We should consider printing out certain event logs from the Windows Event Logs. Some good candidates are Application logs and System logs. They will tell us of events like disk defrag, windows update, hardware modifications, service start/stop.
We can also modify the registry to have the Application logs print why processes exit. (see linked ticket)
The implementation could be similar to how we use dmesg (
- Clear the logs at the beginning of a run: wevtutil clear-log Application
- Print out the logs at the end: wevtutil query-events Application with an optional grep mongo, if we only care about abnormally terminated processes, for example.