Log Files required troubleshooting the Window 7 installation

Lot of time we are unable to install the OS on fresh Computer, we do lot of tries but no luck and we don’t know what to do next, how to dig the issue, which/where to find the logs.

Here is the key to solve failures is identifying where you are in the installation process and when a failure occurs. As you are creating a new installation, the hard drive is not present initially, Windows Setup writes logs into memory, specifically in a Windows PE session (X:\Windows). When hard drive ready to use after formatting, Setup continues logging directly onto the new hard drive (C:\Windows). Whatever Log files created during the Windows PE session are temporary.

Windows Setup Scenario

When a failure occurs in Windows Setup, review the entries in the Setuperr.log file, then the Setupact.log file, and then other log files as appropriate.

Log file	Description	Location
Setupact.log	Primary log file for most errors that occur during the Windows installation process. There are several instances of the Setupact.log file, depending on what point in the installation process the failure occurs. It is important to know which version of the Setupact.log file to look at, based on the phase you are in.	Setup (specialize): X:\Windows\panther Setup (OOBE), LogonUI, OEM First Run:%windir%\panther Windows Welcome (OOBE): %windir%\panther\unattendGC
Setuperr.log	High-level list of errors that occurred during the specialize phase of Setup. The Setuperr.log file does not provide any specific details.	Setup (specialize): %windir%\panther Setup (specialize): %windir%\panther Setup (OOBE), LogonUI, OEM First Run: %windir%\panther
Setupapi.offline.log	Driver failures during the Component Specialization sub-phase of the Setup specialize phase.	%windir%\inf
Cbs_unattend.log	Unattended-setup servicing failures.	%windir%\panther
Setupapi.dev.log	Driver failures during the oobe phase of Setup.	%windir%\inf
Sessions.xml	An XML-based transaction log file that tracks all servicing activity, based on session id, client, status, tasks, and actions. If necessary, the Sessions.log file will point to the DISM.log and CBS.log files for more details.	%windir%\servicing\sessions
CBS.log	Servicing log file that provides more details about offline-servicing failures.	%windir%\Panther

OOBE - Out-of-box experience is the first impressions a user has with a product when opening its packaging and taking it into use. For software, it is "Welcome Screen" or "Initial Configuration" wizard screens that simplify elaborate set-up of the software

As an example, the process of installing Microsoft Windows is OOBE.  Whatever steps we do during installation comes in OOBE - to acknowledge software license terms, specify partition to install OS, "product key" etc.

Note: Information is gathered from Technet.

Page Fault

A page fault occurs when a process requests a page in memory but system can’t find it in memory. The system page fault handler attempts to resolve the page fault.

Type of Page Fault

• Hard Page Fault – If the requested Page retrieved from disk, the fault is called as hard page fault.

• Soft Page Fault - If the requested page found elsewhere in memory, the fault is called as soft page fault

*Most processors can handle large numbers of soft faults without significant consequence. However, hard faults can cause delays because they require disk access.

Given below counters can be used to identify the page faults.

Page Faults/sec - Page Faults/sec is a combination of hard page faults and soft page faults. This counter gives how many times page fault occurs. The Page must either be retrieved from another location in memory or from the pagefile.

Hard Page Fault Counter

·         Page Reads/sec – It indicates how often the system is reading the disk because of hard page faults. We can say, the number of pages reads from the disk that was done to satisfy page faults. The amount of pages read each time the system went to the disk may vary but a sustained value of over 5 is a strong indicator of a memory problem. We can say, counter is best indicator of a memory shortage.

·         Pages Input/sec - pages were read from disk to resolve hard page faults. We can use this counter in comparison with the Page Faults/sec counter to determine the percentage of the page faults that are hard page faults.

·         Pages/sec - pages were read from or written to disk to resolve hard page faults.

In short we can say, a high number of hard page faults may indicate that you need to increase the amount of memory or reduce the cache size on the server.

Soft Page Fault Counter

• Transition Faults/sec - page faults were resolved by recovering pages without additional disk activity, including pages that were being used by another process sharing the page.