This topic provides an overview of the log files that are generated when you use the Cluster-Aware Updating (CAU) feature in Windows Server 2012. The log files contain information that is mainly intended for use by developers and Microsoft Support engineers. However, in some cases you might want to look at one or more logs to help troubleshoot a problem that you encounter when using CAU.
As a convenience, you can run the Save-CauDebugTrace Windows PowerShell cmdlet to package the CAU log files as a zip file. For example, you might need to gather the logs if you contact Microsoft Support for assistance.
The following table summarizes CAU-related log files that are generated on the CAU Update Coordinator computer or the failover cluster nodes. Some log files are generated automatically when you use CAU to apply updates or perform related actions; to generate others, you must perform additional steps. The table also indicates conditions when the log files are included in the package that is generated when you run the Save-CauDebugTrace Windows PowerShell cmdlet. For details about running Save-CauDebugTrace, see Run Save-CAUDebugTrace later in this topic.
CAU debug logs
Information about CAU-related actions such as scanning, download, and installation of updates using Windows PowerShell on a local or remote Update Coordinator
On each Update Coordinator computer, in the User's Profile: %localappdata%\Temp\CAU\debugTrace_ *.etl
If multiple CAU processes are running, separate trace files for each process are generated—for example, debugTrace_01.etl, debugTrace_02.etl, and so on.
Event Trace Log (.etl)
netsh trace convert <EtlFileName> dump=TXT
None. A new .etl file is created automatically for each CAU Windows PowerShell session that runs on a CAU Update Coordinator.
Run on an Update Coordinator
CAU UI tracing logs
Information about actions performed using the CAU UI on a local or remote Update Coordinator
On each Update Coordinator: %localappdata%\temp\ClusterUpdateUI.log (by default).
If multiple CAU UI instances are running, each additional instance creates a new UI log file with a unique identifier prepended to the default name—for example, 8c1cc20b-8697-47df-ad21-19b058211c26ClusterUpdateUI.log.
Text
None. A UI tracing log is automatically created or appended when you start the CAU UI on a CAU Update Coordinator.
The location, trace level, and other properties of the UI tracing log can be optionally customized by modifying the file %systemroot%\Cluster\ClusterUpdateUI.exe.config.
CAU WMI provider logs
Information about the CAU WMI provider that is installed on each cluster node to coordinate updates by CAU
On each cluster node: %systemroot%\system32\LogFiles\ClusterUpdate\CauWmi*.log
None. A CAU WMI provider log is generated automatically on each node for each Updating Run.
Run on a cluster node, or run on a remote Update Coordinator and specify the ClusterName parameter
Failover Clustering log files
Configurable level of detail about the normal activities and problems in the failover cluster. This information is not specific to CAU, but may contain related troubleshooting information about the cluster state.
When generated, on each cluster node: %windir%\cluster\reports\cluster.log (by default)
Set-ClusterLog -size 100 -level 5
2. Use CAU or Failover Clustering tools to apply updates or perform a task that causes the problem that you want to troubleshoot.
Get-ClusterLog -timespan 5
Windows Update Agent log files
Information about when the Windows Update Agent connects to a Microsoft software update source to download or install an update
On each cluster node: %windir%\Windowsupdate.log
None. All Microsoft software update transactions are logged automatically on each cluster node.
You can optionally enable verbose logging. For more information, see article 902093 at the Microsoft Support site.
You can run the Save-CauDebugTrace Windows PowerShell cmdlet on an Update Coordinator computer or on a cluster node to save the CAU log files to a zip file. The files are packaged in a defined structure. Different log files are packaged, depending on the location where you run the cmdlet and the cmdlet parameters that you specify. See the table in CAU log files earlier in this topic.
When running Save-CauDebugTrace, be aware of the following:
Windows PowerShell commands
The following example runs Save-CauDebugTrace on an Update Coordinator computer to package the local CAU debug and UI tracing logs in the file C:\temp\CAUTrace.zip.
Save-CauDebugTrace -FilePath C:\temp\CAUTrace.zip
The following example runs Save-CauDebugTrace on an Update Coordinator computer to package the local CAU debug and UI tracing logs, plus the available CAU-related logs on the nodes in cluster CONTOSO-FC1, in the file C:\temp\CAUTrace.zip on the local computer.
Save-CauDebugTrace –ClusterName CONTOSO-FC1 -FilePath C:\temp\CAUTrace.zip
The following example runs Save-CauDebugTrace on a cluster node to package the local CAU debug and UI tracing logs, plus the available CAU-related logs on the failover cluster nodes, in the file C:\temp\CAUTrace.zip on the local computer.
The zip file that is the output of Save-CauDebugTrace contains log files in a structure similar to the following. Depending on your CAU scenario, the zip file might contain more or fewer files. In the following example, Save-CauDebugTrace was run on a node in a two-node failover cluster consisting of nodes named ContosoNode1 and ContosoNode2. The wildcard character (*) is used here to indicate one or more files.
<!--Root of zip file--> *ClusterUpdateUI.log <!--CAU UI tracing logs--> SaveCauDebugTrace.etl <!--Tracing log for the Save-CauDebugTrace process--> ContosoNode1\ <!--Folder containing logs from node ContosoNode1--> debugTrace_ *.etl <!--CAU debug tracing logs--> WUA WindowsUpdate.log <!--Windows Update Agent log--> WMI CauWMI*.log <!--CAU WMI provider logs--> Cluster ContosoNode1_cluster.log <!--Failover cluster log--> ContosoNode2\ <!--Folder containing logs from node ContosoNode2--> debugTrace_ *.etl <!--CAU debug tracing logs--> WUA WindowsUpdate.log <!--Windows Update Agent log--> WMI CauWMI*.log <!--CAU WMI provider logs--> Cluster ContosoNode2_cluster.log <!--Failover cluster log-->
The following table lists CAU- and Failover Clustering-related event logging channels. You can use these to view CAU-related events using Event Viewer on a remote CAU Update Coordinator computer or on a failover cluster node.
You can also use Failover Cluster Manager to view recent events for all of the nodes in a cluster, or the critical events for a specific clustered role or resource.
ClusterAwareUpdating-Admin
On each cluster node: Applications and Services Logs\Microsoft\Windows\
Yes
CAU administrative events related to:
ClusterAwareUpdating-Debug
No
CAU debugging events related to scanning, download, and installation of updates; CAU reporting; Updating Run coordination.
ClusterAwareUpdating-Management-Admin
On each CAU Update Coordinator: Applications and Services Logs\Microsoft\Windows\
CAU administrative events related to cross-cluster orchestration related to:
System
On each cluster node: Windows Logs\
Includes Failover Clustering events that are of type Critical, Error, or Warning
FailoverClustering-Diagnostic
Circular log that runs anytime the Cluster service starts. Events can be read in the Event Viewer if logging is disabled. They can also be converted to text file format. The primary way to generate the cluster log is to use the Get-ClusterLog Windows PowerShell cmdlet.
FailoverClustering-Operational
A On each cluster node: Applications and Services Logs\Microsoft\Windows\
Informational cluster events
FailoverClustering-Performance-CSV
Events related to Cluster Shared Volumes
FailoverClustering-Client-Diagnostic
Trace logging for the Cluster API. This can help troubleshoot the Create Cluster and Add Node cluster actions.
FailoverClustering-CsvFlt-Diagnostic
Trace logging for the CSV Proxy File System Driver (CsvFs.sys) which is mounted on all nodes in the cluster. This can provide information regarding direct I/O operations
FailoverClustering-Manager-Admin
Errors associated with dialog boxes and pop-up warnings that are displayed in Failover Cluster Manager
FailoverClustering-Manager-Diagnostic
Trace logging for Failover Cluster Manager
FailoverClustering-WMIProvider-Admin
Events associated with the Failover Clustering WMI provider
FailoverClustering-WMIProvider-Diagnostic
Trace logging for the Failover Clustering WMI provider. This can help you troubleshoot WMI scripts or some System Center applications.
Dan Lepow [MSFT] edited Revision 5. Comment: Corrected PowerShell commands
Dan Lepow [MSFT] edited Revision 3. Comment: Removed [toc] tag - didn't work as expected
Dan Lepow [MSFT] edited Revision 2. Comment: More table formatting
Dan Lepow [MSFT] edited Revision 1. Comment: More table formatting
Dan Lepow [MSFT] edited Original. Comment: Added [toc] tag, fixed table formatting