"Event log" usually refers to the system/server logs on Microsoft Windows machines.
"Event log" usually refers to the system/server logs on Microsoft Windows machines.
Questions tagged [windows-event-log]
617 questions
0
votes
1 answer
How to filter Event Viewer for a single website?
I am trying to find out each concurrences for an error happening on a website I managed to create an XML query to filter by EventID
Corobori
- 123
- 6
0
votes
1 answer
Rsyslog not logging Windows Events
I am trying to configure sending Windows Events to rsyslog server, but rsyslog ignores them.
$EscapeControlCharactersOnReceive off
template(name="OnlyMsg" type="string" string="%msg:::drop-last-lf%\n")
module(load="imtcp")
input(type="imtcp"…
0
votes
1 answer
Annotate Windows event logs shipped with Windows Event Forwarding (WEF)
Looking for a way to annotate Windows event logs shipped with Windows Event Forwarding - specifically, looking to tag each log with the MAC address/es of the originating system. Would like to do this within WEF itself, but it does not appear…
Josh Brower
- 1,669
- 3
- 18
- 29
0
votes
0 answers
WEF error 5004 on server 2019
Having a really annoying issue with WEF configured in push mode on server 2019.
It is a domain controller, appropriate permissions are set on the logs and correct URL over HTTP for the subscription server. I know this because it is configured with…
user2782999
- 123
- 3
- 8
0
votes
0 answers
How to tell how long it took for a RDP Session to establish a connection?
Are there logs, or fields inside of logs that tell when the connection was initiated and established? Inside of Event ID 4624 there is a TimeCreated [SystemTime] field, but I am hoping to audit how long it takes to connect not just the time the…
user532115
0
votes
0 answers
Win32_NTLogEvent query rendering data with 1 hour latency with event viewer
Trying to collect the event log data with WMI query using class Win32_NTLogEvent.But this is not sync with event viewer data.The WMI query rendering data with 1 hour latency with event viewer.Hence unable to collect the as per poll interval.
This is…
0
votes
1 answer
wevtutil without admin permissions
Is it possible to install a provider without admin permissions?
whenever I try something like wevtutil im MyManifest.man I got 'Access is denied.'.
If I run the same command in an admin command prompt it works.
bones.felipe
- 103
- 2
0
votes
2 answers
Is there unique information or other reasons a Windows event 'Message' should not be discarded?
Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system?
Is it the case that these are composed of data from other attributes, for localization/readability, and could be…
Cookie Monster
- 182
- 1
- 2
- 9
0
votes
1 answer
Windows - Alert on Event Log failure
I need to display a local alert when Windows Event Log fails. Other than creating a script that is triggered as part of the service recovery options, is there another way to accomplish this?
xCritical
- 21
- 1
0
votes
0 answers
Event log error for Microsoft-Windows-Perflib ID 1008
I started seeing the following error in my Windows Server 2012 event application logs somewhat recently, possibly after installing some Windows updates.
Log Name: Application
Source: Microsoft-Windows-Perflib
Date: …
wrieedx
- 750
- 3
- 11
- 23
0
votes
1 answer
Where are Windows Event Forwarding (WEF) subscriptions filters applied?
I configured Windows Event Forwarding (WEF) in my LAB domain and I'm setting up subscriptions. My subscription is configured on my DC and is source-initiated, the collector is DC01.acme.com and sources are WIN7.acme.com and WIN10.acme.com. Suppose I…
JChris
- 103
- 3
0
votes
0 answers
Bad password on Domain Admin from Unknown Workstation
I'm trying to trackdown the Computer/Device that has a bad password for one of our Domain Admin accounts that gets used as a shared/service account.
The only details I have is a recurring event in the event viewer on our domain controllers. It…
Gre
- 85
- 4
- 13
0
votes
1 answer
Forward Windows 2012 event logs from workgroup host to domain host
Is this possible? I've gone through the following but no events are forwarded.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748890(v=ws.11)
I have a DMZ server that I want to forward logs from…
William Jens
- 191
- 9
0
votes
1 answer
EventId 4625 without IP Address in Windows Server 2012 R2
I am registering all RDP logon failures on my Windows servers through the IP address.
In Windows Server 2012 R2, in Event 4624 the Event Viewer shows me the IP, while in Event 4625 it does not. I tested it on Windows 10 and it shows me the IP in the…
Bruno Gomes
- 11
- 1
0
votes
1 answer
dashboard to show eventlog errors, warnings (traces) etc.
i'm after a dashboard (tfs?) to show what's currently going on with my MVC website. We write errors to the event log, and I duplicate that to a trace which I'm displaying 'live' with dbgview but I'm after something a bit more polished. What should I…
timB33
- 111
- 4