Windows 11 error logs: where to find them and how to read them

Published Sources checked By helps.wiki editorial team

Windows 11 keeps errors in several places: the event logs, the update and DISM logs, and crash dump files. Start with Event Viewer (System and Application), filter by Error level around the time of the problem, and use PowerShell for a faster or deeper look.

Applies to:Windows 11all builds
On this page

What it means

"Error log" is not one file in Windows. The system writes different kinds of problems to different places, so where to look depends on what went wrong: an app crash, a freeze, a restart, or a failed update.

The main places are the event logs (Application, System, Security and Setup), stored as .evtx files in %SystemRoot%\System32\Winevt\Logs\; the DISM log at %WINDIR%\Logs\Dism\dism.log; the Windows Update trace files, which need converting before you can read them; and .dmp crash dump files left after a blue screen. This page shows how to reach each one without getting lost in harmless warnings.

If you already have a specific update error code, the Windows 11 update error guide may get you to the answer faster.

Symptoms and causes

You are likely dealing with this problem if:

  • An app crashed, Windows froze or restarted, and you want to know why
  • An update or install failed and you need the log behind it
  • You looked for a Windows Update log file and cannot find a readable one
  • Event Viewer shows a lot of errors and you cannot tell which one matters

The usual causes, most common first:

There is no single log file
Errors are spread across the event logs, the update traces, the DISM log and dump files, so checking only one place often shows nothing useful.
WindowsUpdate.log is not written as plain text any more
Microsoft states that Windows Update no longer directly produces a WindowsUpdate.log file. It writes .etl trace files to C:\Windows\Logs\WindowsUpdate, which have to be converted before you can read them.
Event Viewer is noisy
Many Warning and Error events are harmless. Without a time and level filter, the one event that matches your problem is easy to miss.
Some logs need administrator rights
Microsoft's Get-WinEvent documentation warns that without admin rights you might see errors saying information about a log cannot be retrieved.

How to fix it

Work through these in order. They start with the quickest, safest checks and move to deeper repairs; stop as soon as the problem is gone.

1.Read the System and Application logs in Event Viewer

Easy

This is the main place Windows records crashes, service failures and driver problems. Filtering by level and time turns a huge list into a few events.

  1. Press WinS, type Event Viewer and open it.
  2. In the left pane, expand Windows Logs and select System for Windows, driver and hardware problems, or Application for app crashes.
  3. Right-click the log and choose Filter Current Log. Tick Critical and Error, and set Logged to a range that covers the time of the problem.
  4. Click an event to read its details in the pane below. Compare its time with when the failure actually happened, and ignore errors from other times.
  5. To reuse the same filter later, choose Create Custom View instead and save it.

2.Pull recent errors with PowerShell

Moderate

A single command shows only recent events, which is quicker than clicking through filters.

  1. Right-click Start, choose Terminal (Admin) and confirm the prompt. Admin rights avoid errors about logs that cannot be read.
  2. List System events from the last two days with Information events hidden, so what remains is Warning, Error and Critical. Add -MaxEvents 50 at the end to limit the output.
    PowerShellrun as administrator
    Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-2); SuppressHashFilter=@{Level=4}}
  3. For app crashes, use the Application log instead.
    PowerShellrun as administrator
    Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=(Get-Date).AddDays(-2); SuppressHashFilter=@{Level=4}}
  4. To see every log available on the PC, or to read a saved log file, use these.
    PowerShellrun as administrator
    Get-WinEvent -ListLog *
Get-WinEvent -Path 'C:\path\file.evtx'

3.Generate a readable Windows Update log

Moderate

Because the update log is stored as .etl traces, you need to convert it to text when an update or install fails.

  1. Open Terminal (Admin) and run the command. It writes WindowsUpdate.log to your Desktop by default. Microsoft's page for this command is written for Windows Server and does not name Windows 11, so if PowerShell does not recognise it on your PC, skip this fix.
    PowerShellrun as administrator
    Get-WindowsUpdateLog
  2. To choose where the file goes, add -LogPath with a file name. To also produce USO.log and UX.log in a folder on the Desktop, add -IncludeAllLogs.
    PowerShellrun as administrator
    Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log
  3. Open the resulting file in Notepad and search for error or failed near the time of the failed update. Temporary files are kept in $env:TEMP\WindowsUpdateLog.
  4. Match any error code you find with the site's guides, for example 0x80070643 or 0x80073712.

4.Check what a blue screen left behind

Advanced

After a blue-screen crash, the System log records the event and a .dmp dump file holds the details that explain the stop code.

  1. Dump files are only written if the crash dump setting allows it. To check, open Control Panel > System and Security > System, select Advanced system settings, and under Startup and Recovery select Settings. The Write Debugging Information list sets the kind of dump Windows creates.
  2. Small memory dumps are listed in the %SystemRoot%\Minidump folder (normally C:\Windows\Minidump), with names that contain the crash date. Other dump types depend on the setting above.
  3. In Event Viewer, open Windows Logs, then System, and look for events from the time of the crash, such as BugCheck or Kernel-Power.
  4. To analyse a dump file, install WinDbg using Microsoft's Install WinDbg page (direct installer, Microsoft Store or winget), then open the .dmp file from WinDbg's File menu.
  5. In the WinDbg command window, run the analysis command first. .bugcheck shows the bug check code.
    Text
    !analyze -v
.bugcheck

5.Look at the DISM log for repair failures

Moderate

Failures of DISM repair and servicing commands write to their own log rather than to Event Viewer.

  1. Open File Explorer and go to %WINDIR%\Logs\Dism\ (normally C:\Windows\Logs\Dism\), then open dism.log. This is DISM's default log location unless the command was run with /LogPath.
  2. When the log grows, DISM archives it as a .bak file and starts a new one, so check for dism.log.bak if the failure is not in the current file. If you need to send the log to someone for help, copy it instead of opening it in a small editor.

Check that it worked

  • You can open Event Viewer and see at least one System or Application event matching the time of the failure
  • Get-WindowsUpdateLog creates a readable WindowsUpdate.log on the Desktop
  • For a blue screen, WinDbg opens the dump file and shows a bug check code

If it still fails

  • If the log shows nothing near the failure time, check that the filter's time range includes it and that you opened both System and Application.
  • If the log is unreadable or access is denied, reopen Terminal or Event Viewer as administrator.
  • Take the exact event source, event ID and message text to Microsoft's support pages or the device manufacturer's support, and search for those rather than for a general description.
  • For repeated blue screens or update failures, see the site's Windows 11 update error guide and the guides for the specific code you found.

Questions

Are all the errors in Event Viewer a problem?

No. Many Error and Warning events are harmless and appear on healthy PCs. Only look at events that match the time of a real failure.

Should I use Get-EventLog instead?

No. Get-WinEvent is the current command. Get-EventLog is kept only for backward compatibility. Neither works in WinPE.

Sources

  1. Get-WinEvent (Microsoft.PowerShell.Diagnostics)Official · Microsoft Learn
  2. Get-WindowsUpdateLog (WindowsUpdate)Official · Microsoft Learn
  3. Analyze a Kernel-Mode Dump File by Using WinDbgOfficial · Microsoft Learn
  4. Install WinDbgOfficial · Microsoft Learn
  5. Enabling a Kernel-Mode Dump FileOfficial · Microsoft Learn
  6. Small Memory DumpOfficial · Microsoft Learn
  7. DISM Global Options for Command-Line SyntaxOfficial · Microsoft Learn

Browse