Log files created when you upgrade Windows 10 to a newer version

When Microsoft rolls an update for Windows 10, the upgrade process creates tons of log files in every step. These log files are useful for analysis if there is any Upgrade problem. While it may not find it easy to analyze, its a gold mine for IT admins. In this post, we will discuss the Log files that are created when you upgrade to a new version of Windows. We have also included when or in which phase these log files are created.

Log files created when you upgrade Windows 10

Log files created when you upgrade Windows 10

Here are some terminologies you would see in the list below:

  1. Down-Level: It is the first phase of the Upgrade process, and since this phase runs on the source OS, upgrade errors are not typically seen except in the log files. It also ensures that the Windows setup source and the destination drive are accessible.
  2. OOBE: Out of the box experience.
  3. Rollback: Its when the setup decides to go back to the initial stage.
  4. Dumps: Its an extremely useful file where all the debugging information is written when the computer stops unexpectedly because of a Stop error (also known as a “blue screen,” system crash, or bug check) or during a Windows Upgrade process.

Below is the list of log files, their location, why are they created, and when you should use these log files. While they are meant for IT admins, anyone who is interested can do their bit of analysis.

Log file Phase: Location Description When to use
setupact.log Down-Level:
List of set up actions to be taken during the downlevel phase. It contains all the down-level failures and starting point for rollback investigations. Without it, failures would be stuck forever.
$Windows.~BT\Sources\Panther\ UnattendGC
It contains the unattended setup experience and contains details about actions during the OOBE phase. Investigating rollbacks that failed during OOBE phase and operations . Error Code 0x4001C, 0x4001D, 0x4001E, 0x4001F.
It includes instructions for rollback. Investigating generic rollbacks – 0xC1900101.
Pre-initialization (prior to downlevel):
Contains information about initializing the setup. If the setup fails to launch.
Post-upgrade (after OOBE):
Instructions to follow during the installation. The log helps to investigate post-upgrade related issues.
setuperr.log Same as setupact.log Data about setup errors during the installation. Review all errors encountered during the installation phase.
miglog.xml Post-upgrade (after OOBE):
List of items migrated during the installation. Identify post upgrade data migration issues.
BlueBox.log Down-Level:
Information on what will be communicated between the setup.exe and Windows Update. Use during WSUS and WU down-level failures or for 0xC1900107.
Supplemental rollback logs:
Event logs (*.evtx)
$Windows.~BT\Sources\Rollback Additional logs collected during rollback. Setupmem.dmp: Created when there is an OS bug.
Setupapi: When Windows fails to install on the device – 0x30018
Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.

List of Log files are created when the upgrade is successful or failure

For every event, there is a log file generated. In fact, Log files are created even for an upgrade fails, and computer restarts for the second time or when there is a rollback. Here is the list:

Log files created when an upgrade is successful

  • C:\Windows\Panther\Setupact.log
  • C:\Windows\panther\setuperr.log
  • C:\Windows\inf\setupapi.app.log
  • C:\Windows\inf\setupapi.dev.log
  • C:\Windows\panther\PreGatherPnPList.log
  • C:\Windows\panther\PostApplyPnPList.log
  • C:\Windows\panther\miglog.xml

Log files created when an upgrade fails during installation before the computer restarts for the second time

  • C:\$Windows.~BT\Sources\panther\setupact.log
  • C:\$Windows.~BT\Sources\panther\miglog.xml
  • C:\Windows\setupapi.log
  • [Windows 10:] C:\Windows\Logs\MoSetup\BlueBox.log

Log files created when an upgrade fails during installation after the computer restarts for the second time

  • C:\Windows\panther\setupact.log
  • C:\Windows\panther\miglog.xml
  • C:\Windows\inf\setupapi.app.log
  • C:\Windows\inf\setupapi.dev.log
  • C:\Windows\panther\PreGatherPnPList.log
  • C:\Windows\panther\PostApplyPnPList.log
  • C:\Windows\memory.dmp

Log files created when an upgrade fails, and then you restore the desktop

  • C:\$Windows.~BT\Sources\panther\setupact.log
  • C:\$Windows.~BT\Sources\panther\miglog.xml
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.dev.log
  • C:\$Windows.~BT\sources\panther\setupapi\setupapi.app.log
  • C:\Windows\memory.dmp

The following log files are created when an upgrade fails, and the installation rollback is initiated:

  • C:\$Windows.~BT\Sources\Rollback\setupact.log
  • C:\$Windows.~BT\Sources\Rollback\setupact.err

Read more about them on Microsoft here and here.

We hope this post was informative enough to make you aware of the type of log files, memory dumps, location of those files which are not easy to find.

Posted by on , in Category Windows with Tags
Ashish is a veteran Windows, and Xbox user who excels in writing tips, tricks, and features on it to improve your day to day experience with your devices.