How to trace Windows search index events

Question

Hello,

I have had a recurring issue with my search index. Periodically, most notibly after updates, my search index disappears and I have to manually reindex.

Is there a way to trace all index activity and events? Can I set up a custom log in Event Viewer? Or, is there a better way to trace index events?

Thanks very much

Answer 1

I see that search logs events into the Application event log. Do you see any errors in yours that might indicate a problem?

Note the date/time of any errors and then check the system event log to see what events get logged around that time.

Here are some MS solutions for fixing search.

https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/fix-problems-in-windows-search

Answer 2

Hi, I am Henry and I'd like to help.

You can try following these below tools:

1. Event Viewer

• Accessing Event Viewer: Press Win + X and choose "Event Viewer," or search for "Event Viewer" in the Start Menu.
• Key Log Locations:
  • Applications and Services Logs > Microsoft > Windows > Search > Operational: This is the primary log for general search service activity, including indexing start/stop, completion of crawls, and some errors. This log is enabled by default.
    • Look for Event IDs like:
      • 1003/1004: Indexing started/completed for a specific user.
      • 1008: Indexing paused.
      • 1009: Indexing resumed.
      • 3028/3029: Gatherer started/stopped.
      • 3036: A crawl completed.
      • Errors (various IDs): Pay attention to any error or warning events. These might indicate why a rebuild was initiated or why items aren't being indexed.
      • Event ID related to reset: Look for events indicating the index was reset or rebuilt. Sometimes an Event ID 30 or similar in the System log for the WSearch service might indicate a problem, or specific events in the Search Operational log.
  • Applications and Services Logs > Microsoft > Windows > Search > Diagnostic: This log is much more verbose and usually disabled by default. It can provide extremely detailed information about the indexer's operations, including individual file processing.
    • To enable the Diagnostic log:
      • In Event Viewer, navigate to the Diagnostic log.
      • Right-click on it and choose Enable Log.
      • You might want to increase its size (right-click > Properties) as it can fill up quickly.
    • This log is excellent for deep dives but can be overwhelming. It's best enabled when you're actively trying to capture an issue.
  • Windows Logs > Application: Sometimes, higher-level Search errors or informational messages from applications interacting with search might appear here.
  • Windows Logs > System: Look for events related to the "Windows Search" service (WSearch). For example, if the service crashes or fails to start, it will be logged here (e.g., Event ID 7034, 7023, 7000, 7009).
• Creating a Custom View: To focus on search-related events without manually browsing multiple logs:
  • In Event Viewer, right-click "Custom Views" and select "Create Custom View..."
  • Under "Logged:", choose "By log."
  • Expand "Applications and Services Logs > Microsoft > Windows > Search" and check both "Operational" and "Diagnostic" (if enabled).
  • You can also include the "System" log and filter by "Event sources" for "Service Control Manager" and check "WSearch" if you want to see service start/stop/crash events.
  • You can further filter by Event IDs or keywords (e.g., "index," "rebuild," "reset," "error").
  • Give your custom view a name (e.g., "Search Indexing Events").

2. Performance Monitor (PerfMon)

PerfMon can track real-time performance counters related to the search indexer. This is more about how the indexer is performing rather than discrete events, but it can show if indexing suddenly stops or if there are bottlenecks.

• Search for "Performance Monitor" in the Start Menu.
• Add counters from the "Search Indexer" and "Search Gatherer" objects.
  • Examples: "Items Indexed," "Items in Queue," "Indexing Speed," "Threads Accessing Network," "Documents Successfully Processed."
• You can log this data to a file over time to see patterns, especially around when you notice the index has disappeared.

Let me know if any of these tools work for you.