Which Windows 7 log file contains device connection/disconnection information?

Question

Windows 7 frequently plays the usb/new device connection/disconnection sound. It happens both when the computer is idle and under load. All usb device connections have been checked (though I can't rule out a bad cable yet). I thought a good way to track down the issue would be to wait for the sound and then check the log file for the latest connected/disconnected device. I just need to know which log file has this information.

Edit: I'm going to leave the answer accepted, however the issue persists. I get that sound seemingly randomly throughout the day. Anyone else have any ideas?

Answer 1

try using USBLogView

Answer 2

There IS a log file of all device connections and disconnections, in %SystemRoot%\inf\setupapi.dev.log . It is semi-readable text. It contains reports for all devices, not just USB.

Open it in Notepad (or Notepad++ or vi or ex or...), scroll to the bottom, and note that the output for each new device is separated from the previous by a couple of blank lines. The most recent will be at the end. There are timestamps.

If the text doesn't tell you what device(s) are trying to connect, then look for lines like this:

 dvi:      Searching for hardware ID(s):
 dvi:           usb\vid_1532&pid_0021&rev_0200&mi_00
 dvi:           usb\vid_1532&pid_0021&mi_00

and search on the web for vendor ID 1532; then, from likely-looking pages, product ID 0021 (the revision code and the rest of the strings don't matter).

n.b.: There are a large number of sites out there that try to provide this information. Many of them offer driver downloads. Do not download any drivers from anywhere except a) Microsoft update or b) the web site of the company that made your device.

Answer 3

These type of event don't always get registered. However, if it is a system event that IS registered by the OS itself, it would be in your Event Viewer under either Custom Views\Administrative Events or Windows Logs\System or possibly Windows Logs\Application depending on the type of events: hardware, drivers, etc.

Now if its done by an application, such as ImgBurn revving up the optical drive to read/rip or write/burn something, it would be strongly dependent on the developer/vendor and if they have chosen to register events and to what extent. If they do register events, they would appear under Applications and Services Logs generally corresponding to the applications name.

Finally, if you KNOW the type of event you are trying to capture, you can create a custom view report under event viewer and set the event level, source it either by log (predefined) or by source to specific element (much more granular), and even if you want to add keyword (use only if you know the event name you are trying to capture). Do what you need to do after you create that and go back and see what it captured for you.

Hope that helps.

Answer 4

In case anyone stumbles upon this and needs a solution for Windows 8 or greater, like I did here. I found that using EventGhost (free and open source) worked for me on Windows 8.1.

Answer 5

I don't have the rep to post this as a comment on the original reply by @imaximchuk, but USBLogView works on Windows 10 as of version 1.20.

I have a similar issue with something connecting and disconnecting constantly, and USBLogView worked for me on Windows 10 (10.0.16299)... almost. Sadly, it only logged USB Mass Storage Device events, not all USB events.

I tried EventGhost (the URL has changed to http://www.eventghost.net because they somehow lost access to the .com address) and yes, it shows EVERYTHING!

As noted above, it's a bit cryptic, so you'll have to do some searching to figure out what it is. In my case, yep, another monitor. No idea why it started doing it out of the blue. On to the next mystery (why the hell it's happening.)