How many times you have been looking for SMSTS.LOG checking all possible locations, finally finding the wrong version, because time in Win PE is off?
Finally, the pain is over! Attached script, ZTITrace32.wsf will open them for you automatically. See the picture.
How it works.
- Script Starts another copy of itself in "TSR" mode and terminates
- the new copy looks for trace32.exe in a path - IMPORTNAT, you need to inject right version of trace32 (x86/x64) to your Windows directory on you boot image
- trace32 is getting registered, so it won't ask to associate itselsf with logs
- Input variable LogsToMonitor, which is comma separated list, is getting parsed
- WMI Notification Query to launch on changes in those files is getting registered
- When change occurs, script checks, if there is a trace32.exe with this log is open, if not -
- Script launches trace32.exe with that log. in PE it starts it minimized, in live OS - normal, because you won't see minimized programs in Winlogon session