"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

2
votes
1answer
6k views

System Account Logon Failures every 30 seconds

We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
1
vote
1answer
3k views

Dell Open Manage message in Windows Event Log, should I be worried?

I have a Dell T110 server with a SAS 6i/R controller and two hard disks in RAID 1. Ocasionally a warning appears in the Windows Event Log with the following message: SAS port report: SAS wide port ...
1
vote
2answers
802 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...
3
votes
2answers
94 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
0
votes
2answers
2k views

Permissions needed to read event log messages remotely?

When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error: The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
1
vote
0answers
261 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
2
votes
2answers
2k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
5
votes
2answers
4k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
2
votes
1answer
59 views

How can I remove the sorting in the Event Log?

I made the mistake of clicking the Date and Time column in the event log. Now, whenever I open that log, it takes like 10 seconds for it to sort all entries. This is highly annoying, especially since ...
2
votes
1answer
467 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
3
votes
1answer
367 views

Audit when users log on and off servers

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)? ...
1
vote
0answers
103 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
0
votes
1answer
213 views

auditpol starting infinite loop in command prompt

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors. I did some troubleshooting around the internet and found out that I should stop auditing a ...
2
votes
1answer
1k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
1
vote
1answer
6k views

NETLOGON Event Warning Dynamic Registration 5781

I've set up a couple of Domain Controllers and the first DC I set up is taking a while to start up and occassionally displaying a warning in the Windows Event Log that I think may be related to the ...
7
votes
2answers
23k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
0
votes
1answer
91 views

Do Windows Events from the Windows Event Log have sensitive information?

I'm looking to start a service where I collect Windows events from consumer computers over an SSL link (https) but I want to make sure that extremely sensitive information wouldn't be contained in the ...
2
votes
1answer
1k views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
7
votes
1answer
17k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
1
vote
2answers
339 views

Tool to aggregate error messages in Windows event logs?

Is there a simple way to filter out only errors and warnings in a Windows event log, and apply aggregate functions like 'count and group by error type', 'message' or 'code'?
1
vote
0answers
222 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
774 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
2
votes
3answers
2k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
391 views

How to change logging details in W2008R2?

Is there a way to change what OS is logging in the Event Log? For example I see "The system time has changed" events in numbers but I dont want them (I have time sync every too often and it is ...
2
votes
2answers
979 views

Event viewer email alerts

Windows Server 2008 Event viewer there is an option to Attach task to this event. Is there a Microsoft solution, to send an email alert for any Error messages that flag up in the event viewer?
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...
1
vote
1answer
128 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
2
votes
0answers
3k views

Windows Application Experience Service

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This occurs ...
0
votes
1answer
1k views

Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this ...
2
votes
1answer
168 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
3
votes
3answers
2k views

How to export all System event logs of a definite time period

I am working on a Windows Server 2003 SP2 with Powershell v2, and I am looking for a way to export all System event logs of a definite time period, (say, from Saturday 2000 hours to Sunday 1100 ...
2
votes
1answer
619 views

Failed Account Logon Events

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account. On ...
0
votes
2answers
5k views

Cannot login SQL Server after changing machine name

After installing and setting up new machines in a domain, we decided to rename one of them which had a SQL Server instance installed. So I changed the hostname, everything went fine regarding the ...
0
votes
3answers
2k views

Exchange 2010: Event id 9554 for deleted mailbox

I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server: Unable to update Mailbox SD in the DS. Mailbox Guid: ...
0
votes
1answer
164 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
1
vote
1answer
323 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
1
vote
2answers
2k views

Totally removing Windows Event Logs

I am developing an application that creates Windows event logs and writes to them. However, during development and testing, I created some event logs by mistake, with sources registered to them. The ...
0
votes
1answer
59 views

Trying to delete an object from the local group policy editor on a windows 2003 r2 member server in a domain

I've used this Serverfault Article in order to add additional event logs for some webservices to the local group policy on my interfaces server. For 2 objects i added, i had a mistype and it created 2 ...
2
votes
2answers
8k views

How to find log about uninstalling program on windows server 2008 R2? [closed]

I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!
1
vote
1answer
117 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
4
votes
2answers
189 views

Forwarded Event Logs

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only ...
6
votes
6answers
2k views

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
0
votes
2answers
255 views

How can I prevent cron from filling up my root partition?

I'm using cron tasks every 3 mins, the result is logged in my cron.log. Also after executing (wget) certain php file, it's name (with 0 bytes filesize) is copied to root, spaming it - see the figure ...
1
vote
1answer
2k views

Windows 2008 Eventlogs best practice and server\Users permission

I have a couple questions about Windows Event Logs and permissions for server 2008 best practice and what Users is in 2008. I am trying to write EVTLogs off to another drive instead of the default ...
1
vote
1answer
101 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
0
votes
1answer
198 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
3
votes
2answers
1k views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
6
votes
1answer
10k views

Server locking up, /var/log/messages reports “backlog limit exceeded”

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
0
votes
1answer
325 views

Disable auditing of logon type 3 events

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)? This ...
4
votes
2answers
5k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...