In this blog, I will be showing you how to track and check SCCM package deployment through SCCM client log flow. Once you understand the complete log flow and including all the log files installed during this process, it will become very easy to track package installation in case it fails. You will be able to understand what information is present in which log file.

Log files involved in SCCM package

Log files are your friend, the earlier we start looking into it to understand the flow, the faster we will be able to troubleshoot the issues. SCCM log files are located under c:\windows\ccm\logs. These are the few log files involved for troubleshooting purpose:


These are the log files involved for Configuration Manager Packages, if you are interested knowing Application Model flow through logs then you may check following link Track SCCM application deployment through client log flow.

Log flow sequence

To demonstrate, I have deployed a package with following details:
Package Name: 7-zip (Package)
Package ID: MAN00082
DeploymentID: MAN20052

TrackSCCMPackage 01

Explanation of Logs & flow

PolicyAgent.log – Once client receives the policy during next evaluation cycle, it downloads the policy, we can see the policy download happening in this log file.

Execmgr.log – Component name Execution Manager, I would consider this log file as a master. PolicyAgent component hands over to execmgr component and we see all activity happening in this log file which consists of displaying downloading of content, running the command line and finally showing an exit code which means success or failure of package.

Execmgr itself is not doing all the task, rather it hands over the download task to CAS.log.

CAS.log – Component name ContentAccess, this component is responsible for 2 tasks:

  1. To locate the content, CAS creates a request for Locationservices Component to get the DP location required for downloading the content.
  2. Once DP location is confirmed, CAS creates CTM Job for ContentTransferManager to download the content.

Apart from that CAS is also responsible for verifying the hash hash and integrity of the package. And provide the package download location to execmgr (example: c:\windows\ccmcache\6)

LocationServices.log – The only job of this component is to handover the package content location (on a DP) to CAS.log / ContentAcess Component.

ContentTransferManager.log CTM Job is received from CAS.log. ContentTransferManager further creates DTS Job for DataTransferService. Hence actual download is not happening through this component. ContentTransferManager shows the downloading status which comes from DataTransferService component.

DataTransferService.logDTS Job is received from ContentTransferManager. It shows the actual downloading of content either using SMB or BITS.

Following diagram might give you appropriate insight.

TrackSCCMPackage 08

Looking into the logs

I have captured the logs during package installation, this is what I see in each log file:


During Machine policy evaluation, policy arrived for the package MAN00082 and downloaded the policy successfully.

PolicyDownload: <File Source=".sms_pol?MAN20052-MAN00082-60F8A6B9.1_00" Destination="MAN20052-MAN00082-60F8A6B9.1.00.tmp"/>
Raising event: instance of CCM_PolicyAgent_PolicyDownloadSucceeded
Evaluating and applying policy 'CCM_Policy_Policy5.PolicyID="MAN20052-MAN00082-60F8A6B9",PolicyVersion="1.00",PolicySource="SMS:MAN"' to '\\.\ROOT\ccm\policy\Machine\RequestedConfig'
Applying policy MAN20052-MAN00082-60F8A6B9
Check SCCM Policy


PolicyAgent has handed over to execmgr component. We can see Content download status, once downloaded command line is executed for the package with existing content location ie. C:\windows\ccmcache\6. And once completed, returns exit code 0 which means success. If return exit code is 3010, it means reboot required. Execmgr has dependency on other components as well such as CAS.log, ContentTransferManager.log, LocationServices.log, DataTransferService.log.

Requesting content from CAS for package MAN00082 version 1. Content source flags 0x42
Successfully created a content request handle {B13D6BE6-09B9-4A4F-960C-FE67A646F742} for the package MAN00082 version 1
Creating mandatory request for advert MAN20052, program Install, package MAN00082
Executing program msiexec /i "7z1900-x64.msi" /q in Admin context
Execution Request for advert MAN20052 package MAN00082 program Install state change from Ready to NotifyExecution
Checking content location C:\WINDOWS\ccmcache\6 for use
Successfully selected content location C:\WINDOWS\ccmcache\6
Successfully prepared command line "C:\WINDOWS\system32\msiexec.exe" /i "7z1900-x64.msi" /q
Running "C:\WINDOWS\system32\msiexec.exe" /i "7z1900-x64.msi" /q with 32bitLauncher
Script for  Package:MAN00082, Program: Install succeeded with exit code 0
Execution Manager


CAS.log is showing the download request {B13D6BE6-09B9-4A4F-960C-FE67A646F742} created for LocationServices.log. Further CTM Job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} also submitted for ContentTransferManager.log. Once DP location is found we can see the result as$/man00082. And saved the content under c:\windows\ccmcache\6.

Submitted CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} to download Content MAN00082.1 under context System
Successfully created download  request {B13D6BE6-09B9-4A4F-960C-FE67A646F742} for content
Download started for content MAN00082.1
Location update from CTM for content MAN00082.1 and request {B13D6BE6-09B9-4A4F-960C-FE67A646F742}
   Matching DP location found 0 -$/man00082 (Locality: SUBNET)
   Download request only, ignoring location update
Download completed for content MAN00082.1 under context System
Hash verification succeeded for content MAN00082.1 downloaded under context System
Saved Content ID Mapping MAN00082.1, C:\WINDOWS\ccmcache\6
CacheManager: ADD new cache entry for id:MAN00082 Version : 1 Size : 1707K RefCount:1 LastRef Minutes : 0 State : ACTIVE PinDuration : 10832 Location : C:\WINDOWS\ccmcache\6
Download succeeded for download request {B13D6BE6-09B9-4A4F-960C-FE67A646F742}
ContentAccess Component


LocationServices component will return the Distribution Point list and hand it back to CAS.log



CTM Job has started and it further creates DTSJob and shows the different phases of download Status such as downloading, processing, preparing.

Starting CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834}.
Created CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} for user S-1-5-18
Queued location request '{4E754DF9-E5A4-44F3-BFDB-C7199C7ECF10}' for CTM job '{0FB80C20-1D44-44F2-8D24-143E7C3CC834}'.
Persisted locations for CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834}:
               (SUBNET) http://SCCM01.MANBAN.COM/SMS_DP_SMSPKG$/MAN00082
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} (corresponding DTS job {74D5E6C9-4A20-4908-96FD-7E80743BB6F6}) started download from 'http://SCCM01.MANBAN.COM/SMS_DP_SMSPKG$/MAN00082' for full content download.
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_MANIFEST
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} entered phase CCM_DOWNLOADSTATUS_PROCESSING_MANIFEST
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} entered phase CCM_DOWNLOADSTATUS_PREPARING_DOWNLOAD
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA
CTM job {0FB80C20-1D44-44F2-8D24-143E7C3CC834} successfully processed download completion.
TrackSCCMPackage 05


Download of data is shown in this log, we can see content is getting downloaded from ‘http://SCCM01.MANBAN.COM:80/SMS_DP_SMSPKG$/MAN00082’ to ‘C:\WINDOWS\ccmcache\6’.

DTSJob {2E4D7193-2AC9-499B-AC93-CD367F7C62DD} in state 'DownloadingData'.
DTSJob {74D5E6C9-4A20-4908-96FD-7E80743BB6F6} created to download from 'http://SCCM01.MANBAN.COM:80/SMS_DP_SMSPKG$/MAN00082' to 'C:\WINDOWS\ccmcache\6'.
DTSJob {74D5E6C9-4A20-4908-96FD-7E80743BB6F6} successfully completed download.
DTSJob {74D5E6C9-4A20-4908-96FD-7E80743BB6F6} in state 'NotifiedComplete'.
DTS job {74D5E6C9-4A20-4908-96FD-7E80743BB6F6} has completed: