Hi,

By tracking some events I was able to monitor Windows 7 Backups. By means of of schedule task triggered by the events belows.

• Image Backup successful : Event log : Microsoft/Windows/Backup/Operational. Source : Backup. Event ID : 14.
• Profile Backup successful : Event Log : Application. Source : Windows Backup. Event ID 4098

(BTW, the Microsoft/Windows/Backup/Operational log not holding all backup logging is a bit disappointing, to say the least.)

How can I monitor Windows 8 "File history" ?

I we keep the default "every hour" File History, the best approach is perhaps to track failures instead of success. Also because I haven't seen any event logged for a successful backup into the log : Microsoft/Windows/FileHistory-Engine/File history backup log/Operational.

When I disconnect the backup device I get and Event ID 203 in there, though.

What are other event IDs related to a backup failure ?

Is there a configurable Action Center notification on backup failure ?

• Edited by lolix2 21 hours 59 minutes ago

Hi,

Log files related to File History can be found in Applications and Service Logs -> Microsoft -> Windows. We found following two interesting event files:

• WHC under FileHistory-Core
• File History Backup Log under FileHistory-Engine

The entries of Information level in WHC appears whenever File History runs, stops, turns off or on. On the other hand, File History Backup Log records warnings or error messages, for instance, file was not backed up due to xyz error, unusual condition was encountered during finalization of a backup cycle for configuration, unable to scan user libraries for changes and perform backup of modified files for configuration.

For more information about file history, you can refer to this link:

Windows 8 File History Analysis

http://articles.forensicfocus.com/2013/11/24/2869/

Hope these could be helpful.