"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

3
votes
1answer
40 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
2
votes
1answer
1k views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
0
votes
0answers
27 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
2
votes
2answers
1k views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
-1
votes
1answer
251 views

Security Log - Overcrossing Maximum size limit

Please check the below print-screen. I have limit maximum log size at 80 MB, still the log size has gone till 10 GB, Why? do you have any idea, why it is happening and how to limit to 80 MB.
1
vote
1answer
133 views

How to record IIS 8 client authentication errors in Windows Events?

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some ...
-1
votes
2answers
288 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
1
vote
3answers
3k views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
3
votes
1answer
184 views

Using Powershell, compare the TimeCreated values of two events and take action if one is older than the other

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent): Get-WinEvent -FilterHashtable ...
1
vote
1answer
60 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
1
vote
1answer
686 views

Security has requested to process its policy settings again. Error

I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO. Security has requested to process its policy settings ...
2
votes
1answer
291 views

Automatic Saving of Windows Event Logs [closed]

I'm looking for a way to automatically save off Windows security event logs from several servers to one central location (connected on the network and domain). I want to be able to do this on a ...
2
votes
1answer
451 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
1
vote
2answers
206 views

How to use imported text in a variable in powershell

I want an automatic AD unlock with some users. I use this to import the info in a text file Get-EventLog -LogName Security -ComputerName COMP -InstanceId 4740 -Newest 1 | Format-List >> ...
4
votes
1answer
399 views

Using Powershell, trigger an action if the most recent Event Log event is over one hour old

We have a server running our backup software, and the software has its own event log. I can retrieve the most recent event log entry with this command: Get-EventLog EventLogName -ComputerName ...
0
votes
3answers
531 views

Windows Server 2003: start program on event in event viewer

With windows server 2008 you can start a program using scheduled task triggered by event on event viewer. Is there a way to emulate this with Windows Server 2003? Thank you in advance
0
votes
1answer
59 views

Odds of a given Windows EventID to be unique for a Source?

I am using the basic NRPE plugins for Nagios to passively monitor Windows Eventlog. The plugin allows for an EventID exception list as a command argument. So, for instance, I can block any event that ...
3
votes
1answer
2k views

powershell Get-WinEvent cmdlt: Filtering by time-stamp not producing desired results?

I am trying to filter events via Get-WinEvent to get specific logs from the last 24 hours: $EventLogFilter = @{logname='ForwardedEvents'; id=4771,4625,4768; StartTime=(Get-Date).AddHours(-24)} ...
7
votes
1answer
826 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
1
vote
0answers
69 views

JAVA task reporting perodic file access issue but windows file auditing says it never tried?

Ok so you've got a JAVA task that reads a file on my local disk when it runs, it immediately closes the handle on the file right after it reads its, less than a second, nothing else on the entire ...
0
votes
1answer
147 views

Monitoring when users login to a Terminal Server

Really looking for some ideas (ideally nothing 3rd party based) that we could implement to monitor when users login to a Terminal Server (and log off if possible) so we can monitor activity. Thanks! ...
3
votes
0answers
443 views

What is a valid destination log for Windows event forwarding

I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid ...
1
vote
0answers
62 views

Getting iLO logs for a specific period

I am fetching iLO event logs remotely using cpqlocfg.exe and script Get_iLO_Log.xml. But this gives complete event logs and there is no parameter that can be set to get the logs only for a specific ...
0
votes
1answer
50 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
4
votes
2answers
238 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
3
votes
2answers
236 views

What's this odd logon failure I see every day?

I'm having something weird happen on a Windows Server 2008 R2 server. Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
0
votes
2answers
265 views

Determine windows server attack? Should I monitor the server and block IPs all the day?

While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows: **An account failed to log on.** Subject: Security ID: SYSTEM Account Name: ...
2
votes
2answers
298 views

Event 34 on Windows 2008 R2 write cache and sysvol on system drive

I have Windows Server 2008 R2 running as Active Directory Primary Domain Controller. Since our domain is not large, I put the SYSVOL and NTDS folders in the default location on the system drive (SSD ...
0
votes
1answer
132 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
2answers
772 views

Clean up event log by script

Any way to remove all entries from the Windows event logs (Application, System & Software) apart from the last 24 hours? Via command line such as batch file. On Windows 2008 R2 Server & ...
1
vote
2answers
106 views

Windows service restart source

I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
1
vote
1answer
1k views

security_error_ring_buffer_recorded in system health log - what does it mean?

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012. Today I was checking the log files located in: ...
1
vote
1answer
2k views

How to automatically backup Windows event logs?

There doesn't appear to be a way to backup (archive) Windows event logs automatically via the GUI. Is there a way via a script that can be set as a scheduled task to do this? If so, can someone ...
0
votes
1answer
316 views

Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role

Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this: The message repeats every second and the port number is increased by one the range ...
4
votes
2answers
2k views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
0
votes
1answer
42 views

Group Policy Preference Event id in Window XP [closed]

Whenever Group Policy Preference get auto-update after 90 minutes interval on Window XP. Is there any event id generated or not in Window XP? Please answer in Yes or No. If yes than what is Event Id ...
-1
votes
1answer
149 views

Group Policy Event id [duplicate]

DC - Windows Server 2008 R2 Client OS - Window XP Which Event id is generated on Window XP, if my Group policy preference is automatically updated after 90 minutes interval. Sorry, i tried to find ...
0
votes
1answer
122 views

Can eventvwr.msc's log files be exported to text or sql server in Windows?

Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files? Every search I do on Google for this returns how to export ...
1
vote
1answer
5k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
1
vote
0answers
476 views

What do these IPMI System Event Logs mean?

I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
1
vote
1answer
202 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
0
votes
1answer
3k views

Event ID 2013 (Disk Is At Or Near Capacity) not getting logged

I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is ...
0
votes
1answer
260 views

BINLSVC warning in event log - netclass.inf parsing Manufacture

So I am trying to get Remote Installation Service Running on a Windows Server 2003 R2 Standard Edition with Service Pack 2 installed. I am trying to integrate network drivers into the image and I keep ...
0
votes
1answer
167 views

SBS 2003 no network connection and acting strangely a bunch of Event ID 13568

I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
2
votes
1answer
322 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
-1
votes
2answers
56 views

Lots of Failure Alerts on my DC

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit. Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
1
vote
2answers
544 views

Is it possible to export Windows event logs from multiple servers to a non-windows host, without running event manager on each of the Windows servers?

I want to export event logs from Windows to a non-Windows host. I was considering using Logstash, but that would seem to require that I install and run Logstash on each server. Is it possible to do ...
1
vote
2answers
1k views

how to open a saved eventlog file with display information

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
1answer
640 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
0
votes
2answers
738 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...