WMI Log Files

WMI uses Event Tracing (ETW) and events can be obtained through the Event Viewer user interface or the Wevtutil command line tool. For more information, see Tracing WMI Activity.

Event Tracing Instead of Text Logs

WMI service activity is recorded in the WMITracing.log file. For more information about enabling WMI event tracing and accessing the WMITracing.log file, see Tracing WMI Activity. Windows Driver Model (WDM) providers continue to log in the Wbemprov.log file.

WMI Log Files

The WMI service and some providers write text log files to record events.

WMI Provider Log Files

WMI providers also may maintain logs. Which log files appear on a system depends on which providers are installed.

WMI Reference

Tracing WMI Activity

Logging WMI Activity