Windows Galore
Troubleshoot Using System Files

As Windows installs, it creates 3 files to track the installation process and to log any problems that may occur during installation. Those files are: BOOTLOG.TXT, DETLOG.TXT and SETUPLOG.TXT. Each of these files is described in detail below.

BOOTLOG.TXT

From a troubleshooting standpoint, BOOTLOG.TXT is probably the most useful of the files covered here, although it's more what BOOTLOG.TXT doesn't tell you that's important than what it does tell you.
BOOTLOG.TXT is a hidden ASCII file in the root directory of the hard drive. It is created during the first boot after setup. After that, a user can force the creation of a new BOOTLOG.TXT by hitting F8 at startup and choosing "Step by Step Confirmation" or by booting to a command prompt and starting Windows by using the "win /b" command. The previous copy of BOOTLOG.TXT will be renamed to BOOTLOG.PRV. Windows will keep only the current and most recent backup of BOOTLOG.TXT.
There are four main classes of events that are logged in the BOOTLOG.TXT:

Normally, the first ten lines of the file deal with the loading and success or failure of real mode drivers like HIMEM.SYS, EMM386 and SETVER. The rest of the file references the loading and initialization of VxD's, dVxD's, core files, and other protect mode Windows files.
Examination of the BOOTLOG.TXT file can give a good deal of insight into the boot process. Listed below is an example of what the file looks like:

[00106CA1] Loading Vxd = vpd
[00106CA1] LoadSuccess = vpd
[00106CA1] Loading Vxd = vkd
[00106CA2] LoadSuccess = vkd
[00106CA2] Loading Vxd = vpowerd
[00106CA2] LoadFailed = vpowerd
[00106CA2] Loading Vxd = enable
[00106CA2] LoadSuccess = enable

As you can see, VPOWERD failed to load. This does not mean that there is a problem with the system, however. VPOWERD is Windows version of Power Management, and, if this is disabled in Device Manager, this will fail to load.
Whether an item succeeds or fails to load may or may not have an impact on why Windows will fail to load in general. If Windows hangs on boot, the first place to look at in BOOTLOG.TXT is the end. Generally, there will be a line saying LOADING … but no line indicating whether the item successfully loaded or not. In this case, that item is causing the system to hang. More common, however, is a line at the end of the BOOTLOG.TXT saying LOADSUCCESS… . This means that whatever item loads after this item is the cause of the hang. Taking a look at the BOOTLOG.TXT of another, like, system may give some insight as to what was trying to load when the system failed.

Back To Top

DETLOG.TXT

Detlog is actually a combination of two files; DETLOG.TXT and DETCRASH.LOG.

DETLOG.TXT
Is the ASCII counterpart of the file DETCRASH.LOG. It is not used by setup, and is only created for users to read. This file is really only useful in determining the cause of a failed hardware installation.

DETLOG.TXT is created under any of the following conditions:
- During the hardware detection portion of setup
- Detection is invoked from Control Panel | Add New Hardware
- Laptop is booting for first time after changing docking state
- PCMCIA support is enabled (by using the PCMCIA Wizard)

During the setup process, or whenever hardware detection is run (Add New Hardware), Windows loads specific detection modules based upon information in the MSDET.INF. Most of the DETLOG.TXT is filled with entries such as:
...
QueryIOMem: Caller=DETECTSONYCD, rcQuery=0
IO=250-253
QueryIOMem: Caller=DETECTSONYCD, rcQuery=0
IO=270-273
QueryIOMem: Caller=DETECTSONYCD, rcQuery=0
IO=290-293
QueryIOMem: Caller=DETECTSONYCD, rcQuery=0
IO=300-303......

In this example, the DETECTSONYCD module of the SYSDETMG.DLL file is querying a range of I/O addresses for the Sony CD ROM drive. It is not uncommon to find up to 200 consecutive entries for a call to a piece of particular hardware, even if that hardware is not installed on the system.
DETLOG.TXT is a cumbersome way to determine why a piece of hardware failed detection, but it can show you if an I/O address is conflicting, as well as other failure causes.

Back To Top

SETUPLOG.TXT

The SETUPLOG.TXT file is a hidden ASCII text file that resides in the root directory after running setup. It has information gathered and logged during the setup process that could be useful if setup is hanging.
This file records all the options the user chose during the setup process. The [Optional Components] section shows which of the optional components the user chose to install. The next two lines show an example of how SETUPLOG.TXT looks:

This shows that Word Pad was selected for install, while Dial-Up Networking was not. Similarly the [System] and [NameAndOrg] sections demonstrate that because of it=s text format, the meaning of many settings in the SETUPLOG.TXT are immediately evident.
To view the directories that have been, and will be, used by setup, view the [Destination] section. Each of the directories listed in this section is assigned a numerical value. From this point, directories are referenced by these values.
The [Detection] section is built following the hardware detection portion of setup. It indicates whether the detection phase of setup completed successfully or not. If setup hangs during detection, this section will be blank. The file DETLOG.TXT will be a good one to look at in this scenario.
The [FileCopy] section logs the files that were copied onto the hard drive, along with their destination directories (in numbered format as defined in the [Destination] section). This section is used in Maintenance Mode Setup to verify the presence and integrity of the files which were copied to the hard drive during Setup. Toward the beginning of the installation process, setup looks for a SETUPLOG.TXT file. If found, it then searches for the [FileCopy] section. If this section is found, the user will be prompted with an option run Safe Detection. Therefore, deletion of the SETUPLOG.TXT or the removal of the [FileCopy] section will disallow Safe Detection (which can sometimes be a good thing). If setup was originally done from a network, and the system crashes, removing the [FileCopy] section can also allow Windows to gather files from a CD ROM, rather than looking over a network drive for them.

Back To Top