"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
0answers
14 views

What if Security ID and Account Name differ on Windows Security Event Log

the latest MS Kerberos Vulnerability let us search our Security Event Logs for potential attackers. According to a technet article, to identify an attacker you have to search for non matching security ...
0
votes
1answer
24 views

Task scheduler not logging failure to operational view in event viewer

The task scheduler below clearly errors but it never shows up under the task scheduler operational view as being failed but completed successfully. I want to send an email on a failed task scheduler ...
2
votes
1answer
60 views

Remote Desktop to local PC

In our organization we have a control that watches users who use high privilege Active Directory accounts to RDP into any server or workstation on our network. I recently enabled this control which ...
0
votes
1answer
112 views

Powershell use Get-WinEvent with hashtable to query very specific time range

I'm trying to make a powershell script that essentially automates the account lockout tools. ideally I'll be able to get a fairly efficient query that can identify recently locked out accounts then ...
0
votes
2answers
32 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
0
votes
1answer
92 views

Event ID: 2002 Source: IIS-W3SVC-PerfCounters on Windows Server 2012

My server is showing on Event Viewer this error every hour. Log Name: Application Source: Microsoft-Windows-IIS-W3SVC-PerfCounters Date: 03/10/14 9:07:42 Event ID: 2002 Task ...
0
votes
1answer
97 views

What time zone are the description timestamps in Windows Event log (UTC?)

Log Name: System Source: LsaSrv Date: <date> <time> Event ID: 45058 Task Category: Logon Cache Level: Information Keywords: Classic User: N/A Computer: computername.contoso.com ...
0
votes
1answer
60 views

How to find out file path of file on a network share drive?

I am using a small .NET application which integrates a file into another application, however, I keep getting the following error in EventViewer (part of the .NET application): "The specified path, ...
2
votes
1answer
127 views

Event ID 12240 on Windows Server 2012

I have a Windows Server 2012 and some virtual machines in it. Since last week some error events appears hourly on event viewer saying that the system cannot find a remote VHD file. This VHD file is ...
0
votes
0answers
8 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
3answers
82 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
1
vote
0answers
28 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
2
votes
1answer
646 views

Event Viewer Warning: “Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057”

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
0
votes
1answer
40 views

Log Parser: Getting Unique Record Numbers

I've been playing with Log Parser the past few days, we're trying to retain specific event IDs from the security logs of our Domain Controllers. As these are high traffic volume logs, the data in them ...
1
vote
0answers
154 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
0
votes
0answers
191 views

Event Log service broken on Windows 8.1 dev machines

On two separate Windows 8.1 installations with Visual Studio 2013 installed, the event log service errors on any attempt to read from/write to it. When I open Event Viewer I get this message when ...
0
votes
0answers
59 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
2
votes
1answer
69 views

How to find core dumps mentioned in event log

When I search for the files the event log mentions they are not there. Well, the bottom one is there but there's no helpful information in that file. This event was created by the Windows Error ...
2
votes
1answer
273 views

WMI command line event log acess

Can someone explain me how to get access to arbitrary system logs in eventlog service files? Now I'm poking around WMI(wmic.exe) and trying to execute following commands: For system services like ...
1
vote
3answers
76 views

Event logs saved on network share

I'm currently working on a project and having problems with saving event logs where i specify them. My problem is i want to have them saved on our file-server in a specified folder, however they wont ...
1
vote
1answer
67 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
161 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
3
votes
2answers
311 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...
2
votes
1answer
280 views

Windows Forward Events Missing User Data and Description

I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section. The Subscription Event ...
0
votes
0answers
55 views

Backup program completely disappeared over the weekend

Good morning everyone, I got an email on Friday from my backup software telling me I had some minor errors. I got in today and went to fix the errors but couldn't find ANY trance what so ever of the ...
2
votes
1answer
51 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
1
vote
2answers
434 views

Write to Windows Event Log when an IIS site is started or stopped

Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
1
vote
1answer
195 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
0answers
109 views

Customer Experience Improvement sent to Microsoft failure Error 90080108

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 90080108). I'm seeing this error event on a lot of Windows 7 PCs. Once it appears it seems to ...
2
votes
1answer
293 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
9
votes
1answer
832 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
0
votes
0answers
205 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
0answers
80 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
1
vote
3answers
440 views

Window's native event forwarding directly to a syslog\sql server

Right now I have events being forwarded to a collector on which I then run a script to pull them out of the collector's event logs as xml and then insert them in a DB. Is there any utility that knows ...
0
votes
1answer
69 views

Can you view an individual events size in the Windows Event Log?

I'm currently using Windows 2008, and would like to view an individual event's size in the Windows Event Log (Application, Security, System logs). I have tried right clicking and selecting ...
0
votes
1answer
87 views

Windows 2003 Ntfs error Event 55 every 15 minutes

I have Windows 2003 with four errors every 15 minutes in my EventLog. The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume I ran chkdsk and ...
0
votes
0answers
9 views

Feature 'SpellingFiles_ESN' does not exist

I'm getting lots of MsiInstaller warnings posted in my event logs for the following error - Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'SpellingFiles_ESN', component ...
2
votes
1answer
236 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
3
votes
2answers
7k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
1
vote
1answer
92 views

How can I list the Source Network Address for failed FTP attempts in the Security Windows Log on Windows Server 2008 R2?

I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as ...
2
votes
1answer
699 views

wevtutil requires Run As Admin for Security log (but not for System), or how to Run As Admin for Task

I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary: wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1 I'm making a batch file ...
1
vote
1answer
299 views

How to get application for application event log

I have some servers that are commonly having error 1000s. I want to find if it's the same application all the time, or if it's different applications. I am using this: Get-EventLog application 1000 ...
0
votes
1answer
23 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
3
votes
0answers
57 views

Logging a list of Worker Process Requests when Application Recycle happens

Does anyone know of the best way to log all work process requests that are currently running when an IIS recycle happens. If you go to IIS > Worker Processes > Select an app pool > View Current ...
2
votes
1answer
23 views

How to make advanced audit changes in 2008 (non-R2)?

I am trying to configure auditing settings across my domain. My domain controllers are Windows Server 2008 and the rest of my environment is either 2008 or 2008 R2. Some of the audit policies I need ...
1
vote
1answer
200 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
3
votes
1answer
40 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
2
votes
1answer
888 views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
0
votes
0answers
27 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
2
votes
2answers
1k views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...