If you’ve ever wondered what USB devices have been connected to a shared or unattended Windows PC, USBLogView is exactly the tool you stumbled upon at the right time. It’s a free, portable NirSoft utility that quietly logs every USB connect and disconnect event, and it’s worth a look even if you only need it once.
What is USBLogView?
USBLogView is a lightweight, portable Windows utility from NirSoft (current version: 1.26) that runs in the background and records a timestamped entry every time a USB device is connected or disconnected. It logs the device name, event type, serial number, vendor/product IDs, and for storage devices, the assigned drive letter. It doesn’t require installation: just run the EXE and it starts logging immediately.
It’s useful for IT admins, home users who share a PC, or anyone trying to track down what’s causing repeated USB connect/disconnect sounds on their machine.
How to Set Up USBLogView on Windows 11 (or Windows 10)
NirSoft’s compatibility list runs through Windows 10. If using Windows 11, confirm that a test plug/unplug creates rows before relying on the log. USBLogView records events while running; it does not reconstruct activity from before it was opened.
Step 1: Download and run USBLogView
- Go to the NirSoft USBLogView page and download the zip file.
2. Extract the zip to any folder. Your Desktop works fine.
3. Double-click USBLogView.exe to launch it. There is no installation wizard. Windows may still show a security prompt; verify that the download came from NirSoft before opening it.
The main window starts logging right away. Plug in any USB device, a flash drive, a keyboard, a phone, and you’ll see a new row appear within a second or two.
Step 2: View device details
- Right-click any entry in the list and select Properties, or select a row and click the Properties button in the toolbar.
The Properties panel shows everything USBLogView captured about that device: vendor and product IDs, serial number (when the device exposes one), device type, and the drive letter if it’s a storage device. This is particularly useful when you need to identify exactly which device triggered an event. It’s especially handy if you’re seeing phantom connect/disconnect sounds from a dock or hub.
Step 3: Run USBLogView in the background via the system tray
- In the menu bar, click Options.
2. Select Put Icon On Tray.
3. Close the main window. USBLogView keeps running and logging in the background.
The tray icon is easy to miss. Check the hidden icons area in the taskbar if you don’t see it immediately. Click it to bring the main window back up at any time.
Step 4: Enable persistent file logging (recommended)
By default, USBLogView only keeps the log in memory. If you close it, the history is gone. To save events to a file automatically:
- Press
F9to open Advanced Options.
2. Enable the option to add every plug/unplug event into a log file.
3. Set the log file path to somewhere you’ll remember, like C:\Logs\usblog.txt.
4. Click OK.
This feature was added in version 1.25 and is genuinely useful if you’re monitoring a shared PC over several days. The log file appends each new event, so you don’t lose history between sessions.
Step 5: Export the log
- Select the log rows you want to export.
- Press Ctrl + S to open Save Selected Items.
- Choose an available format such as CSV, tab-delimited text, XML, or HTML, then save the file. The exact menu labels can vary by version.
The HTML export is nicely done. It produces a clean, readable table that’s easy to share or attach to a ticket. CSV works well if you want to pull the data into Excel for filtering.
Step 6: Customize the columns
- Click View in the menu bar and select Choose Columns.
2. Check or uncheck columns to match what you actually need. For most use cases, Event Time, Event Type, Device Name, Drive Letter, and Serial Number are enough.
3. Click OK.
A note on modern USB setups
If you’re using a USB-C dock, Thunderbolt hub, or a multi-port adapter, you may see more events than expected. Docks re-enumerate their connected devices when power cycles or when Thunderbolt authorization kicks in. That’s normal behavior, not a sign that USBLogView is misbehaving. It’s actually useful: those repeated events are exactly what USBLogView is good at surfacing, so you can pinpoint which port or device in the chain is causing problems.
Alternatives worth knowing about
USBLogView is the simplest option for local, single-machine logging. If your needs are different, here’s what actually works better:
- USBTreeView: better for visualizing the full USB hardware topology. It’s useful when you’re troubleshooting a dock, hub, or controller rather than just reading an event log.
– Windows Event Viewer: built-in and requires no download, but the USB event format is harder to read and less convenient for a quick timeline.
– ManageEngine ADAudit Plus (and similar tools): the right choice if you need centralized, fleet-wide USB auditing for compliance. It’s overkill for a single PC, but a gem for enterprise environments.
Conclusion
USBLogView is a clever little tool that does exactly one thing well: it tells you what USB devices have been connected to a Windows machine and when. For most people, Steps 1–3 are all you need. Download, run, and minimize to tray. If you’re monitoring a shared PC over time, enable the file logging in Advanced Options (Step 4) so you don’t lose history between sessions. Spreading the word on this one is easy to justify. It’s free, portable, and takes about 90 seconds to set up.