1

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to understand what was occurring I attached a task to that event to send me an email if it occurred again.

I've been receiving emails all weekend, some 200 emails received since Friday evening, and they are still arriving.

This morning I've logged onto the server and opened event viewer and I cannot see any new instances of that event in the log viewer.

If i filter by event ID I can see the series of events from last week but nothing since then.

Get-Eventlog shows the same as the GUI viewer, ie no record of these events, and yet I am still getting the emails generated.

Everything else seems to be being logged as expected, as far as I can tell.

This is a Server 2008 R2 box runnin in an ESXi cluster, latest updates etc. Tools is up to date with ESXi (although I am going to move to 10.0.5 I think).

EDIT: WEVTUTIL qe APPLICATION >>ApplicationLog.log

I can now see the logs triggering hte event. Still no idea why these are not showing in the viewer.

13
  • I suspect that whatever Windows process is sending those emails has them queued somewhere, and possibly because of a slow mailserver is taking a while? Have they stopped by now?
    – Lucky Luke
    Apr 7, 2016 at 18:03
  • No, these are absolutely not queued. I'm still receiving them, some 27 received so far today. Mail server is capable of very high volume, and shows no queues. I am still convinced that these are still being generated by incidences of that event.
    – Patrick
    Apr 8, 2016 at 12:53
  • Don't the events have a timestamp associated with them? When were they generated? Why wouldn't you see them in the actual event logs? Are they coming from a standard log (e.g. Application, System) or from one of the newer Application/Services logs?
    – Lucky Luke
    Apr 10, 2016 at 23:55
  • > Why wouldn't you see them in the actual event logs? Yes, well thats what I'm asking isn't it, they aren't visible in event logs. As i say in the OP, these events were in the usual application log. Although I realise that they may be showing up in a different one, good point. I'll check now.
    – Patrick
    Apr 11, 2016 at 7:45
  • 1
    What's the output of WEVTUTIL GL Application? Apr 14, 2016 at 10:36

1 Answer 1

-1

It is most likely the Default setting for EventLog dropping off old items.

See my answer at: https://superuser.com/questions/1414698/does-windows-eventlog-drops-off-old-items-as-new-items-are-added

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .