SCCM Logs and Quick Tips to Read Logs

5
SCCM Logs Troubleshooting Home

In this post, you will know more about SCCM logs. SCCM logs are essential to troubleshoot an issue and fix those. SCCM 1806 and later version of SCCM clients are installed with built-in log reader tool CMTrace.exe. But there are newer or new SCCM Logs reading tools with latest versions of SCCM.

SCCM Logs details are given at the last section of this post. Both the server and client side of SCCM logs file details are explained in this post.

SCCM Logs – Viewing Tools

When I started SCCM (SMS) admin job, SCCM logs reading tool was Trace32.exe. With SCCM 2012 and CB, the default SCCM logs reading tool CMTrace.exe became integrated with products itself. You don’t have to download it separately. 

  • Trace32.exe (SMS/SCCM 2007)
  • CMTrace.exe (SCCM 2012 & CB)
  • CMLogViewer.exe (SCCM CB)

What is SCCM Support Center New Log Viewer?

Microsoft released a new in-build tool to support SCCM troubleshooting, and this is called Support Center tool. I have explained this tool in details in the following post. https://www.anoopcnair.com/sccm-troubleshooting-tool-support-center/

The Support Center comes with an SCCM logs viewing tool called CMLogViewer.log. This Support center log viewer is not an independent tool which can’t be run with just CMLogViewer.exe.

To run CMLogViewer.exe, you need supporting files to work properly. You can see more details about the supported files of CMLogViewer.exe tool in this post.

How to Use Support Center Log Viewer?

The Support Center Log Viewer can be used to check the log files from the SCCM logs from server and client side. Make sure; you have all the supporting files for CMLogViewer.exe.

  • Double click on CMLogViewer.exe file
  • Click on Open Logs button and select any of the following options to start SCCM client troubleshooting
    • Open Logs
    • Open logs in the current view
    • Open logs in a new window
  • Click Close and Clear logs button and select any of the following options to clear the multiple windows of log files
    • Close and Clear logs
    • Clear all entries
    • Close all logs
  • Click and select any of the following from Search Options Support center log viewer:
    • Find
    • Find next
    • Find Previous
  • Click and select any of the following from Options Support center log viewer:
    • Live updating
    • Auto-scroll
    • Show Details
    • Quick Filter
    • Wrap log text
    • Raw Log entry display
    • Advanced filters
    • Error code link
  • Click and select any of the following from Tasks Support center log viewer:
    • Error lookup
    • Decode Certificate

SCCM Logs – Troubleshooting

In this section, you will see the client side and server side SCCM logs.

Client Side – SCCM Logs

Log nameDescription
CAS.logThe Content Access service. Maintains the local package cache on the client.
Ccm32BitLauncher.logRecords actions for starting applications on the client marked run as 32 bit.
CcmEval.logRecords SCCM client status evaluation activities and details for components that are required by the SCCM client.
CcmEvalTask.logRecords the SCCM client status evaluation activities that are initiated by the evaluation scheduled task.
CcmExec.logRecords activities of the client and the SMS Agent Host service. This log file also includes information about enabling and disabling wake-up proxy.
CcmMessaging.logRecords activities related to communication between the client and management points.
CCMNotificationAgent.logRecords activities related to client notification operations.
Ccmperf.logRecords activities related to the maintenance and capture of data related to client performance counters.
CcmRestart.logRecords client service restart activity.
CCMSDKProvider.logRecords activities for the client SDK interfaces.
CertificateMaintenance.logMaintains certificates for Active Directory Domain Services and management points.
CIDownloader.logRecords details about configuration item definition downloads.
CITaskMgr.logRecords tasks that are initiated for each application and deployment type, such as content download and install or uninstall actions.
ClientAuth.logRecords signing and authentication activity for the client.
ClientIDManagerStartup.logCreates and maintains the client GUID and identifies tasks performed during client registration and assignment.
ClientLocation.logRecords tasks that are related to client site assignment.
CMHttpsReadiness.logRecords the results of running the SCCM HTTPS Readiness Assessment Tool. This tool checks whether computers have a public key infrastructure (PKI) client authentication certificate that can be used with SCCM.
CmRcService.logRecords information for the remote control service.
ContentTransferManager.logSchedules the Background Intelligent Transfer Service (BITS) or Server Message Block (SMB) to download or access packages.
DataTransferService.logRecords all BITS communication for policy or package access.
EndpointProtectionAgentRecords information about the installation of the System Center Endpoint Protection client and the application of antimalware policy to that client.
execmgr.logRecords details about packages and task sequences that run on the client.
ExpressionSolver.logRecords details about enhanced detection methods that are used when verbose or debug logging is turned on.
ExternalEventAgent.logRecords the history of Endpoint Protection malware detection and events related to client status.
FileBITS.logRecords all SMB package access tasks.
FileSystemFile.logRecords the activity of the Windows Management Instrumentation (WMI) provider for software inventory and file collection.
FSPStateMessage.logRecords the activity for state messages that are sent to the fallback status point by the client.
InternetProxy.logRecords the network proxy configuration and use activity for the client.
InventoryAgent.logRecords activities of hardware inventory, software inventory, and heartbeat discovery actions on the client.
LocationCache.logRecords the activity for location cache use and maintenance for the client.
LocationServices.logRecords the client activity for locating management points, software update points, and distribution points.
MaintenanceCoordinator.logRecords the activity for general maintenance tasks for the client.
Mifprovider.logRecords the activity of the WMI provider for Management Information Format (MIF) files.
mtrmgr.logMonitors all software metering processes.
PolicyAgent.logRecords requests for policies made by using the Data Transfer Service.
PolicyAgentProvider.logRecords policy changes.
PolicyEvaluator.logRecords details about the evaluation of policies on client computers, including policies from software updates.
PolicyPlatformClient.logRecords the process of remediation and compliance for all providers located in \Program Files\Microsoft Policy Platform, except the file provider.
PolicySdk.logRecords activities for policy system SDK interfaces.
Pwrmgmt.logRecords information about enabling or disabling and configuring the wake-up proxy client settings.
PwrProvider.logRecords the activities of the power management provider (PWRInvProvider) hosted in the WMI service. On all supported versions of Windows, the provider enumerates the current settings on computers during hardware inventory and applies power plan settings.
SCClient_<domain>@<username>_1.logRecords the activity in Software Center for the specified user on the client computer.
SCClient_<domain>@<username>_2.logRecords the historical activity in Software Center for the specified user on the client computer.
Scheduler.logRecords activities of scheduled tasks for all client operations.
SCNotify_<domain>@<username>_1.logRecords the activity for notifying users about software for the specified user.
SCNotify_<domain>@<username>_1-<date_time>.logRecords the historical information for notifying users about software for the specified user.
setuppolicyevaluator.logRecords configuration and inventory policy creation in WMI.
SleepAgent_<domain>@SYSTEM_0.logThe main log file for wake-up proxy.
smscliui.logRecords use of the SCCM client in Control Panel.
SrcUpdateMgr.logRecords activity for installed Windows Installer applications that are updated with current distribution point source locations.
StatusAgent.logRecords status messages that are created by the client components.
SWMTRReportGen.logGenerates a use data report that is collected by the metering agent. This data is logged in Mtrmgr.log.
UserAffinity.logRecords details about user device affinity.
VirtualApp.logRecords information specific to the evaluation of Application Virtualization (App-V) deployment types.
Wedmtrace.logRecords operations related to write filters on Windows Embedded clients.
wakeprxy-install.logRecords installation information when clients receive the client setting option to turn on wake-up proxy.
wakeprxy-uninstall.logRecords information about uninstalling wake-up proxy when clients receive the client setting option to turn off wake-up proxy, if wake-up proxy was previously turned on.
ccmsetup.logRecords ccmsetup.exe tasks for client setup, client upgrade, and client removal. Can be used to troubleshoot client installation problems.
ccmsetup-ccmeval.logRecords ccmsetup.exe tasks for client status and remediation.
CcmRepair.logRecords the repair activities of the client agent.
client.msi.logRecords setup tasks performed by client.msi. Can be used to troubleshoot client installation or removal problems.

Server Side – SCCM Logs

SCCM LogsDescription
adctrl.logRecords enrollment processing activity.
ADForestDisc.logRecords Active Directory Forest Discovery actions.
ADService.logRecords account creation and security group details in Active Directory.
adsgdis.logRecords Active Directory Group Discovery actions.
adsysdis.logRecords Active Directory System Discovery actions.
adusrdis.logRecords Active Directory User Discovery actions.
ccm.logRecords client push installation activities.
CertMgr.logRecords certificate activities for intrasite communication.
chmgr.logRecords activities of the client health manager.
Cidm.logRecords changes to the client settings by the Client Install Data Manager (CIDM).
colleval.logRecords details about when collections are created, changed, and deleted by the Collection Evaluator.
compmon.logRecords the status of component threads monitored for the site server.
compsumm.logRecords Component Status Summarizer tasks.
ComRegSetup.logRecords the initial installation of COM registration results for a site server.
dataldr.logRecords information about the processing of MIF files and hardware inventory in the SCCM database.
ddm.logRecords activities of the discovery data manager.
despool.logRecords incoming site-to-site communication transfers.
distmgr.logRecords details about package creation, compression, delta replication, and information updates.
EPCtrlMgr.logRecords information about the syncing of malware threat information from the Endpoint Protection site system role server with the SCCM database.
EPMgr.logRecords the status of the Endpoint Protection site system role.
EPSetup.logProvides information about the installation of the Endpoint Protection site system role.
EnrollSrv.logRecords activities of the enrollment service process.
EnrollWeb.logRecords activities of the enrollment website process.
fspmgr.logRecords activities of the fallback status point site system role.
hman.logRecords information about site configuration changes, and about the publishing of site information in Active Directory Domain Services.
Inboxast.logRecords the files that are moved from the management point to the corresponding INBOXES folder on the site server.
inboxmgr.logRecords file transfer activities between inbox folders.
inboxmon.logRecords the processing of inbox files and performance counter updates.
invproc.logRecords the forwarding of MIF files from a secondary site to its parent site.
migmctrl.logRecords information for Migration actions that involve migration jobs, shared distribution points, and distribution point upgrades.
mpcontrol.logRecords the registration of the management point with Windows Internet Name Service (WINS). Records the availability of the management point every 10 minutes.
mpfdm.logRecords the actions of the management point component that moves client files to the corresponding INBOXES folder on the site server.
mpMSI.logRecords details about the management point installation.
MPSetup.logRecords the management point installation wrapper process.
netdisc.logRecords Network Discovery actions.
NotiCtrl.logApplication request notifications.
ntsvrdis.logRecords the discovery activity of site system servers.
ObjreplmgrRecords the processing of object change notifications for replication.
offermgr.logRecords advertisement updates.
offersum.logRecords the summarization of deployment status messages.
OfflineServicingMgr.logRecords the activities of applying updates to operating system image files.
outboxmon.logRecords the processing of outbox files and performance counter updates.
PerfSetup.logRecords the results of the installation of performance counters.
PkgXferMgr.logRecords the actions of the SMS_Executive component that is responsible for sending content from a primary site to a remote distribution point.
policypv.logRecords updates to the client policies to reflect changes to client settings or deployments.
rcmctrl.logRecords the activities of database replication between sites in the hierarchy.
replmgr.logRecords the replication of files between the site server components and the Scheduler component.
ResourceExplorer.logRecords errors, warnings, and information about running Resource Explorer.
ruleengine.logRecords details about automatic deployment rules for the identification, content download, and software update group and deployment creation.
schedule.logRecords details about site-to-site job and file replication.
sender.logRecords the files that transfer by file-based replication between sites.
sinvproc.logRecords information about the processing of software inventory data to the site database.
sitecomp.logRecords details about the maintenance of the installed site components on all site system servers in the site.
sitectrl.logRecords site setting changes made to site control objects in the database.
sitestat.logRecords the availability and disk space monitoring process of all site systems.
SMS_ISVUPDATES_SYNCAGENT.logLog file for synchronization of third-party software updates starting in SCCM version 1806.
SMS_PhasedDeployment.logLog file for phased deployments
SmsAdminUI.logRecords SCCM console activity.
SMSAWEBSVCSetup.logRecords the installation activities of the Application Catalog web service.
smsbkup.logRecords output from the site backup process.
smsdbmon.logRecords database changes.
SMSENROLLSRVSetup.logRecords the installation activities of the enrollment web service.
SMSENROLLWEBSetup.logRecords the installation activities of the enrollment website.
smsexec.logRecords the processing of all site server component threads.
SMSFSPSetup.logRecords messages generated by the installation of a fallback status point.
SMSPORTALWEBSetup.logRecords the installation activities of the Application Catalog website.
SMSProv.logRecords WMI provider access to the site database.
srsrpMSI.logRecords detailed results of the reporting point installation process from the MSI output.
srsrpsetup.logRecords results of the reporting point installation process.
statesys.logRecords the processing of state system messages.
statmgr.logRecords the writing of all status messages to the database.
swmproc.logRecords the processing of metering files and settings.
ConfigMgrPrereq.logRecords prerequisite component evaluation and installation activities.
ConfigMgrSetup.logRecords detailed output from the site server setup.
ConfigMgrSetupWizard.logRecords information related to activity in the Setup Wizard.
SMS_BOOTSTRAP.logRecords information about the progress of launching the secondary site installation process. Details of the actual setup process are contained in ConfigMgrSetup.log.
smstsvc.logRecords information about the installation, use, and removal of a Windows service that is used to test network connectivity and permissions between servers, using the computer account of the server that initiates the connection.
DWSSMSI.logRecords messages generated by the installation of a data warehouse service point.
DWSSSetup.logRecords messages generated by the installation of a data warehouse service point.
Microsoft.ConfigMgrDataWarehouse.logRecords information about data synchronization between the site database and the data warehouse database.
FspIsapiRecords details about communications to the fallback status point from mobile device legacy clients and client computers.
fspMSI.logRecords messages generated by the installation of a fallback status point.
fspmgr.logRecords activities of the fallback status point site system role.
CcmIsapi.logRecords client messaging activity on the endpoint.
MP_CliReg.logRecords the client registration activity processed by the management point.
MP_Ddr.logRecords the conversion of XML.ddr records from clients, and then copies them to the site server.
MP_Framework.logRecords the activities of the core management point and client framework components.
MP_GetAuth.logRecords client authorization activity.
MP_GetPolicy.logRecords policy request activity from client computers.
MP_Hinv.logRecords details about the conversion of XML hardware inventory records from clients and the copy of those files to the site server.
MP_Location.logRecords location request and reply activity from clients.
MP_OOBMgr.logRecords the management point activities related to receiving an OTP from a client.
MP_Policy.logRecords policy communication.
MP_Relay.logRecords the transfer of files that are collected from the client.
MP_Retry.logRecords hardware inventory retry processes.
MP_Sinv.logRecords details about the conversion of XML software inventory records from clients and the copy of those files to the site server.
MP_SinvCollFile.logRecords details about file collection.
MP_Status.logRecords details about the conversion of XML.svf status message files from clients and the copy of those files to the site server.
mpcontrol.logRecords the registration of the management point with WINS. Records the availability of the management point every 10 minutes.
mpfdm.logRecords the actions of the management point component that moves client files to the corresponding INBOXES folder on the site server.
mpMSI.logRecords details about the management point installation.
MPSetup.logRecords the management point installation wrapper process.
objreplmgr.logRecords details about the replication of software updates notification files from a parent site to child sites.
PatchDownloader.logRecords details about the process of downloading software updates from the update source to the download destination on the site server.
ruleengine.logRecords details about automatic deployment rules for the identification, content download, and software update group and deployment creation.
SMS_ISVUPDATES_SYNCAGENT.logLog file for synchronization of third-party software updates starting in SCCM version 1806.
SUPSetup.logRecords details about the software update point installation. When the software update point installation completes, Installation was successful is written to this log file.
WCM.logRecords details about the software update point configuration and connections to the WSUS server for subscribed update categories, classifications, and languages.
WSUSCtrl.logRecords details about the configuration, database connectivity, and health of the WSUS server for the site.
wsyncmgr.logRecords details about the software updates sync process.
WUSSyncXML.logRecords details about the Inventory Tool for the Microsoft Updates sync process.
AppIntentEval.logRecords details about the current and intended state of applications, their applicability, whether requirements were met, deployment types, and dependencies.
AppDiscovery.logRecords details about the discovery or detection of applications on client computers.
AppEnforce.logRecords details about enforcement actions (install and uninstall) taken for applications on the client.
awebsctl.logRecords monitoring activities for the Application Catalog web service point site system role.
awebsvcMSI.logRecords detailed installation information for the Application Catalog web service point site system role.
Ccmsdkprovider.logRecords the activities of the application management SDK.
colleval.logRecords details about when collections are created, changed, and deleted by the Collection Evaluator.
ConfigMgrSoftwareCatalog.logRecords the activity of the Application Catalog, which includes its use of Silverlight.
NotiCtrl.logApplication request notifications.
portlctl.logRecords the monitoring activities for the Application Catalog website point site system role.
portlwebMSI.logRecords the MSI installation activity for the Application Catalog website role.
PrestageContent.logRecords details about the use of the ExtractContent.exe tool on a remote, prestaged distribution point. This tool extracts content that has been exported to a file.
ServicePortalWebService.logRecords the activity of the Application Catalog web service.
ServicePortalWebSite.logRecords the activity of the Application Catalog website.
SMSdpmon.logRecords details about the distribution point health monitoring scheduled task that is configured on a distribution point.
SoftwareCatalogUpdateEndpoint.logRecords activities for managing the URL for the Application Catalog shown in Software Center.
SoftwareCenterSystemTasks.logRecords activities related to Software Center prerequisite component validation.
colleval.logRecords details about when collections are created, changed, and deleted by the Collection Evaluator.
execmgr.logRecords details about packages and task sequences that run.
AssetAdvisor.logRecords the activities of Asset Intelligence inventory actions.
aikbmgr.logRecords details about the processing of XML files from the inbox for updating the Asset Intelligence catalog.
AIUpdateSvc.logRecords the interaction of the Asset Intelligence sync point with System Center Online (SCO), the online web service.
AIUSMSI.logRecords details about the installation of the Asset Intelligence sync point site system role.
AIUSSetup.logRecords details about the installation of the Asset Intelligence sync point site system role.
ManagedProvider.logRecords details about discovering software with an associated software identification tag. Also records activities related to hardware inventory.
MVLSImport.logRecords details about the processing of imported licensing files.
ConfigMgrSetup.logRecords information about setup and recovery tasks when SCCM recovers a site from backup.
Smsbkup.logRecords details about the site backup activity.
smssqlbkup.logRecords output from the site database backup process when SQL Server is installed on a server that is not the site server.
Smswriter.logRecords information about the state of the SCCM VSS writer that is used by the backup process.
Crp.logRecords enrollment activities.
Crpctrl.logRecords the operational health of the certificate registration point.
Crpsetup.logRecords details about the installation and configuration of the certificate registration point.
Crpmsi.logRecords details about the installation and configuration of the certificate registration point.
NDESPlugin.logRecords challenge verification and certificate enrollment activities.

Resources

5 COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.