Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [eventviewer]

This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

This tag is for questions about Windows' Event Viewer and Event Logs. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

Event Viewer has three primary logging areas:

  • Application
  • Security
  • System

Recent Versions of Windows (Vista and later / Server 2008 and later) have a large number of additional log areas.

Most Windows components (such as services) log to the System log, with notable exceptions being IIS and user-related operations (such as folder redirection at login) which log to the Application log. Programs that you write should log either to their own log areas or to the Application log. The Security log records successful and failed logins.

See also:

202 questions
3
votes
3 answers

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? Between Maximum log size of 1 GB or Retain Log to 30…
Param
  • 1,357
  • 14
  • 36
  • 52
3
votes
2 answers

Can not see entries in Application Log in Event Viewer

Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and mmc would crash whenever we tried to view the…
yakatz
  • 1,213
  • 4
  • 12
  • 35
3
votes
2 answers

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins learn what to look for in event viewer? Sometimes…
MetaGuru
  • 896
  • 6
  • 22
  • 36
3
votes
2 answers

Why are logon types on Domain Controller and Workstation different

When I logon to a specific machine in an Active Directory domain, the logon type recorded in Event Viewer is 10, but the same event log on the domain controller is 3. Why are the all of logon on the domain controller are logon type 3 while the logon…
Amin Mirzanejad
  • 43
  • 4
2
votes
0 answers

Windows not collecting logs. Error: The WinRM service is not listening for WS-Management requests

I am getting this error The WinRM service is not listening for WS-Management requests. User Action If you did not intentionally stop the service, use the following command to see the WinRM configuration: winrm enumerate…
Rajat jain
  • 121
  • 1
  • 5
2
votes
1 answer

IP Address Change event id for Windows 10?

Is there an event id / log / log source for when an ip, gateway, netmask changes in Windows 10?
leeand00
  • 4,869
  • 15
  • 69
  • 110
2
votes
2 answers

Is it possible to view events from all event logs (including "Applications and Services Logs") simultaneously?

One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-Q1 strain of the Dharma ransomware). Fortunately…
Dai
  • 2,290
  • 8
  • 27
  • 43
2
votes
1 answer

Event log subscription returns error code (0x138C)

I have been battling getting event log subscriptions to work on my Server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults whenever possible. I selected my desired events and…
PenNerd
  • 21
  • 1
  • 1
  • 2
2
votes
1 answer

Domain member server causing continuous login failure for Administrator account

One of our domain member servers keeps producing continuous login failures (caught in Event viewer via Audit Policy) almost every minute. Here's a typical failure log (names & IPs obfuscated): Event Type: Failure Audit Event Source: Security Event…
miCRoSCoPiCeaRthLinG
  • 283
  • 1
  • 5
  • 17
2
votes
3 answers

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice / help would be greatly…
Samuel Pardee
  • 33
  • 1
  • 1
  • 4
2
votes
1 answer

Windows event log exclude user

We're running Windows 2012 with AD LDS (aka ADAM). We're troubleshooting an application, and the ADAM sync command that runs hourly is filling up our event log. The event viewer filters show how to exclude criteria for event IDs, but not how to…
bgStack15
  • 1,111
  • 1
  • 12
  • 23
2
votes
1 answer

Save Custom View from Event Viewer in .evtx

I have a Custom View in the Event Viewer with a couple of Event id's. I know you can save those event id's in an .evtx file to open it. This proces has to be executed manually. Now is my question, how can I automate this? Through a PowerShell script…
user3603657
  • 73
  • 2
  • 7
2
votes
1 answer

Backup/export custom view automatically from Event Viewer

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically my own whole custom view log with event id's.
user3603657
  • 73
  • 2
  • 7
2
votes
1 answer

Offline Windows Event ID Solution?

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for the reason of a unique event Id . I wish my…
nux
  • 121
  • 2
2
votes
0 answers

Powershell 3.0 Enter-PSSession fails randomly, reboot solves it. DCOM error in Event Viewer on target machine

Using PowerShell's Enter-PSSession (even locally, against the local computer) fails randomly with the following message. Running Windows 2012 Standard with all updates. The error message takes a while to show up. Command: Enter-PSSession…
Ricardo Pardini
  • 776
  • 7
  • 9
1 2 3
…
13 14