Using the Windows Server Solutions Log Collector

Applies To: Windows Home Server 2011, Windows Small Business Server 2011 Essentials, Windows Storage Server 2008 R2 Essentials

When you are troubleshooting computer issues, a representative from Microsoft Customer Service and Support may ask you to gather logs from servers, computers on the network, or both by using the Windows Server Solutions Log Collector.

The Log Collector copies program logs, event reviewer logs, and related environment information into a single zip file at a specified location. You can run the Log Collector tool directly from the server or any computer on the network, or by using a remote connection to the computers.

Note

The Log Collector does not analyze network issues or make changes to any server or computer on the network. For information about how to troubleshoot network issues, see the Help documentation for your server product.

Note

In this guide, the computers on your network, other than your server, are called “network computers.”

Perform the steps in the following topics to install and run the Log Collector:

  1. Installing the Windows Server Solutions Log Collector

  2. Running the Windows Server Solutions Log Collector

Environment information collected

For each network computer or server that you specify, the Log Collector gathers the following environment information and places it into the log collection file.

  • Operating system version

  • CPU manufacturer and description

  • Memory amount and allocation

  • Network adapters that are bound to TCP/IP

  • Locale

  • Processes

  • Storage configuration

  • Host file information

  • Event Logs including Application, System, Windows Server and Media Center

  • Service Control Manager messages

  • Reboot events and Windows Update events

  • System Errors and Application Errors

Services information collected

Server services

  • Windows Server Solutions Computer Backup Service

  • Windows Server Solutions Computer Backup Provider Service

  • Windows Server Solutions Devices Provider

  • Windows Server Domain Name Manager Provider

  • Windows Server Solutions Service Provider Registry

  • Windows Server Solutions Settings Provider

  • Windows Server Solutions UPnP Device Service

  • Windows Server Solutions Remote Access Administration Provider

  • Windows Server Solutions Health Service

  • Windows Server Storage Service

  • Windows Server SQM Service

Network computer services

  • Windows Server Solutions Computer Backup Provider Service

  • Windows Server Solutions Health Service

  • Windows Server Solution Service Provider Registry

  • Windows Server SQM Service

Logs and registry information collected

For each network computer or server specified, the Log Collector gathers log and registry information from the server and network computer as follows.

Server logs and registry information

  • Server product logs, from <ProgramData>\Microsoft\Windows Server\Logs

  • Scheduled tasks

  • Setup API logs

  • Windows Update logs

  • Health Alerts file

  • Devices Info file

  • Server Backup Log file

  • Panther Log file

  • Services

  • Registry keys, from

    • \\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\

    • \\HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\DevicesProviderSvc

    • \\HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\DomainManagerProviderSvc

Network computer logs and registry information

  • Network computer product logs at <ProgramData>\Microsoft\Windows Server\Logs

  • Health Alerts file at <ProgramData>\Microsoft\Windows Server\Data

  • Windows Update logs

  • Setup API logs

  • Scheduled tasks info

  • Registry keys from \\HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows Server\

Logs for computers that do not run a version of the Windows operating system

The Log Collector does not gather log files from computers that do not run a version of the Windows operating system. For non-Windows computers, manually copy the following log files to the same location where you are storing the Log Collector files.

  • System.log

  • Library/Logs/Windows Server.log

  • Library/Logs/CrashReporter/LaunchPad-<nnn> (copy all of the LaunchPad-<nnn>.crash files)

  • Library/Logs/DiagnosticReports/LaunchPad-<nnn> (copy all of the LaunchPad-<nnn>.crash files)