How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vista

Article translations Article translations
Article ID: 928228 - View products that this article applies to.

Support for Windows Vista without any service packs installed ended on April 13, 2010. To continue receiving security updates for Windows, make sure you're running Windows Vista with Service Pack 2 (SP2). For more information, refer to this Microsoft web page: Support is ending for some versions of Windows

Expand all | Collapse all

On This Page

INTRODUCTION

This article describes how to analyze the log files that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vista.

MORE INFORMATION

Overview

You can use the SFC.exe program to help you troubleshoot crashes that occur in the user mode part of Windows Vista. These crashes may be related to missing or damaged operating system files.

The SFC.exe program performs the following operations:
  • It verifies that non-configurable Windows Vista system files have not changed. Also, it verifies that these files match the operating system's definition of which files are expected to be installed on the computer.
  • It repairs non-configurable Windows Vista system files, when it is possible.

How to analyze the log file that the SFC.exe program generates

How to view the log file

The SFC.exe program writes the details of each verification operation and of each repair operation to the CBS.log file. Each SFC.exe program entry in this file has an [SR] tag. The CBS.log file is located in the %windir%\Logs\CBS folder.

Note The Windows Modules Installer service also writes to this log file. (The Windows Modules Installer service installs optional features, updates, and service packs.)

You can search for [SR] tags to help locate SFC.exe program entries. To perform this kind of search and to redirect the results to a text file, follow these steps:
  1. Click Start
    Collapse this imageExpand this image
    Start button
    , type cmd in the Start Search box, right-click cmd in the Programs list, and then click Run as administrator.

    Collapse this imageExpand this image
     User Account Control permission
    If you are prompted for an administrator password or for a confirmation, type your password, or click Continue.
  2. Type the following command, and then press ENTER:
    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt
The Sfcdetails.txt file includes the entries that are logged every time that the SFC.exe program runs on the computer.

How to interpret the log file entries

The SFC.exe program verifies files in groups of 100. Therefore, there will be many groups of SFC.exe program entries. Each entry has the following format:
date time entry_type details
The following sample excerpt from a CBS.log file shows that the SFC.exe program did not identify any problems with the Windows Vista system files:
<date> <time>, Info   CSI    00000006 [SR] Verifying 100 (0x00000064) components
<date> <time>, Info   CSI    00000007 [SR] Beginning Verify and Repair transaction
<date> <time>, Info   CSI    00000009 [SR] Verify complete
<date> <time>, Info   CSI    0000000a [SR] Verifying 100 (0x00000064) components
<date> <time>, Info   CSI    0000000b [SR] Beginning Verify and Repair transaction
<date> <time>, Info   CSI    0000000d [SR] Verify complete
<date> <time>, Info   CSI    0000000e [SR] Verifying 100 (0x00000064) components
<date> <time>, Info   CSI    0000000f [SR] Beginning Verify and Repair transaction
<date> <time>, Info   CSI    00000011 [SR] Verify complete
<additional entries>
<additional entries>
<date> <time>, Info   CSI    00000011 [SR] Verify complete
The following sample excerpt from a CBS.log file shows that the SFC.exe program has identified problems with the Windows Vista system files:
<date> <time>, Info   CSI    00000006 [SR] Verifying 100 (0x00000064) components
<additional entries>
<additional entries>
<date> <time>, Info   CSI    00000007 [SR] Beginning Verify and Repair transaction
<date> <time>, Info   CSI    00000008 [SR] Repairing corrupted file [ml:520{260},l:108{54}]"\??\E:\Program Files\Common Files\Microsoft Shared\DAO"\[l:20{10}]"dao360.dll" from store
<date> <time>, Info   CSI    0000000a [SR] Verify complete
Note Although the log file entry states that the SFC.exe program is repairing the changed file, no actual repair operation occurs when a file is verified.

The following table lists other messages that may be logged in the SFC.exe program entries of the CBS.log file after verification is completed.
Collapse this tableExpand this table
EntryExampleExplanation
Cannot repair member file file detailsCannot repair member file [l:14{7}]"url.dll" of Microsoft-Windows-IE-WinsockAutodialStub, Version = 6.0.5752.0, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeNThis entry indicates that the file content does not match the operating system definition for the file. In this situation, the SFC.exe program cannot repair the file.
Repaired file file details by copying from backupRepaired file \SystemRoot\WinSxS\Manifests\\[ml:24{12},l:18{9}]"netnb.inf" by copying from backupThis entry indicates that a problem exists with a file. The SFC.exe program can repair this file by copying a version from a private system store backup.
Repairing corrupted file [ml:520{260},l:36{18}]"\??\C:\Windows\inf"\[l:18{9}]"netnb.inf" from storeRepairing corrupted file [ml:520{260},l:36{18}]"\??\C:\Windows\inf"\[l:18{9}]"netnb.inf" from storeThis entry indicates that a problem exists with a file. The SFC.exe program can repair this file by copying a version from the system store.

Properties

Article ID: 928228 - Last Review: March 15, 2007 - Revision: 1.7
APPLIES TO
  • Windows Vista Business
  • Windows Vista Enterprise
  • Windows Vista Home Basic
  • Windows Vista Home Premium
  • Windows Vista Ultimate
  • Windows Vista Enterprise 64-bit Edition
  • Windows Vista Home Basic 64-bit Edition
  • Windows Vista Home Premium 64-bit Edition
  • Windows Vista Ultimate 64-bit Edition
  • Windows Vista Starter
Keywords: 
kbexpertiseadvanced kbfilesystems kbhowto kbinfo KB928228

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com