WMI Log Files

WMI uses Event Tracing (ETW) and events can be obtained through the Event Viewer user interface or the Wevtutil command line tool. For more information, see Tracing WMI Activity.

Event Tracing Instead of Text Logs

WMI service activity is recorded in the WMITracing.log file. For more information about enabling WMI event tracing and accessing the WMITracing.log file, see Tracing WMI Activity. Windows Driver Model (WDM) providers continue to log in the Wbemprov.log file.

WMI Log Files

The WMI service and some providers write text log files to record events.

WMI Provider Log Files

WMI providers also may maintain logs. Which log files appear on a system depends on which providers are installed.

WMI Reference

Tracing WMI Activity

Logging WMI Activity

 

 


Additional resources

Documentation

  • Tracing WMI Activity - Win32 apps

    Starting with Windows Vista, the WMI service does not use the WMI Log Files. Instead, it uses Event Tracing for Windows (ETW) and events are available through Event Viewer or the Wevtutil command-line tool.

  • Logging WMI Activity - Win32 apps

    The WMI log files are no longer supported.

  • WMI Provider Log Files - Win32 apps

    WMI providers also may maintain logs. Which log files appear on a system depends on which providers are installed.