Re: Is Update Working?

> Bottom line, how can I know if this update is actually in progress, or
> is installed?

Check the logs:
%windir%\SoftwareDistribution\ReportingEvents.log
%windir%\WindowsUpdates.log

Those are just summaries of what was done.
You can do even more detailed checking by what changed in that
subdirectory and examining those files (e.g. *.cab and .xml)

If there is an update in progress you may see wuauclt.exe
active in Task Manager's Processes tab. Notice its PID;
you will see it referred to in the logs. Also try the command

bitsadmin /list

(in a command window) for clues.


Good luck

Robert Aldwinckle
---


"Jentle Jiant" <> wrote in message
news:...
> (Running XP Home Edition, SP2 installed.)
>
> I cannot determine if Windows Update is working.
>
> I am set up to be notified before downloading/installing updates.
>
> This morning I was notified of two updates; one for Internet Explorer
> and one for Office. They has a cumultative size of about 8-9 mb. That
> was about 3 hours ago. I accepted the updates (I thought!)
>
> I clicked "download", but nothing appears to have happened. There is
> no icon in the System Tray. There is no indication of any kind that
> the download is in progress. There has been ample time for these to
> have been downloaded and installed many times over.
>
> Prior to SP2, these notifications provided an option to "remind me
> later", which does not seem to be available anymore. And once an
> update was accepted the Icon remained in SysTray, and hovering the
> mouse pointer over that icon showed a percentage of download progress.
> Now there is nothing I can see which tells me that the update is in
> progress.
>
> How can I know if this download is actually occurring? Is there
> something I can check in Task Manager? There is no indication there
> under "Programs". Perhaps there is something under "Processes" I could
> check?
>
> Bottom line, how can I know if this update is actually in progress, or
> is installed?
>

On Thu, 14 Oct 2004 13:50:53 -0400, "Robert Aldwinckle"
<> wrote:

>> Bottom line, how can I know if this update is actually in progress, or
>> is installed?
>
>Check the logs:
> %windir%\SoftwareDistribution\ReportingEvents.log
> %windir%\WindowsUpdates.log
>
>Those are just summaries of what was done.
>You can do even more detailed checking by what changed in that
>subdirectory and examining those files (e.g. *.cab and .xml)
>
>If there is an update in progress you may see wuauclt.exe
>active in Task Manager's Processes tab. Notice its PID;
>you will see it referred to in the logs. Also try the command
>
> bitsadmin /list
>
>(in a command window) for clues.
>
>
>Good luck
>
>Robert Aldwinckle
>---
I experienced the same problem as the original poster when
I attempted to install 834707.
My automatic options are also set to "notify but don't
automatically download"
The "notification" worked, I selected the fix, then the ! icon
disappeared, nothing further happned as far as I can see.
Later last night I used windowsudate manually and it installed fine.
I looked in the logs, but I was unable to determine anything
definitive. Perhaps I'm not familiar enough with them:
http://home.comcast.net/~davetest/WindowsUpdate.log
http://home.comcast.net/~davetest/ReportingEvents.log
Dave

> The "notification" worked, I selected the fix, then the ! icon
> disappeared, nothing further happned as far as I can see.
> Later last night I used windowsudate manually and it installed fine.
....
> http://home.comcast.net/~davetest/WindowsUpdate.log
> http://home.comcast.net/~davetest/ReportingEvents.log

Yes. I see what you mean. Your ReportingEvents.log shows
the first instance of 834707 at 2004-10-13 16:32:08-0700

Your WindowsUpdate.log shows that it was first detected
and downloaded at 2004-10-13 09:05:14-0700

Here is what happened after that:

<extract>
2004-10-13 09:05:27-0700 632 528 AU received event of 0
2004-10-13 09:11:18-0700 1032 418 0 updates are ready to be installed at shutdown.
2004-10-13 09:11:19-0700 632 27c Service received logoff notification
2004-10-13 09:11:19-0700 632 528 AU received event of 3
2004-10-13 09:11:24-0700 632 5e8 AU Restart required....
2004-10-13 09:11:24-0700 632 528 AU received event of 1
2004-10-13 09:11:24-0700 632 528 ISusInternal API CClientCallRecorder:isconnectCall succeeds
2004-10-13 09:11:24-0700 632 528 AU is paused, not initializing any handlers
2004-10-13 09:11:25-0700 632 27c Service received SERVICE_CONTROL_SHUTDOWN control
2004-10-13 09:11:25-0700 632 528 Exiting Service Main
2004-10-13 09:11:25-0700 1800 70c Out of proc datastore is shutting down
2004-10-13 09:11:25-0700 632 528 WUAUENG ServiceMain exits. Exit code is 0x240001
2004-10-13 09:12:08-0700 632 540 Service Main starts
</extract>

Here are the details that I think are significant and interesting:
1. What happened in those 6 minutes between 09:05 and 09:11?
One can imagine that perhaps there might have been a clickable icon
in the SysTray then. It wouldn't install right away because it would be
waiting for you to say Ok. Did you check to see if it was hidden?
(Mine usually is and I frequently forget to check for it. Also the little
beep that it had with V4 may be less reliable with V5.)
2. Which process was 1032 and which process was 1800?
Usually it is wuauclt.exe. Were there two of them?
Which account(s) would they have been using?
3. Then 30 seconds later it is as if a new detection cycle is starting.
Were you doing anything which might have accounted for that?

I suspect that if you had just waited for the next detection cycle
perhaps after the next boot that it might have noticed that it could
offer you something to install and given you a beep then.
(That's even the way that V4 sometimes used to work for me.)

I believe you may also be able to hurry the process by Run...
wuauclt /detectnow
However, I have not experimented with that command myself yet.
In any case I think I would only try it if there was no other wuauclt.exe
already active.


HTH

Robert
---


"davexnet02" <davexnetzerotwo@hooya!.com> wrote in message news:...
> On Thu, 14 Oct 2004 13:50:53 -0400, "Robert Aldwinckle"
> <> wrote:
>
>>> Bottom line, how can I know if this update is actually in progress, or
>>> is installed?
>>
>>Check the logs:
>> %windir%\SoftwareDistribution\ReportingEvents.log
>> %windir%\WindowsUpdates.log
>>
>>Those are just summaries of what was done.
>>You can do even more detailed checking by what changed in that
>>subdirectory and examining those files (e.g. *.cab and .xml)
>>
>>If there is an update in progress you may see wuauclt.exe
>>active in Task Manager's Processes tab. Notice its PID;
>>you will see it referred to in the logs. Also try the command
>>
>> bitsadmin /list
>>
>>(in a command window) for clues.
>>
>>
>>Good luck
>>
>>Robert Aldwinckle
>>---
> I experienced the same problem as the original poster when
> I attempted to install 834707.
> My automatic options are also set to "notify but don't
> automatically download"
> The "notification" worked, I selected the fix, then the ! icon
> disappeared, nothing further happned as far as I can see.
> Later last night I used windowsudate manually and it installed fine.
> I looked in the logs, but I was unable to determine anything
> definitive. Perhaps I'm not familiar enough with them:
> http://home.comcast.net/~davetest/WindowsUpdate.log
> http://home.comcast.net/~davetest/ReportingEvents.log
> Dave
>

On Thu, 14 Oct 2004 22:25:48 -0400, "Robert Aldwinckle"
<> wrote:

>> The "notification" worked, I selected the fix, then the ! icon
>> disappeared, nothing further happned as far as I can see.
>> Later last night I used windowsudate manually and it installed fine.
>...
>> http://home.comcast.net/~davetest/WindowsUpdate.log
>> http://home.comcast.net/~davetest/ReportingEvents.log
>
>Yes. I see what you mean. Your ReportingEvents.log shows
>the first instance of 834707 at 2004-10-13 16:32:08-0700
>
>Your WindowsUpdate.log shows that it was first detected
>and downloaded at 2004-10-13 09:05:14-0700
>
>Here is what happened after that:
>
><extract>
>2004-10-13 09:05:27-0700 632 528 AU received event of 0
>2004-10-13 09:11:18-0700 1032 418 0 updates are ready to be installed at shutdown.
>2004-10-13 09:11:19-0700 632 27c Service received logoff notification
>2004-10-13 09:11:19-0700 632 528 AU received event of 3
>2004-10-13 09:11:24-0700 632 5e8 AU Restart required....
>2004-10-13 09:11:24-0700 632 528 AU received event of 1
>2004-10-13 09:11:24-0700 632 528 ISusInternal API CClientCallRecorder:isconnectCall succeeds
>2004-10-13 09:11:24-0700 632 528 AU is paused, not initializing any handlers
>2004-10-13 09:11:25-0700 632 27c Service received SERVICE_CONTROL_SHUTDOWN control
>2004-10-13 09:11:25-0700 632 528 Exiting Service Main
>2004-10-13 09:11:25-0700 1800 70c Out of proc datastore is shutting down
>2004-10-13 09:11:25-0700 632 528 WUAUENG ServiceMain exits. Exit code is 0x240001
>2004-10-13 09:12:08-0700 632 540 Service Main starts
></extract>
>
>Here are the details that I think are significant and interesting:
>1. What happened in those 6 minutes between 09:05 and 09:11?
> One can imagine that perhaps there might have been a clickable icon
> in the SysTray then. It wouldn't install right away because it would be
> waiting for you to say Ok. Did you check to see if it was hidden?
> (Mine usually is and I frequently forget to check for it. Also the little
> beep that it had with V4 may be less reliable with V5.)
>2. Which process was 1032 and which process was 1800?
> Usually it is wuauclt.exe. Were there two of them?
> Which account(s) would they have been using?
>3. Then 30 seconds later it is as if a new detection cycle is starting.
> Were you doing anything which might have accounted for that?
>
>I suspect that if you had just waited for the next detection cycle
>perhaps after the next boot that it might have noticed that it could
>offer you something to install and given you a beep then.
>(That's even the way that V4 sometimes used to work for me.)
>
>I believe you may also be able to hurry the process by Run...
> wuauclt /detectnow
>However, I have not experimented with that command myself yet.
>In any case I think I would only try it if there was no other wuauclt.exe
>already active.
>
>
>HTH
>
>Robert
Hi Robert, appreciate very much your attempted analysis.
This is the only time I've seen AU in "action", having
enabled it for the first time a week or two ago when I
installed SP2.
Regarding that 5 minute gap at the beginning, I think I waited to see
what would happen (nothing did) so I reboted. As far as it being
hidden, never experienced that before, how do you check?

I got it to redetect 2 or 3 times using a method I saw mentioned
in a KB article somewhere:
control panel/automatic updates/select "turn off automatic updates"/
apply. Wait 10 seconds or so,
reselect your original setting (mine was Notify Me)/ apply
and after a few seconds, the ! icon reappeared to "notify"
of the availabilty of the updates again.
Then the whole sad state of affairs just repeaed as before.
Not sure about what happened after 30 seconds, unless it
did something by itself after I rebooted.

Unable to identify process 1032 and 1080, since rebooted
and no such PID today.

Cheers,
Dave

On Thu, 14 Oct 2004 18:57:25 -0700, Jentle Jiant <>
wrote:


>Thanks for the feedback.
>
>The update started about 12 hours after I posted my request. It took
>over 10 hours! to finish!!!
>
>(note to daveexnet02: I was hesitant to do what you did. Not knowing
>if the download might be in progress, It seemed potentially
>problrmatic to update manually. Obviously I could have. I probably
>will do ALL my updates that way in the futurel)
>
Hi Jentle Jiant,
thanks for the update. to add insult to injury, during the
windowsupdate manual install, the AU ! icon suddenly reappeared
notifying me of the same fix's availabilty!
I guess WU woke it up! I just ignored it and it went away.

regards,
Dave

"davexnet02" <davexnetzerotwo@hooya!.com> wrote in message
news:
....
> Hi Robert, appreciate very much your attempted analysis.
> This is the only time I've seen AU in "action", having
> enabled it for the first time a week or two ago when I
> installed SP2.
> Regarding that 5 minute gap at the beginning, I think I waited to see
> what would happen (nothing did) so I reboted. As far as it being
> hidden, never experienced that before, how do you check?

In the SysTray if you have two chevrons << hold your mouse over
them and the SysTray will expand, showing you any hidden notifications.
In my case AutomaticUpdates is ususually hidden.

I just realized that that may be my fault. You can check what the icon
behavior is in the Taskbar and Start Menu Properties
Customize Notifications dialog. I just changed mine to Always show.
I'll wait to see if that makes AU seem better behaved.
(Keystrokes: Win,Menu,r,Ctrl-Tab,C,...)


>
> I got it to redetect 2 or 3 times using a method I saw mentioned
> in a KB article somewhere:
> control panel/automatic updates/select "turn off automatic updates"/
> apply. Wait 10 seconds or so,
> reselect your original setting (mine was Notify Me)/ apply
> and after a few seconds, the ! icon reappeared to "notify"
> of the availabilty of the updates again.

I think that I would have used that /detectnow switch that I mentioned
or restarted the Automatic Updates service (each 1 command instead of
several). Run... services.msc to do the latter.


> Then the whole sad state of affairs just repeaed as before.
> Not sure about what happened after 30 seconds, unless it
> did something by itself after I rebooted.

I think the sorriest thing is that the log isn't clearer about what
is going on. I suspected that those entries were indicating
that manual intervention was being used but I don't see why
it couldn't explicitly have said so and removed my doubts.


>
> Unable to identify process 1032 and 1080, since rebooted
> and no such PID today.

As I mentioned the only way to be certain of knowing what
these were (again due to deficiencies in the log IMO) would
be to have been running FileMon monitoring accesses
to SoftwareDistribution, unless you just happen to catch them
by intently watching Task Manager's Processes tab and try to
make note of all changes by PID.


>
> Cheers,
> Dave
>
>


HTH

Robert
---

"Jentle Jiant" <> wrote in message
news:...
> On Fri, 15 Oct 2004 08:50:36 -0400, "Robert Aldwinckle"
> <> wrote:
....
>>In the SysTray if you have two chevrons << hold your mouse over
>>them and the SysTray will expand, showing you any hidden notifications.
>>In my case AutomaticUpdates is ususually hidden.
>
> In my situation there was no chevron, no icon of any kind after I
> clicked download. That is why I posted my question. There was
> absolutly no indication that the update was in progress, until some 12
> hours later.
>
> (Again I say, some reasonably informative feedback message from
> Windows Update would be most desireable if there is any delay or
> backup)

Have we seen your logs yet? You may have a completely different
symptoms details-wise but still trying to argue with me about the facts
based on the symptoms that Dave's log showed he has.

BTW making the icon Always show is going to make a big difference
for me.


>
>>
>>I just realized that that may be my fault. You can check what the icon
>>behavior is in the Taskbar and Start Menu Properties
>>Customize Notifications dialog. I just changed mine to Always show.
>>I'll wait to see if that makes AU seem better behaved.
>>(Keystrokes: Win,Menu,r,Ctrl-Tab,C,...)
>
> I do not see the options you describe.
> I get as far as "Keystrokes: Win,Menu,r,Ctrl-Tab.."
> When I hit "C", I get a beep.

Try Alt-C then. (It's the Customize... button in the Notification area.)


> I see no option available for "Custom Notifications".

That is the title of the dialog which the Customize... button brings up.


> In the "Notification" section of the Taskbar Properties, I see only
> "Show The CLock" (which is selected, & "Hide Inactive Icons" (which is
> not selected).
>
> Am I misunderstanding something?
> (I'm running WinXP Home, SP2 installed.)

Perhaps XP Home doesn't have the Customize... button?
(I'm using XP Pro + SP2.)


>
> Thanks
>
> Jentle Jiant


HTH

Robert
---

On Fri, 15 Oct 2004 17:37:56 -0400, "Robert Aldwinckle"
<> wrote:

>
>BTW making the icon Always show is going to make a big difference
>for me.
>
>
>>
>>>
>>>I just realized that that may be my fault. You can check what the icon
>>>behavior is in the Taskbar and Start Menu Properties
>>>Customize Notifications dialog. I just changed mine to Always show.
>>>I'll wait to see if that makes AU seem better behaved.
>>>(Keystrokes: Win,Menu,r,Ctrl-Tab,C,...)
>>
>> I do not see the options you describe.
>> I get as far as "Keystrokes: Win,Menu,r,Ctrl-Tab.."
>> When I hit "C", I get a beep.
>
>Try Alt-C then. (It's the Customize... button in the Notification area.)
>
>
>> I see no option available for "Custom Notifications".
>
>That is the title of the dialog which the Customize... button brings up.
>
>
>> In the "Notification" section of the Taskbar Properties, I see only
>> "Show The CLock" (which is selected, & "Hide Inactive Icons" (which is
>> not selected).
>>
>> Am I misunderstanding something?
>> (I'm running WinXP Home, SP2 installed.)
>
>Perhaps XP Home doesn't have the Customize... button?
>(I'm using XP Pro + SP2.)
>
>
>>
>> Thanks
>>
>> Jentle Jiant
>
>
>HTH
>
>Robert
I checked my taskbar properties - I do not have "hide inactive icons"
selected. So I don't think the ! icon was hidden;
it merely disappeared for reasons known to itself,
apparently due to something after I selected the fix to download.

Dave

"davexnet02" <davexnetzerotwo@hooya!.com> wrote in message news:
....
> I checked my taskbar properties - I do not have "hide inactive icons"
> selected. So I don't think the ! icon was hidden;
> it merely disappeared for reasons known to itself,
> apparently due to something after I selected the fix to download.

Well, since you have finished your updates you could try clearing
the SoftwareDistribution directory for next time.
That's what I had to do to get my log looking cleaner.
I thought that your log looked pretty clean but if wuauclt.exe
is terminating prematurely that would be an equally undesirable
symptom. (A problem is that I have seen no documentation
yet on how it is supposed to work and I haven't had enough practical
experience either to know what log entries should be there which
aren't.)

In my case I think it may have been that having used it for XPsp2RC2
and not clearing it for XPsp2RTM (installed via CD) made it appear
corrupted.

I first followed the troubleshooter's suggestion to clear just the
DataStore and Download subdirectories

http://v5.windowsupdate.microsoft.co...cleid=11&ln=en

When that seemed to be insufficient I also cleared the EventCache,
as Torgeir sometimes suggests as an additional repair.

After that the log seemed clean but apparently for a long time there
wasn't anything for AU to do so it was impossible to know if it was
really working properly or not. That's why I have been advocating using
changed files in SoftwareDistribution as a means of checking on what
the log really means. Using FileMon is just another layer of that
which in addition makes clear which process is doing what, when.


HTH

Robert
---

On Sat, 16 Oct 2004 00:08:17 -0400, "Robert Aldwinckle"
<> wrote:

>"davexnet02" <davexnetzerotwo@hooya!.com> wrote in message news:
>...
>> I checked my taskbar properties - I do not have "hide inactive icons"
>> selected. So I don't think the ! icon was hidden;
>> it merely disappeared for reasons known to itself,
>> apparently due to something after I selected the fix to download.
>
>Well, since you have finished your updates you could try clearing
>the SoftwareDistribution directory for next time.
>That's what I had to do to get my log looking cleaner.
>I thought that your log looked pretty clean but if wuauclt.exe
>is terminating prematurely that would be an equally undesirable
>symptom. (A problem is that I have seen no documentation
>yet on how it is supposed to work and I haven't had enough practical
>experience either to know what log entries should be there which
>aren't.)
>
>In my case I think it may have been that having used it for XPsp2RC2
>and not clearing it for XPsp2RTM (installed via CD) made it appear
>corrupted.
>
>I first followed the troubleshooter's suggestion to clear just the
>DataStore and Download subdirectories
>
>http://v5.windowsupdate.microsoft.co...cleid=11&ln=en
>
>When that seemed to be insufficient I also cleared the EventCache,
>as Torgeir sometimes suggests as an additional repair.
>
>After that the log seemed clean but apparently for a long time there
>wasn't anything for AU to do so it was impossible to know if it was
>really working properly or not. That's why I have been advocating using
>changed files in SoftwareDistribution as a means of checking on what
>the log really means. Using FileMon is just another layer of that
>which in addition makes clear which process is doing what, when.
>
>
>HTH
>
>Robert
>---
>
Hi Robert,
thanks for the info. I've got a dual boot machine,
two installs of XP PRO. On the other install
automatic updates downloaded and installed this fix just
fine. AS was similar to the system with the error,
it was the first time I had used AU.

Any interest in looking at the good windowsupdate.log for
a comparison?

Dave