The Windows 8 Metro App delivery and installation mechanism has a lot of new plumbing!  When you experience a problem, it is a big challenge to figure out everywhere you might look to solve the problem.  I am a big proponent of gathering existing logging data whenever I start to work on a problem - mainly because the data is there for zero effort!  Sure I can slap on procmon and dig deep, but what if a single eventlog message is nailing the problem in a small clear voice?

Let's take a look at the places where we can find existing log data for the installation and running of Win 8 Metro WinRT Store Apps (yes I am mocking the many name changes of this class of Windows Apps type while simultaneously making sure your searches hit this page no matter what nomenclature you use).

If you take the time to register below, you will receive a download that includes a Custom Event View that brings together all the logs that may contain applicable logging data.

Event Logs

Windows 8 ships with many new event logs that deal with Windows 8 Metro Store Apps.

All of the below event logs accessed in the eventvwr snap-in under "Applications and Services Logs => Microsoft => Windows"

Installing Appx Packages

• All-User-Install-Agent - logs propagation of "provisioned apps" to a user who logs in.  Provisioned apps are ones that are installed AND staged so that they install for each user who logs in.
• AppXDeployment - documents which process requests an AppX deployment to occur.
• AppXDeployment-Server - tracks status and errors of installing, updating and uninstalling Appx packages.

Running Windows 8 Metro Store Apps

• Apps - tracks Immersive Shell (Metro UI) operations.
• AppModel-Runtime - reports status and errors for WinRT runtime when starting, running and terminating Win8 Metro Store Apps.
• AppHost - tracks errors when the apphost process cannot start a Win8 Metro Store App.
• AppLocker => Package app-Deployment - details what AppX deployments have been allowed and blocked by AppLocker policies.
• AppLocker => Package app-Execution - details what Apps have been allowed to run and blocked from running by AppLocker policies.
• AppxPackagingOM - validation of appx package signatures, manifests and checksums.

Syncing and Validating Windows 8 Metro Store Apps

• PackageState-Roaming - status on App state syncrhonization.
• PushNotifications-Platform - documents the reception and delivery of App push notifications.
• Store-Licencing - logs events dealing with the license validation status of installed Apps.

Text Logs

winstore.log

%TEMP%\winstore.log - logs processes triggered under user profile, including automated updates that are individually scheduled for each user to service their per-user installs.

%LOCALAPPDATA%\Packages\WinStore_cw5n1h2txyewy\AC\Temp\winstore.log - logs installs done by the interactive store run by the user (WWAHost.exe)

%WINDIR%\temp\winstore.log - Windows store processes done by automation or background tasks: msiexec.exe, rundll32.exe, svchost.exe, dllhost.exe, sysprep.exe, system32\wsqmcons.exe ("Windows SQM Consolidator" - Windows Customer Experience Improvement Program. This program collects and sends usage data to Microsoft.)

Deployment Imaging and Service Management (DISM.log)

%windir%\logs\DISM\dism.log - logs for dism command line.  DISM is used to "provision" Appx packages when building a corporate image (offline or online mode) or installing on deployed machines (online mode).  Other DISM commands will also be in this log.  Powershell Appx CMDlets do not generate records in this log.

TrustedInstaller Log

%windir%\logs\cbs\cbs.log - when the TrustedInstaller service is used to install Windows Resource Protected files or registry keys (would be rare to need this log for analyzing Appx).

Logging Commands

Get-Appxlog - retrieves and displays (date time order) the event logs for the last package operation from the logs: Appx-Deployment/Operational, AppXDeployment-Server/Operational and AppXDeployment-Server/Operational.

Get-AppxLastError - get the error from the last Appx deployment attempt.  If the last deployment operation did not end in an error - no output is generated.

Windows 8 App Troubleshooter - a Microsoft troubleshooting script that checks for common problems.

If you register to be notified of our Windows 8 eBook, we will also immediately send you our Windows 8 Metro Store App IT Toolkit.  It includes the following items:

• A URL Link to the Windows 8 App Troubleshooter - created by Microsoft.
• Complete Sample Appx Package and Certificate - for installation practice and use with COMMANDSAMPLES.CMD.
• ENABLEAllowAllTrustedAppsPolicy.reg - turns on "AllowAllTrustedApps" policy for domain joined machines to be able to sideload apps.
• AppXWrapper.msi  - msi that uses dism.exe to provision and uninstall packages.
• COMMANDSAMPLES.CMD   - Powershell and DISM.exe commands for installing this sample appx.
• Eventlog\AllWin8MetroWinRTStoreAppsCustomLogView.xml   - custom view for event viewer that merges all appx and Metro App runtime eventlogs.
• Eventlog\POWERSHELLAllWin8MetroWinRTStoreAppsFilter.xml   - filter that has same event logs as custom view for use with powershell.
• Eventlog\ListEventsWithFilter.ps1  - sample script that uses Get-WinEvent along with POWERSHELLAllWin8MetroWinRTStoreAppsFilter.xml to display events.

Click here to register for notification and receive the IT Toolkit.