Generate Event Viewer Logs for Windows

Issue

Automox Support has requested Windows Event Viewer logs to troubleshoot a device, and it is unclear which logs to export and how to export them.

Environment

• Automox (current agent release)
• Windows 10 / 11, Windows Server

Resolution — export via Event Viewer (GUI)

1. Open Event Viewer (eventvwr.msc).
2. Expand Windows Logs and select the log you need (see "Which log" below).
3. In the Actions pane, click Save All Events As…
4. Save the file as a .evtx (use a descriptive name that includes the channel, e.g. WUClient.evtx, so multiple exports don't collide).
5. Attach the file to your Support case.

Which log to export

• Application and System — general errors and service events.
• Applications and Services Logs → Microsoft → Windows → WindowsUpdate → Operational (Microsoft-Windows-WindowsUpdateClient/Operational) — the most useful log for patching/update issues. Export this one for any patch-related case.
• Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational — useful when Group Policy is suspected of affecting updates.

Faster alternative (PowerShell)

Export a channel directly with wevtutil:

wevtutil epl "Microsoft-Windows-WindowsUpdateClient/Operational" "$env:USERPROFILE\Desktop\WUClient.evtx"

Notes

• Channel names can vary slightly by Windows build — verify the exact name before exporting.
• Some channels have limited default retention, so events from an older incident may already have rolled off. Collect logs as soon as possible after the issue.