"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
1answer
4k views

NETLOGON Event Warning Dynamic Registration 5781

I've set up a couple of Domain Controllers and the first DC I set up is taking a while to start up and occassionally displaying a warning in the Windows Event Log that I think may be related to the ...
6
votes
2answers
14k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
0
votes
1answer
84 views

Do Windows Events from the Windows Event Log have sensitive information?

I'm looking to start a service where I collect Windows events from consumer computers over an SSL link (https) but I want to make sure that extremely sensitive information wouldn't be contained in the ...
2
votes
1answer
982 views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
4
votes
1answer
14k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
1
vote
2answers
303 views

Tool to aggregate error messages in Windows event logs?

Is there a simple way to filter out only errors and warnings in a Windows event log, and apply aggregate functions like 'count and group by error type', 'message' or 'code'?
1
vote
0answers
177 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
631 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
1
vote
3answers
1k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
379 views

How to change logging details in W2008R2?

Is there a way to change what OS is logging in the Event Log? For example I see "The system time has changed" events in numbers but I dont want them (I have time sync every too often and it is ...
2
votes
2answers
855 views

Event viewer email alerts

Windows Server 2008 Event viewer there is an option to Attach task to this event. Is there a Microsoft solution, to send an email alert for any Error messages that flag up in the event viewer?
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...
1
vote
1answer
117 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
2
votes
0answers
2k views

Windows Application Experience Service

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This occurs ...
0
votes
1answer
946 views

Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this ...
2
votes
1answer
164 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
3
votes
3answers
2k views

How to export all System event logs of a definite time period

I am working on a Windows Server 2003 SP2 with Powershell v2, and I am looking for a way to export all System event logs of a definite time period, (say, from Saturday 2000 hours to Sunday 1100 ...
2
votes
1answer
543 views

Failed Account Logon Events

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account. On ...
0
votes
2answers
4k views

Cannot login SQL Server after changing machine name

After installing and setting up new machines in a domain, we decided to rename one of them which had a SQL Server instance installed. So I changed the hostname, everything went fine regarding the ...
0
votes
3answers
1k views

Exchange 2010: Event id 9554 for deleted mailbox

I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server: Unable to update Mailbox SD in the DS. Mailbox Guid: ...
0
votes
1answer
161 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
1
vote
1answer
258 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
1
vote
2answers
1k views

Totally removing Windows Event Logs

I am developing an application that creates Windows event logs and writes to them. However, during development and testing, I created some event logs by mistake, with sources registered to them. The ...
0
votes
1answer
57 views

Trying to delete an object from the local group policy editor on a windows 2003 r2 member server in a domain

I've used this Serverfault Article in order to add additional event logs for some webservices to the local group policy on my interfaces server. For 2 objects i added, i had a mistype and it created 2 ...
2
votes
2answers
5k views

How to find log about uninstalling program on windows server 2008 R2? [closed]

I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!
1
vote
1answer
114 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
4
votes
2answers
167 views

Forwarded Event Logs

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only ...
6
votes
6answers
2k views

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
0
votes
2answers
236 views

How can I prevent cron from filling up my root partition?

I'm using cron tasks every 3 mins, the result is logged in my cron.log. Also after executing (wget) certain php file, it's name (with 0 bytes filesize) is copied to root, spaming it - see the figure ...
1
vote
1answer
1k views

Windows 2008 Eventlogs best practice and server\Users permission

I have a couple questions about Windows Event Logs and permissions for server 2008 best practice and what Users is in 2008. I am trying to write EVTLogs off to another drive instead of the default ...
1
vote
1answer
92 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
0
votes
1answer
171 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
3
votes
2answers
1k views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
6
votes
1answer
7k views

Server locking up, /var/log/messages reports “backlog limit exceeded”

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
0
votes
1answer
304 views

Disable auditing of logon type 3 events

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)? This ...
4
votes
2answers
4k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
0
votes
1answer
116 views

Event Logs for Remote Share BruteForce

This command is used to access remote shares. net use \10.31.247.2\share /user:admin password Is there any way to detect(EventLogs/other tools) if someone is trying to BruteForce into a remote ...
1
vote
1answer
3k views

Event ID 8021 The browser was unable to retrieve a list of servers from the browser master

We have a LAN where workstations are randomly losing network connectivity for brief moments of time. The workstations can also take a long time to login to the domain. During our troubleshooting we ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
1
vote
2answers
419 views

Issue reading EventLog entries for Standard user on Windows 7

I am trying to read the Windows Security Event log by notification. Below is sample line of code, but when I run it on Windows 7 with a standard user I get an Exception: EventLog _eventlog = new ...
0
votes
2answers
323 views

Finding the most common errors in event logs using Powershell.

I have the event logs for one of our servers locally in .evtx format. I can load the log file into PS using the command: Get-WinEvent -Path D:\Desktop\serverlogs.evtx What I would like to do is on ...
3
votes
3answers
4k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
2
votes
1answer
174 views

How do I access the Windows Event Logs on a server instance in Windows Azure?

Can the Event Logs be access on Windows Azure for a deployment with multiple instances? It would be able to view the event logs of each server instance if necessary. The "black box" things just ...
1
vote
1answer
125 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...
1
vote
2answers
8k views

Schannell: Certificate received from the remote server was issued by an untrusted certificate authoritythe

i'm not sure whether to ask this on dba.stackexchange.com or here. Periodically following error is logged in Windows Server 2008 Administrative events: The certificate received from the remote ...
0
votes
2answers
192 views

Maximum log file size is reset every x time?

The default size of the maximum lof file in my win7 is 4000 KB. I set it to : 900032 KB and it works. But after a period of time - its coming back to 4000KB. How do I prevent that ?
1
vote
1answer
653 views

using New-EventLog to create logs under Applications and Services Logs

I am trying to get the new log to appear as a node under the Applications and Services Logs node in the event viewer, and I just learned here that the Powershell cmdlet New-EventLog will create a new ...
0
votes
2answers
296 views

creating Event Viewer Applications and Services Logs

On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
4
votes
1answer
2k views

Where can I view active directory failed logon attempts?

I do not see any failed logon attempts in my windows sever 2003 security event log (I see only successful ones). However, I have a user that is getting locked out very often and I need to try to ...
0
votes
1answer
49 views

Apache/Server Logs help

I have this on my apache conf <VirtualHost *:80> ServerAdmin info@myweb.com DocumentRoot /var/www/html/web ServerName web.myweb.com ErrorLog logs/index-error_log CustomLog logs/index-access_log ...