find /vmfs/volumes/ -name vmware-*.log -mtime +1 -exec ls  {} \;
    http://www.vmwarewolf.com/which-esx-log-file/

WSUS (more info on...)
Log file location
    %WinDir%\WindowsUpdate.log
   
WSUS Client Diagnostic Tool direct download link:
    http://download.microsoft.com/download/9/7/6/976d1084-d2fd-45a1-8c27-a467c768d8ef/WSUS%20Client%20Diagnostic%20Tool.EXE

Run the following batch file on them to ensure there is no duplicate SID (WSUS SID is different than a machine SID)

%Windir%\system32\net.exe stop bits 
                      %Windir%\system32\net.exe stop wuauserv 
                      %Windir%\system32\net.exe stop cryptsvc 
                      del %WINDIR%\WindowsUpdate.log /S /Q  
                       
                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f
                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f
                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f
                      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v LastWaitTimeout /f
                      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v DetectionStartTime /f
                      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v NextDetectionTime /f 
                      
                      rd /s /q %windir%\softwareDistribution
                      %Windir%\system32\net.exe start cryptsvc
                      %Windir%\system32\net.exe start bits 
                      %Windir%\system32\net.exe start wuauserv 
                      
                      sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) 
                      
                      sc sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) 
                      wuauclt /resetauthorization /detectnow
                      wuauclt /reportnow 
                      exit /B 0  

Select all Open in new window

GPO (Group Policy Objects)
Location on the server

References

   Troubleshoot IIS7 errors like a pro
   
    How do I troubleshoot SharePoint?
   
    How To Check SMTP Logs in Windows Server    

    Which ESX log file