reading msi log file

  • Thread starter Brindha Ramakrishnan
  • Start date


Brindha Ramakrishnan


I have generated an msi log file using /L*v switch and i find number of
components that starts with the prefix "__" and ends with "65". For eg., for
a component, say abc.dll there is a corresponding __abc.dll65 component for
which the "Installed" state is Null and "Request" and "Action" are set to
Local. Here's the portion of the log file where these entries are present:

MSI (s) (18:34): Component: __viewit_shortcut65; Installed: Null; Request:
Local; Action: Local
MSI (s) (18:34): Component: __product_shortcut65; Installed: Null; Request:
Local; Action: Local
MSI (s) (18:34): Component: __licensemgr_shortcut65; Installed: Null;
Request: Local; Action: Local

I don't find these mysterious components when i view the same log file using
WiLogUtil.exe and i checked my .msi database too where i don't have these
components in the Component Table. Where are these coming from? Are these
getting generated by MSI engine? If so, for what purpose?

Also, i am interested to know what (s) and (18:34) in the above log file
messages mean?

Any insight into this is much appreciated.

Thanks in advance.




I have also noticed that MSI creates these __ components for each component
in your installer.Not sure why though.

The (s) stands for server. For actions in the UI sequence you will see a (c)
that stands for client.MSI launches the installer in the user context and
for the "actual install" part where the system is changed, it passes off
control to the service that could run with elevated privileges. You may also
sometimes see a (N) which stands for nested install. This will happen if
your MSI launches another msi as a nested installer. Most commonly you will
see this if you are doing a major upgrade and the previous version needs to
be uninstalled as part of your current install.

I am guessing the (18:34) is some kind of process or thread id.




Carolyn Napier [MSFT]

Naren is fairly close to figuring it out. Here's the decoder ring:

(c) denotes client (operations happening in the client engine)
(s) denotes service (operations happening in the Windows Installer service)

Note that control switches from the client to the service when the ExecuteAction
of the InstallUISequence table is processed. At that point, the Installer will
then start processing the InstallExecuteSequence table within the service. Once
that completes, execution will return to the client portion for the remaining
actions. In basic UI and no UI modes, processing basically occurs in the

(18:34) is a process ID and thread ID indication.

18 represents the last two hex digits of the process ID. 34 represents the last
two hex digits of the thread ID.

As for the "mysterious" components, those are auto-generated by the Windows
Installer engine for costing purposes. Not all components will have an
auto-generated equivalent, but suffice to say that their only primary purpose is
to help with evaluating associated disk cost and some internal feature/component
action state changes.

Hope this helps,
- Carolyn Napier
Microsoft Windows Installer Team

This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send email directly to this alias. This alias is for newsgroup
purposes only.


Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question