Which Windows 7 log file contains device connection/disconnection information?
There IS a log file of all device connections and disconnections, in %SystemRoot%\inf\setupapi.dev.log . It is semi-readable text. It contains reports for all devices, not just USB.
Open it in Notepad (or Notepad++ or vi or ex or...), scroll to the bottom, and note that the output for each new device is separated from the previous by a couple of blank lines. The most recent will be at the end. There are timestamps.
If the text doesn't tell you what device(s) are trying to connect, then look for lines like this:
dvi: Searching for hardware ID(s):
dvi: usb\vid_1532&pid_0021&rev_0200&mi_00
dvi: usb\vid_1532&pid_0021&mi_00
and search on the web for vendor ID 1532; then, from likely-looking pages, product ID 0021 (the revision code and the rest of the strings don't matter).
n.b.: There are a large number of sites out there that try to provide this information. Many of them offer driver downloads. Do not download any drivers from anywhere except a) Microsoft update or b) the web site of the company that made your device.
try using USBLogView
These type of event don't always get registered. However, if it is a system event that IS registered by the OS itself, it would be in your Event Viewer under either Custom Views\Administrative Events
or Windows Logs\System
or possibly Windows Logs\Application
depending on the type of events: hardware, drivers, etc.
Now if its done by an application, such as ImgBurn revving up the optical drive to read/rip or write/burn something, it would be strongly dependent on the developer/vendor and if they have chosen to register events and to what extent. If they do register events, they would appear under Applications and Services Logs
generally corresponding to the applications name.
Finally, if you KNOW the type of event you are trying to capture, you can create a custom view report under event viewer and set the event level, source it either by log (predefined) or by source to specific element (much more granular), and even if you want to add keyword (use only if you know the event name you are trying to capture). Do what you need to do after you create that and go back and see what it captured for you.
Hope that helps.