IT 전문가는 문제를 진단하기 위해 한 대 이상의 컴퓨터에서 로그 파일을 가져와야만 할 수 있습니다. 이 작업은 원격 관리 툴을 통해 수행하는 것이 가장 좋지만, 스크립팅을 통해 수행할 수도 있습니다. 이 문서의 첨부 파일 섹션에는 대부분의 요구 사항을 충족하도록 실행하거나 수정할 수 있는 로그 수집기 예제가 포함되어 있습니다.
스크립트 세부 정보:
C:\Users\<Current User>\AppData\Roaming\
9af4c403c997dcebdba49b6251565a5c
3a8bb6d3a75ebe14ffc631fe68dcfa308eaf3691
4917c7f2e0d8d6111159cfe18b8dc9ca6cf04ff4467166d65435e3b8e07a5e2b
.cmd
파일이 메모장 아이콘으로 표시되고 두 번 클릭하면 메모장으로 열립니다.
.cmd
및 기타 스크립트 파일..bat
대신 파일?
.cmd
및 .bat
컨텍스트 및 보안 차이점을 포함하는 파일..cmd
..bat
..txt
파일에 포함되어 있습니까?
수집된 로그 | ZIP 로그 경로 | 사용된 명령 | 관리자 필수 | 명령 유형 | Microsoft/Dell 참조 URL | 2.3 변화 |
---|---|---|---|---|---|---|
애플리케이션 이벤트 로그 | \Logs\OperatingSystem\Event Logs\application_eventlog.evtx |
wevtutil epl Application /q:"*[System[(Level<=5)]]" application_eventlog.evtx |
No | 명령줄 | https://learn.microsoft.com/windows/win32/wes/windows-event-log |
0 |
Appx 패키지 목록 | \Logs\Application\installed_appx.txt |
Get-AppxPackage | Select PackageFullName | Sort PackageFullName |
예 | PowerShell | https://learn.microsoft.com/powershell/module/appx/get-appxpackage?view=windowsserver2022-ps |
0 |
사용 가능한 절전 상태 목록 | \Logs\Power\available_sleepstates.txt |
powercfg /a |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
배터리 보고서 | \Logs\Power\Battery_Report.html |
powercfg /batteryreport /output Battery_Report.html /duration 14 |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
BCD 정보 | \Logs\OperatingSystem\bcd.txt |
bcdedit |
예 | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/bcdedit |
0 |
Bitlocker 보호기 목록 | \Logs\Security\bitlocker_PCRs.txt |
manage-bde %SYSTEMDRIVE% -protectors -get -type TPM |
예 | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/manage-bde |
0 |
Bitlocker 상태 | \Logs\Security\bitlocker_status.txt |
manage-bde -status |
예 | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/manage-bde |
0 |
광대역 어댑터 목록 | \Logs\Network\broadband_adapter.txt |
netsh mbn show interfaces |
No | 명령줄 | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
구성된 절전 모드 해제 타이머 목록 | \Logs\Power\waketimers.txt |
powercfg /waketimers |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Dell Command Update 로그 | \Logs\Dell\Dell_Command_Update\Activity.log |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\UpdateService\Log |
예 | 명령줄 | Dell Command | Update | 0 |
Dell Data Migrate 로그(대상) | \Logs\Dell\Dell_Data_Migrate_Destination\(Various files) |
XCOPY /s /I /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\SupportAssist\CDM\Logs . |
예 | 명령줄 | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/ | 0 |
Dell Data Migrate 로그(소스) | \Logs\Dell\Dell_Data_Migrate_Source\(Various Files) |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\DDA\logs\ . |
예 | 명령줄 | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/introduction?guid=guid-28c0bb91-e84d-4118-99ee-e5500769b170& | 0 |
Dell Digital Delivery 로그 | \Logs\Dell\Dell_Digital_Delivery\ |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\dell\D3\Resources\Logs\ |
예 | 명령줄 | https://www.dell.com/support/contents/article/product-support/self-support-knowledgebase/software-and-downloads/download-center/dell-digital-delivery | 0 |
Dell 출고 시 로드 정보 | \Logs\Dell\FactoryLoad\dell.sdr |
XCOPY /y /q /F %SYSTEMDRIVE%\dell.sdr |
No | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
0 |
Dell Optimizer 로그 | \Logs\Dell\Dell_Optimizer\* |
*XCOPY command copies multiple AppData files specific to Dell Optimizer* |
No | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
1 |
Dell Update Package 로그 | \Logs\Dell\Dell_Update_Package\* |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\UpdatePackage\Log . |
No | 명령줄 | Dell Command | Update | 0 |
상세한 드라이버 보고서 | \Logs\Driver\driver_details.txt |
Get-WmiObject Win32_PnPSignedDriver | select * |
No | PowerShell | https://learn.microsoft.com/previous-versions/windows/desktop/legacy/aa394354(v=vs.85) |
0 |
DirectX 진단 로그 | \Logs\Graphics\DXdiag.txt |
dxdiag.exe /t DXdiag.txt |
No | 명령줄 | https://support.microsoft.com/windows/open-and-run-dxdiag-exe-dad7792c-2ad5-f6cd-5a37-bf92228dfd85 |
0 |
드라이버 목록 | \Logs\Driver\driver_list.txt |
Get-WmiObject Win32_PnPSignedDriver| select devicename, driverversion, driverdate | Sort-Object devicename |
No | PowerShell | https://learn.microsoft.com/previous-versions/windows/desktop/legacy/aa394354(v=vs.85) |
0 |
드라이버 저장소 목록 | \Logs\Driver\driver_store.txt |
dism /online /get-drivers /all /format:table |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11 |
0 |
오류 상태인 드라이버 | \Logs\Driver\error_state_drivers.txt |
Pnputil /enum-devices /problem /ids |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/drivers/devtest/pnputil |
1 |
에너지 보고서 | \Logs\Power\energy.html |
powercfg /energy /output energy.html |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
그룹 정책 개체 | \Logs\OperatingSystem\GPO_List.html |
start /min gpresult /H GPO_List.html |
No | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/gpresult |
0 |
설치된 애플리케이션 목록 | \Logs\Application\installed_apps.txt |
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object InstallDate |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-7.3 |
0 |
IP 구성 | \Logs\Network\ipconfig_all.txt |
ipconfig /all |
No | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/ipconfig |
0 |
마지막 절전 모드 해제 트리거 | \Logs\Power\lastwake.txt |
powercfg /lastwake |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
메모리 덤프(전체 커널) | \Logs\MemoryDumps\memory.dmp |
XCOPY /y /q /F %SYSTEMROOT%\memory.dmp |
No | 명령줄 | https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/xcopy |
0 |
메모리 덤프(미니덤프) | \Logs\MemoryDumps\*.dmp |
XCOPY /s /I /y /q /F %SYSTEMROOT%\minidump\*.dmp |
예 | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
0 |
메모리 덤프(상태/세부 정보) | \Logs\Operating System\DumpStatus.txt |
IF EXIST %SYSTEMROOT%\memory.dmp |
예 | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/if |
0 |
메모리 관리 상태 | \Logs\System\MemoryManagement.html |
Get-mmagent | Out-File MemoryManagement.html |
예 | PowerShell | https://learn.microsoft.com/powershell/module/mmagent/get-mmagent?view=windowsserver2022-ps |
1 |
Microsoft 시스템 정보(MSinfo32) | \Logs\OperatingSystem\msinfo32.nfo |
start msinfo32 /nfo msinfo32.nfo |
No | 명령줄 | https://support.microsoft.com/topic/description-of-microsoft-system-information-msinfo32-exe-tool-10d335d8-5834-90b4-8452-42c58e61f9fc |
0 |
모니터 정보 | \Logs\Graphics\monitor.txt |
Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID | ForEach-Object {if ($_.UserFriendlyNameLength -gt 0) {($_.ManufacturerName -ne 0 | foreach {[char]$_}) + [char] 10 + 'InstanceName: ' + ($_.InstanceName) + [char] 10 + ($_.UserFriendlyName -ne 0 | foreach {[char]$_}) + [char] 10 + 'Serial: ' + ($_.SerialNumberID -ne 0 | foreach {[char]$_}) + [char] 10 + 'ProdCodeID: ' + ($_.ProductCodeID -ne 0 | foreach {[char]$_}) + [char] 10 + 'WeekOfManufacture:' + $_.WeekOfManufacture + [char] 10 + 'YearOfManufacture:' + $_.YearOfManufacture + [char] 10 + 'DisplayActive:' + $_.Active + [char] 10 -join ''} else{($_.ManufacturerName -ne 0 | foreach {[char]$_}) + [char] 10 + 'InstanceName: ' + ($_.InstanceName) + [char] 10 + ('No Model (Likely Internal LCD)') + [char] 10 + 'Serial: ' + ($_.SerialNumberID -ne 0 | foreach {[char]$_}) + [char] 10 + 'ProdCodeID: ' + ($_.ProductCodeID -ne 0 | foreach {[char]$_}) + [char] 10 + 'WeekOfManufacture:' + $_.WeekOfManufacture + [char] 10 + 'YearOfManufacture:' + $_.YearOfManufacture + [char] 10 + 'DisplayActive:' + $_.Active + [char] 10 -join ''}} |
No | No | https://learn.microsoft.com/windows/win32/wmicoreprov/wmimonitorid |
0 |
네트워크 어댑터 고급 속성 로그 | \Logs\Network\net_adapter_adv_properties.txt |
Get-NetAdapterAdvancedProperty |
No | PowerShell | https://learn.microsoft.com/powershell/module/netadapter/get-netadapteradvancedproperty?view=windowsserver2022-ps |
0 |
OS 버전 및 설치 날짜 | \Logs\LogCollectorStatus.txt |
(Get-WMIObject -class Win32_ComputerSystem | Select-Object Model| Format-List | Out-string).Trim(); (Get-WMIObject -class Win32_OperatingSystem | Select-Object Caption, Version| Format-List| Out-string).Trim(); (Write-Output 'OS Install Date:').Trim(); ((Get-Item 'C:\Windows\system.ini').CreationTime | Out-String).Trim() |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-operatingsystem |
0 |
PnP 디바이스 목록 | \Logs\Operating System\pnp_devices.txt |
Get-CimInstance Win32_PnPEntity |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-pnpentity |
0 |
전원 요청 | \Logs\Power\power_requests.txt |
powercfg /requests |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
전원 구성표 세부 정보 | \Logs\Power\powerschemes.txt |
powercfg /query |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
전원 구성표 목록 | \Logs\Power\power_schemes.html |
powercfg /list |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
프로세스 목록 | \Logs\OperatingSystem\ processes.txt |
Get-WmiObject -Class Win32_Service | Select-Object -Property Name, ProcessID |
No | PowerShell | https://learn.microsoft.com/powershell/module/scheduledtasks/get-scheduledtask?view=windowsserver2022-ps |
0 |
프로비저닝 패키지 | \Logs\Application\installed_provisioning_packages.txt |
Get-ProvisioningPackage |
No | PowerShell | https://learn.microsoft.com/powershell/module/provisioning/get-provisioningpackage?view=windowsserver2022-ps |
0 |
예약 작업 목록 | \Logs\OperatingSystem\taskscheduler.txt |
Get-ScheduledTask | Where State -ne "Disabled" | Get-ScheduledTaskInfo |
No | PowerShell | https://learn.microsoft.com/powershell/module/scheduledtasks/get-scheduledtask?view=windowsserver2022-ps |
0 |
서비스 태그 | Part of File Name |
Get-CimInstance -ClassName Win32_BIOS -Property SerialNumber | Select-Object -ExpandProperty SerialNumber |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-bios |
0 |
서비스 태그 및 BaseBoard ID | \Logs\System\System_Board.txt |
Get-CimInstance -ClassName Win32_BaseBoard | Format-List |
No | PowerShell | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/introduction?guid=guid-28c0bb91-e84d-4118-99ee-e5500769b170 | 1 |
서비스 목록 | \Logs\OperatingSystem\services.txt |
Get-Service | Sort Status |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-service?view=powershell-7.3 |
0 |
절전 모드 조사 보고서 | \Logs\Power\sleepstudy.html |
powercfg /sleepstudy /output sleepstudy.html |
예 | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
시작 프로세스 목록 | \Logs\Application\startup_processes.txt |
Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-startupcommand |
0 |
스토리지 디바이스 정보 | \Logs\Storage\Disk_Drives.txt |
Get-CimInstance -ClassName Win32_DiskDrive | select * | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-diskdrive |
0 |
스토리지 볼륨 | \Logs\Storage\Disk_Volumes.txt |
Get-CimInstance -ClassName Win32_DiskPartition | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/Win32-DiskPartition |
0 |
시스템 모델 | Part of File Name |
Get-WMIObject -class Win32_ComputerSystem | Select-Object -ExpandProperty Model |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-computersystem |
0 |
TPM 정보 | \Logs\Security\tpm.txt |
get-tpm |
예 | PowerShell | https://learn.microsoft.com/powershell/module/trustedplatformmodule/get-tpm?view=windowsserver2022-ps |
0 |
USB 디바이스 목록 | \Logs\USB\usb_devices.txt |
gwmi Win32_USBControllerDevice |%%{[wmi]($_.Dependent)} | Sort Manufacturer,Name,Description,DeviceID | Ft -GroupBy Manufacturer Name,Description,Service,DeviceID |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-usbcontrollerdevice |
0 |
비디오 어댑터 세부 정보 | \Logs\Graphics\video.txt |
Get-WmiObject win32_videocontroller | select * |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller |
0 |
비디오 해상도 세부 정보 | \Logs\Graphics\video.txt |
Get-WmiObject win32_videocontroller | select caption, CurrentHorizontalResolution, CurrentVerticalResolution, CurrentRefreshRate, DriverVersion |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller |
0 |
절전 모드가 해제된 디바이스 목록 | \Logs\Power\device_wake_armed.html |
powercfg -devicequery wake_armed |
No | 명령줄 | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Windows 시스템 이벤트 로그 | \Logs\OperatingSystem\Event Logs\system_eventlog.evtx |
wevtutil epl System /q:"*[System[(Level<=5)]]" system_eventlog.evtx |
No | 명령줄 | https://learn.microsoft.com/windows/win32/wes/windows-event-log |
0 |
Windows Systeminfo 로그 | \Logs\LogCollectorStatus.txt |
Systeminfo |
No | 명령줄 | https://learn.microsoft.com/windows-server/administration/windows-commands/systeminfo |
0 |
Windows 업데이트 목록 | \Logs\OperatingSystem\WindowsUpdateLog.txt |
Get-WindowsUpdateLog |
No | PowerShell | https://learn.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=windowsserver2022-ps |
0 |
Windows 업데이트 로그 | \Logs\OperatingSystem\hotfixes.txt |
Get-hotfix |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-hotfix?view=powershell-7.3 |
0 |
유선 네트워크 목록 | \Logs\Network\current_wired_network_interfaces.txt |
netsh lan show interfaces |
No | 명령줄 | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
무선 네트워크 프로파일 | \Logs\Network\wired_profiles.txt |
netsh lan show profiles |
No | 명령줄 | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
유선 네트워크 설정 | \Logs\Network\wired_settings.txt |
netsh lan show settings |
No | 명령줄 | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
무선 보고서 | \Logs\Network\wlan-report-latest.html |
netsh wlan show wlanreport duration=30 && copy /y %ProgramData%\microsoft\windows\wlanreport\wlan-report-latest.html . && copy /y %ProgramData%\Microsoft\Windows\wlanreport\wlan-report-latest.cab . |
예 | 명령줄 | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Windows 업그레이드/교체 | \Logs\OperatingSystem\windows_upgrade_history |
get-itemproperty -path 'HKLM:\SYSTEM\Setup\Source OS*' | SELECT PSChildName, Productname, ReleaseId, DisplayVersion, CurrentBuild |
PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-7.4 |
1 | |
디스플레이 스트림 압축 | Logs\Graphics\Display_Stream_Compression_status.txt |
REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\Class /s /v DPMstDscDisable > Display_Stream_Compression_status.txt |
No | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/reg-query |
1 |
PCIe 디바이스 생성 및 링크 속도 | \Logs\System\PCIe_Device_Info.txt |
(Get-WMIObject Win32_Bus -Filter 'DeviceID like "PCI%%"').GetRelated('Win32_PnPEntity') | foreach { [pscustomobject][ordered]@{Name = $_.Name; ExpressSpecVersion=$_.GetDeviceProperties('DEVPKEY_PciDevice_ExpressSpecVersion').deviceProperties.data;MaxLinkSpeed=$_.GetDeviceProperties('DEVPKEY_PciDevice_MaxLinkSpeed').deviceProperties.data; MaxLinkWidth=$_.GetDeviceProperties('DEVPKEY_PciDevice_MaxLinkWidth').deviceProperties.data; CurrentLinkSpeed=$_.GetDeviceProperties('DEVPKEY_PciDevice_CurrentLinkSpeed').deviceProperties.data; CurrentLinkWidth=$_.GetDeviceProperties('DEVPKEY_PciDevice_CurrentLinkWidth' ).deviceProperties.data} | Where MaxLinkSpeed } | Format-Table -AutoSize; |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 |
1 |
BIOS 설정 | \Logs\System\BIOS_Settings.txt |
Get-CimInstance -Namespace root\dcim\sysman\biosattributes -ClassName EnumerationAttribute | Select-Object AttributeName, CurrentValue, Defaultvalue, PossibleValue |
예 | PowerShell | https://learn.microsoft.com/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.4 |
1 |
Dell 명령 무시 목록 | \Logs\Dell\Dell_Command_Update\Update_Ignore_List.txt |
REG QUERY HKLM\SOFTWARE\DELL\UpdateService\Service\IgnoreList /s /v InstalledUpdateJson |
No | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/reg-query |
1 |
Dell Optimizer 설정 | \Logs\Dell\Dell_Optimizer\user_settings.txt |
do-cli /get |
No | 명령줄 | https://www.dell.com/support/manuals/dell-optimizer/dell-optimizer-4.0_ug/command-line-interface-for-dell-optimizer?guid=guid-a82481c9-8abf-4a15-9f2b-6011e36c6b19& |
1 |