News

Windows 10 Fall Creators Update To Improve Log File Access

• By Kurt Mackie
• 10/11/2017

Microsoft will make it a little easier for IT pros and developers to read update log files for debugging purposes with the release of the Windows 10 "fall creators update" (version 1709).

In an announcement today, Microsoft explained that establishing a connection to the Microsoft Symbol Server won't be part of the process that's required to read Windows Update log files, starting with Windows 10 version 1709. However, users still will have to run the Get-WindowsUpdateLog PowerShell cmdlet to translate the Windows Update log from its binary format into readable text files.

IT pros and developers typically might want to read the Windows Update log in text-file format to debug application compatibility problems. In the past, these log files were issued in a readable text format for Windows, but Microsoft switched to an unreadable binary format with the release of Windows 10 back in 2015. Consequently, getting readable Windows 10 update text files became a two-step process, as was outlined in this 2015 Microsoft blog post.

That process required that users either connect online to the Microsoft Symbol Server to get the latest symbol files or they needed to download the latest Windows symbol files before running the Get-WindowsUpdateLog cmdlet. However, if the latest symbols weren't there at the Microsoft Symbol Server at the right time, then users would experience formatting problems in the transformed text files.

Microsoft's announcement explained that not having the newest symbols uploaded to the Microsoft Symbol Server "was usually a temporary situation" but that "it seems it would always happen when people had a need to format the log."

Symbol files can be identified by their .PDB extensions. They contain data not needed to run Windows binaries, although that data can be useful for debugging code. Symbol files contain information about various items, such as "global variables, local variables, function names and the addresses of the entry points, frame pointer omission (FPO) records and source-line numbers." Each item is considered to be a "symbol," according to this Microsoft document explanation.

The symbol files get housed in the Microsoft Symbol Server. Users typically get access to the server by pointing their debug tools, "such as WinDbg, NTSD or Visual Studio," to automatically search a path for the symbol files, Microsoft explained, in this article on Symbol Servers.

With Windows 10 version 1709, expected to arrive on Oct. 17, the Get-WindowsUpdateLog cmdlet will now work without requiring a network connection or the downloading of symbol files.

Microsoft had shifted to using the unreadable binary approach in the first place for technical reasons. Namely, the Windows Update client for Windows 10 "uses Event Tracing for Windows (ETW) to generate diagnostic logs." That approach "improves performance and reduces disk space," Microsoft explained, in this support article.