"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
0answers
30 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
0answers
80 views

Event Log service broken on Windows 8.1 dev machines

On two separate Windows 8.1 installations with Visual Studio 2013 installed, the event log service errors on any attempt to read from/write to it. When I open Event Viewer I get this message when ...
-1
votes
0answers
11 views

I'm looking for a piece of software that will take multiple windows event logs and combine them into one timeline [migrated]

Currently I have replication errors on a NAS and I'm trying to diagnose what the issue would be. Ideally I'd like a piece of software I could load several event logs (file replication, application, ...
0
votes
0answers
9 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
2
votes
1answer
34 views

How to find core dumps mentioned in event log

When I search for the files the event log mentions they are not there. Well, the bottom one is there but there's no helpful information in that file. This event was created by the Windows Error ...
2
votes
1answer
69 views

WMI command line event log acess

Can someone explain me how to get access to arbitrary system logs in eventlog service files? Now I'm poking around WMI(wmic.exe) and trying to execute following commands: For system services like ...
1
vote
3answers
50 views

Event logs saved on network share

I'm currently working on a project and having problems with saving event logs where i specify them. My problem is i want to have them saved on our file-server in a specified folder, however they wont ...
1
vote
1answer
36 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
95 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
3
votes
2answers
133 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...
2
votes
1answer
152 views

Windows Forward Events Missing User Data and Description

I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section. The Subscription Event ...
0
votes
0answers
47 views

Backup program completely disappeared over the weekend

Good morning everyone, I got an email on Friday from my backup software telling me I had some minor errors. I got in today and went to fix the errors but couldn't find ANY trance what so ever of the ...
2
votes
1answer
45 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
1
vote
2answers
133 views

Write to Windows Event Log when an IIS site is started or stopped

Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
0
votes
1answer
54 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
0answers
75 views

Customer Experience Improvement sent to Microsoft failure Error 90080108

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 90080108). I'm seeing this error event on a lot of Windows 7 PCs. Once it appears it seems to ...
2
votes
1answer
125 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
9
votes
1answer
404 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
0
votes
0answers
162 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
0answers
67 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
1
vote
3answers
193 views

Window's native event forwarding directly to a syslog\sql server

Right now I have events being forwarded to a collector on which I then run a script to pull them out of the collector's event logs as xml and then insert them in a DB. Is there any utility that knows ...
0
votes
1answer
45 views

Can you view an individual events size in the Windows Event Log?

I'm currently using Windows 2008, and would like to view an individual event's size in the Windows Event Log (Application, Security, System logs). I have tried right clicking and selecting ...
0
votes
1answer
68 views

Windows 2003 Ntfs error Event 55 every 15 minutes

I have Windows 2003 with four errors every 15 minutes in my EventLog. The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume I ran chkdsk and ...
0
votes
0answers
9 views

Feature 'SpellingFiles_ESN' does not exist

I'm getting lots of MsiInstaller warnings posted in my event logs for the following error - Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'SpellingFiles_ESN', component ...
2
votes
1answer
155 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
3
votes
2answers
3k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
1
vote
1answer
70 views

How can I list the Source Network Address for failed FTP attempts in the Security Windows Log on Windows Server 2008 R2?

I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as ...
2
votes
1answer
432 views

wevtutil requires Run As Admin for Security log (but not for System), or how to Run As Admin for Task

I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary: wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1 I'm making a batch file ...
1
vote
1answer
190 views

How to get application for application event log

I have some servers that are commonly having error 1000s. I want to find if it's the same application all the time, or if it's different applications. I am using this: Get-EventLog application 1000 ...
0
votes
1answer
20 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
3
votes
0answers
38 views

Logging a list of Worker Process Requests when Application Recycle happens

Does anyone know of the best way to log all work process requests that are currently running when an IIS recycle happens. If you go to IIS > Worker Processes > Select an app pool > View Current ...
2
votes
1answer
21 views

How to make advanced audit changes in 2008 (non-R2)?

I am trying to configure auditing settings across my domain. My domain controllers are Windows Server 2008 and the rest of my environment is either 2008 or 2008 R2. Some of the audit policies I need ...
1
vote
1answer
92 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
3
votes
1answer
38 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
2
votes
1answer
436 views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
0
votes
0answers
26 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
2
votes
2answers
759 views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
2
votes
1answer
114 views

Security Log - Overcrossing Maximum size limit

Please check the below print-screen. I have limit maximum log size at 80 MB, still the log size has gone till 10 GB, Why? do you have any idea, why it is happening and how to limit to 80 MB.
0
votes
0answers
40 views

How to record AD EventLog that LDAP authentication failure of account that does not exist?

I tried the LDAP authentication to ActiveDirectory from Linux. I was able to confirm that the authentication of the account to the existing successful / failure remains in the event log. But I do not ...
1
vote
1answer
106 views

How to record IIS 8 client authentication errors in Windows Events?

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some ...
-1
votes
2answers
172 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
1
vote
3answers
2k views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
3
votes
1answer
151 views

Using Powershell, compare the TimeCreated values of two events and take action if one is older than the other

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent): Get-WinEvent -FilterHashtable ...
0
votes
0answers
127 views

Windows server 2003. Windows search service error. Unable to initialize the filter host process

I was trying to install SQL server management studio 2008 on Windows Server 2003 SP2 x86 Standard edition and but I couldn't install it. I got an error saying install "Windows Installer 4.5" so I ...
1
vote
1answer
56 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
0
votes
1answer
475 views

Security has requested to process its policy settings again. Error

I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO. Security has requested to process its policy settings ...
1
vote
1answer
174 views

Automatic Saving of Windows Event Logs [closed]

I'm looking for a way to automatically save off Windows security event logs from several servers to one central location (connected on the network and domain). I want to be able to do this on a ...
0
votes
0answers
141 views

Simplify NXLOG Setup for me (or alternative)

I need to automatically save off my event logs. A coworker suggested doing this by using a piece of software called NXLOG. Unfortunately the manual for configuring NXLOG gets kind of complicated and ...
2
votes
1answer
225 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
1
vote
2answers
162 views

How to use imported text in a variable in powershell

I want an automatic AD unlock with some users. I use this to import the info in a text file Get-EventLog -LogName Security -ComputerName COMP -InstanceId 4740 -Newest 1 | Format-List >> ...