General discussion

Where are XP's logs?

Apr 13, 2009 10:23AM PDT

I recently ran a scandisk from XP, you know the diskcheck that requires a restart, problem is that when it finishes it doesn't give you time to read the results. Is there a log created somewhere I can read?

Discussion is locked

Reply to: Where are XP's logs?
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: Where are XP's logs?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
- Collapse -
You can see the chkdsk results ...
Apr 13, 2009 11:06AM PDT

by opening your Event Viewer Application log.

When chkdsk runs at boot time or from the recovery console, it creates c:\bootex.log. You will only see this file if boot-time chkdsk is interrupted or you are using the recovery console. When Windows next boots it copies any c:\bootex.log to an entry in the Application* Event log, helpfully titled "WINLOGON".

- Collapse -
They are not logs
Apr 13, 2009 11:16AM PDT

I searched my system for WINLOGON and got 3 results all applications. I daren't execute these apps. because they are in system32 and I don't know what I could affect. So I still have no log for chkdisc results.
One curious thing. The dates the WINLOGON files were created is reported as 14/4/2008. Yes 2008, I didn't mistype and my computer clock and date are correct. I formatted 2 weeks ago, where did this date come from?
Thanks again.

- Collapse -
Where did I tell you to "search your system"? ...
Apr 14, 2009 1:50AM PDT

I said to use your Event Viewer to view the Application log where you will find Winlogon which contains the contents of the log of the chkdsk preformed.

Since you appear to need a guide here is a handy, dandy link to How to view and manage event logs in Event Viewer in Windows XP

You are welcome.

- Collapse -
Perhaps everything about Chkdsk you need to know
Apr 14, 2009 12:09AM PDT

1. Chkdsk.exe is the command-line interface which verifies the logical integrity of a file system, [Q314835].

? When running CHKDSK and logical inconsistencies are encountered in file system data, it performs repair actions (assuming that the data is not in read-only mode).

? When running it online, the code that actually performs the verification resides in utility DLLs (Untfs.dll and Ufat.dll). The verification routines that it invokes are the same routines that run when a volume is verified through the Windows Explorer or the Disk Management Graphical User Interface.

a. If an error is encountered which causes a system to shutdown prematurely, CHKDSK is scheduled during the next boot and calls Autochk.exe which is run early in the startup sequence, runs without the benefit of virtual memory use, and is run when CHKDSK is used on the boot volume. CHKDSK cannot dismount the boot volume so it offers the option to run the repair process by using Autochk when the computer is restarted, [Q831426].

b. Chkdsk requires Autochk. Chkdsk automatically looks for Autochk.exe in the startup folder. If Chkdsk cannot find the file in the startup folder it looks for the Windows media CD-ROM. If Chkdsk cannot find the installation CD-ROM, Chkdsk prompts the user for the location of Autochk.exe, [Q307654]. Also note, CHKDSK can be initiated using the Recovery Console.

c. When Autochk runs against a volume at boot time it records its output to a file called Bootex.log in the root of the volume being checked. The Winlogon service then moves the contents of each Bootex.log file to the Application Event log. One event log message for each volume checked is recorded as follows:

Event ID: 1001
Source: Winlogon
Description: This includes file system type; drive letter or GUID, and volume name or serial number to help determine what volume Chkdsk ran against. Also included is whether Chkdsk ran because a user scheduled it or because the dirty bit was set.

? Chkdsk without parameters - it runs in read-only mode, examines a disk, and then reports whether it found any file system errors but does not repair anything.

? Chkdsk with parameters - parameters /f or /r errors are repairs relating to the file system structure.

d. How to View Event Details To view the details of an event, follow these steps:

[1] Click Start,Control Panel and click Performance and Maintenance. Click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in eventvwr.msc using Start, Run.

[2] In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.

[3]In the details pane, double-click the event that you want to view.

? The Event Properties dialog box containing header information and a description of the event is displayed.

? To copy the details of the event, click the Copy button, then open a new document in the program in which you want to paste the event (for example, Microsoft Word), and then click Paste on the Edit menu.

e. In addition to using the command-line version of CHKDSK, it can be run from My Computer/Explorer but the graphical version offers the read-only mode equivalent where CHKDSK will run to completion only if no significant corruption exist and no correction is made, [Q315265]. And for your information and for what it is worth, be aware of the contents of this article even though it does not mention WinXP, "Err Msg: CHKDSK Detected Minor Inconsistencies on the Drive... (Q109524)."

f. Supplemental reading:

(1) "Chkdsk Runs Each Time That You Start Computer After Upgrade to Windows XP (Q316506)."

Note: In addition to these instructions the same type of anomaly may occur should the Bootex.log file becomes corrupted - the file Autochk records its output in the root of the volume being checked and which the Winlogon service then moves to the Application Event log. Use the [Recovery Console], a special command prompt with its own command interpreter that requres the local Administrator password to fix it. For a list of commands that are available in Recovery Console, type recovery console commands or help at the command prompt, and then press ENTER. Use the command Chkdsk /p to fix the dirty bit and file corruption.

(2) "Stop 0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted (Q315403)."

2. For correct verification a volume must be static and the only way to guarantee a static state is to lock the volume. CHKDSK locks the volume only if you specify the /F switch (or the /R switch which implies /F), [User Action].

CNET Forums

Forum Info