"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

4
votes
2answers
133 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
2
votes
2answers
180 views

What's this odd logon failure I see every day?

I'm having something weird happen on a Windows Server 2008 R2 server. Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
0
votes
2answers
201 views

Determine windows server attack? Should I monitor the server and block IPs all the day?

While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows: **An account failed to log on.** Subject: Security ID: SYSTEM Account Name: ...
2
votes
2answers
168 views

Event 34 on Windows 2008 R2 write cache and sysvol on system drive

I have Windows Server 2008 R2 running as Active Directory Primary Domain Controller. Since our domain is not large, I put the SYSVOL and NTDS folders in the default location on the system drive (SSD ...
0
votes
0answers
121 views

Create Windows 2012 Event Viewer custom view

I have folders that I'm tracking with object access auditing. I'd like to create a custom view to see just a specific folder path. I created a custom filter to just take the Object Access event ...
0
votes
1answer
78 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
2answers
359 views

Clean up event log by script

Any way to remove all entries from the Windows event logs (Application, System & Software) apart from the last 24 hours? Via command line such as batch file. On Windows 2008 R2 Server & ...
0
votes
2answers
70 views

Windows service restart source

I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
1
vote
1answer
604 views

security_error_ring_buffer_recorded in system health log - what does it mean?

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012. Today I was checking the log files located in: ...
1
vote
1answer
403 views

How to automatically backup Windows event logs?

There doesn't appear to be a way to backup (archive) Windows event logs automatically via the GUI. Is there a way via a script that can be set as a scheduled task to do this? If so, can someone ...
0
votes
1answer
154 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
4
votes
2answers
763 views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
0
votes
1answer
39 views

Group Policy Preference Event id in Window XP [closed]

Whenever Group Policy Preference get auto-update after 90 minutes interval on Window XP. Is there any event id generated or not in Window XP? Please answer in Yes or No. If yes than what is Event Id ...
1
vote
1answer
99 views

Group Policy Event id [duplicate]

DC - Windows Server 2008 R2 Client OS - Window XP Which Event id is generated on Window XP, if my Group policy preference is automatically updated after 90 minutes interval. Sorry, i tried to find ...
0
votes
1answer
102 views

Can eventvwr.msc's log files be exported to text or sql server in Windows?

Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files? Every search I do on Google for this returns how to export ...
1
vote
1answer
2k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
1
vote
0answers
284 views

What do these IPMI System Event Logs mean?

I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
3
votes
1answer
128 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
0
votes
1answer
2k views

Event ID 2013 (Disk Is At Or Near Capacity) not getting logged

I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is ...
0
votes
1answer
142 views

BINLSVC warning in event log - netclass.inf parsing Manufacture

So I am trying to get Remote Installation Service Running on a Windows Server 2003 R2 Standard Edition with Service Pack 2 installed. I am trying to integrate network drivers into the image and I keep ...
1
vote
0answers
19 views

Clear specific entries in Security Log, Event Log in Windows 8 [duplicate]

Possible Duplicate: How can I remove specific events from the event log in Windows Server 2008? Is it possible to remove specific entries in Event Log of Windows 8? Which tools could I use? ...
0
votes
1answer
122 views

SBS 2003 no network connection and acting strangely a bunch of Event ID 13568

I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
2
votes
1answer
171 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
1
vote
2answers
55 views

Lots of Failure Alerts on my DC

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit. Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
1
vote
2answers
461 views

Is it possible to export Windows event logs from multiple servers to a non-windows host, without running event manager on each of the Windows servers?

I want to export event logs from Windows to a non-Windows host. I was considering using Logstash, but that would seem to require that I install and run Logstash on each server. Is it possible to do ...
0
votes
2answers
779 views

how to open a saved eventlog file with display information

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
1answer
370 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
0
votes
2answers
514 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...
1
vote
1answer
216 views

Remote Desktop IP missing in Event Log

I was checking my remote desktop event logs and an entry is confusing for me. The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
0
votes
1answer
1k views

What would cause so many EventID 4656 PlugPlayManager Security Audit Failures at one time?

I found 141 PlugPlayManager Security Audit Failures logged within the same minute on one of our Server 2008 R2 servers (running only SQL 2008 R2). While Googling all I could find was other people, ...
4
votes
1answer
2k views

What are the differences between Windows EVT and EVTX log files?

Windows is moving to the *.EVTX format for their logging files, but we still have clients that have versions that write to the older *.EVT format. What are the differences in how those files are ...
2
votes
1answer
4k views

System Account Logon Failures every 30 seconds

We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
0
votes
1answer
2k views

Dell Open Manage message in Windows Event Log, should I be worried?

I have a Dell T110 server with a SAS 6i/R controller and two hard disks in RAID 1. Ocasionally a warning appears in the Windows Event Log with the following message: SAS port report: SAS wide port ...
1
vote
2answers
501 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...
3
votes
2answers
77 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
0
votes
2answers
1k views

Permissions needed to read event log messages remotely?

When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error: The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
1
vote
0answers
215 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
2
votes
2answers
1k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
5
votes
2answers
2k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
2
votes
1answer
50 views

How can I remove the sorting in the Event Log?

I made the mistake of clicking the Date and Time column in the event log. Now, whenever I open that log, it takes like 10 seconds for it to sort all entries. This is highly annoying, especially since ...
2
votes
1answer
300 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
3
votes
1answer
190 views

Audit when users log on and off servers

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)? ...
1
vote
0answers
85 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
0
votes
1answer
163 views

auditpol starting infinite loop in command prompt

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors. I did some troubleshooting around the internet and found out that I should stop auditing a ...
2
votes
1answer
366 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
0
votes
1answer
3k views

NETLOGON Event Warning Dynamic Registration 5781

I've set up a couple of Domain Controllers and the first DC I set up is taking a while to start up and occassionally displaying a warning in the Windows Event Log that I think may be related to the ...
6
votes
2answers
11k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
0
votes
1answer
80 views

Do Windows Events from the Windows Event Log have sensitive information?

I'm looking to start a service where I collect Windows events from consumer computers over an SSL link (https) but I want to make sure that extremely sensitive information wouldn't be contained in the ...
2
votes
1answer
890 views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
3
votes
1answer
12k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...