Initial commit

## Windows

This log dataset was collected by aggregating a number of logs from a lab computer running Windows 7. The original logs were located at `C:\Windows\Logs\CBS`. [CBS (Component Based Servicing)](https://blogs.technet.microsoft.com/askperf/2008/04/23/understanding-component-based-servicing/) is a componentization architecture in Windows, which works at the package/update level. The CBS architecture is far more robust and secure than the installers in previous operating systems. Users benefit from a more complete and controlled installation process that allows updates, drivers and optional components to be added while simultaneously mitigating against instability issues caused by improper or partial installation. The logs have a large size (over 27GB) and span a period of 226+ days.

### Download

The raw logs are available for downloading at https://github.com/logpai/loghub.

### Citation

If you use this dataset from loghub in your research, please cite the following papers.

+ Jieming Zhu, Shilin He, Pinjia He, Jinyang Liu, Michael R. Lyu. [Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics](https://arxiv.org/abs/2008.06448). IEEE International Symposium on Software Reliability Engineering (ISSRE), 2023.

EventId,EventTemplate

E1,"<*> Created NT transaction (seq <*>) result <*>, handle @<*>"

E2,"<*> Creating NT transaction (seq <*>), objectname [<*>]""(null)"""

E3,<*> CSI perf trace:

E4,<*> CSI Store <*> (<*>) initialized

E5,"<*> IAdvancedInstallerAwareStore_ResolvePendingTransactions (call <*>) (flags = <*>, progress = <*>, phase = <*>, pdwDisposition = @<*>"

E6,<*> ICSITransaction::Commit calling IStorePendingTransaction::Apply - coldpatching=FALSE applyflags=<*>

E7,<*> Performing <*> operations; <*> are not lock/unlock and follow:

E8,"<*> Store coherency cookie matches last scavenge cookie, skipping scavenge."

E9,<*>@<*>/<*>/<*>:<*>:<*>:<*>.<*> CSI Transaction @<*> destroyed

E10,"<*>@<*>/<*>/<*>:<*>:<*>:<*>.<*> CSI Transaction @<*> initialized for deployment engine {<*>} with flags <*> and client id [<*>]""<*>/"""

E11,<*>@<*>/<*>/<*>:<*>:<*>:<*>.<*> PopulateComponentFamiliesKey - Begin

E12,<*>@<*>/<*>/<*>:<*>:<*>:<*>.<*> PopulateComponentFamiliesKey - End

E13,<*>@<*>/<*>/<*>:<*>:<*>:<*>.<*> WcpInitialize (wcp.dll version <*>) called (stack @<*>)

E14,"Disabling manifest caching, because the image is not writeable."

E15,Ending the TrustedInstaller main loop.

E16,Ending TrustedInstaller finalization.

E17,Ending TrustedInstaller initialization.

E18,Expecting attribute name [HRESULT = <*> - CBS_E_MANIFEST_INVALID_ITEM]

E19,Failed to create backup log cab. [HRESULT = <*> - ERROR_INVALID_FUNCTION]

E20,Failed to get next element [HRESULT = <*> - CBS_E_MANIFEST_INVALID_ITEM]

E21,Failed to internally open package. [HRESULT = <*> - CBS_E_INVALID_PACKAGE]

E22,Idle processing thread terminated normally

E23,Loaded Servicing Stack <*> with Core: <*>\cbscore.dll

E24,"Loading offline registry hive: <*>, into registry key '<*>' from path '<*>'."

E25,"No startup processing required, TrustedInstaller service was not set as autostart, or else a reboot is still pending."

E26,NonStart: Checking to ensure startup processing was not required.

E27,"NonStart: Success, startup processing not required as expected."

E28,Offline image is: read-only

E29,"Read out cached package applicability for package: <*>, ApplicableState: <*>, CurrentState:<*>"

E30,Reboot mark refs incremented to: <*>

E31,Reboot mark refs: <*>

E32,Scavenge: Begin CSI Store

E33,"Scavenge: Completed, disposition: <*>"

E34,Scavenge: Starts

E35,Session: <*>_<*> initialized by client SPP.

E36,Session: <*>_<*> initialized by client WindowsUpdateAgent.

E37,SQM: Cleaning up report files older than <*> days.

E38,SQM: Failed to start standard sample upload. [HRESULT = <*> - E_FAIL]

E39,"SQM: Failed to start upload with file pattern: <*>, flags: <*> [HRESULT = <*> - E_FAIL]"

E40,SQM: Initializing online with Windows opt-in: False

E41,"SQM: Queued <*> file(s) for upload with pattern: <*>, flags: <*>"

E42,SQM: Requesting upload of all unsent reports.

E43,SQM: Warning: Failed to upload all unsent reports. [HRESULT = <*> - E_FAIL]

E44,Starting the TrustedInstaller main loop.

E45,Starting TrustedInstaller finalization.

E46,Starting TrustedInstaller initialization.

E47,Startup processing thread terminated normally

E48,TrustedInstaller service starts successfully.

E49,Unloading offline registry hive: <*>

E50,Warning: Unrecognized packageExtended attribute.