What and where is the "system log" for EC2 windows instances?

I ran into the same issue and got the same result. So if you look at

C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Get-ConsolePort.ps1 that is where you see that error on line 174.

Write-Log "ACPI SPCR table not found. Bailing Out"

Now if you look at the above if statement causing that you will see this line of code

$SPCRReaderExeDir = "$env:ProgramData\Amazon\EC2-Windows\Launch\Scripts"
    if (Test-Path -Path $SPCRReaderExeDir)
    {
        $SPCRReaderExePath = Join-Path $SPCRReaderExeDir "AWSAcpiSpcrReader.exe"
        $SPCROutput = cmd /c $SPCRReaderExePath

        # Parse the SPCR output and extract key fields such as Vendor ID, Device ID, BDF.
        $Dictionary = @{ }
        if ($SPCROutput -match 'SPCR table signature')
        {

I am 90% sure AWSAcpiSpcrReader.exe is used with the huge

# SIG # Begin signature block

at the end of each file and is used to validate that it is an allowed thing.

I am trying to copy the block into my user data but I think it will probably be too large so. It may be that if I import from S3 I can put the sig block there but I'm not sure. I am not a powershell person so we'll see.

HAHAHAHAHHA IT WORKED!! 2020/06/11 02:17:14Z: Message: Windows is Ready to use

2020/06/11 02:17:24Z: Message: OMGOMGOMG

Now, it is possible that block is generated every time the instance is built so we may have to somehow grab that block and import it to the userdata script. Or maybe when a new release is made. Unknown. Point is, the sig may change.

Excellent question. I have been struggling for months with seeing anything useful in that log for new Windows instances so I had to dig in. I'd like to post status messages there from provisioning scripts.

This is output from a serial console. I think Amazon set it up to be sort of like a Linux console, or maybe it's some ancient part of Windows. EC2Launch writes to it via a COM port.

You can see some examples by reading the code in _C:\ProgramData\Amazon\EC2-Windows\Launch\Module_ on a newer Windows instance.

An example that does effectively write during boot for some of the instances I have handy C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\SendWindowsIsReady.ps1

There's another script that's supposed to copy errors from the System event log to it, C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\SendEventLogs.ps1 ... I think that must be what the "last three system event log errors" documentation is referring to. But I've never been able to get that to show anything I wanted to show like progress of my userdata script.

I'm having a lot of trouble writing anything to the console. Maybe it's only accessible during boot or something. I'm trying things like,

Import-Module C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Ec2Launch.psd1
Initialize-Log -Filename "testlog.log" -AllowLogToConsole
Open-SerialPort
Write-Log -Message 'hi from powershell' -LogToConsole

but I get this error from Open-SerialPort:

ACPI SPCR table not found. Bailing Out

From the EC2 panel select your EC2

Navigate in Action options => select Instance settings => get system logs.

There you can find logs of your system.