"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
1answer
172 views

SBS 2003 no network connection and acting strangely a bunch of Event ID 13568

I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
3
votes
1answer
348 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
-1
votes
2answers
56 views

Lots of Failure Alerts on my DC

I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit. Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
1
vote
2answers
562 views

Is it possible to export Windows event logs from multiple servers to a non-windows host, without running event manager on each of the Windows servers?

I want to export event logs from Windows to a non-Windows host. I was considering using Logstash, but that would seem to require that I install and run Logstash on each server. Is it possible to do ...
2
votes
2answers
2k views

how to open a saved eventlog file with display information

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
1answer
694 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
0
votes
2answers
762 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...
1
vote
1answer
306 views

Remote Desktop IP missing in Event Log

I was checking my remote desktop event logs and an entry is confusing for me. The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
1
vote
1answer
5k views

What would cause so many EventID 4656 PlugPlayManager Security Audit Failures at one time?

I found 141 PlugPlayManager Security Audit Failures logged within the same minute on one of our Server 2008 R2 servers (running only SQL 2008 R2). While Googling all I could find was other people, ...
4
votes
1answer
3k views

What are the differences between Windows EVT and EVTX log files?

Windows is moving to the *.EVTX format for their logging files, but we still have clients that have versions that write to the older *.EVT format. What are the differences in how those files are ...
2
votes
1answer
7k views

System Account Logon Failures every 30 seconds

We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
1
vote
1answer
4k views

Dell Open Manage message in Windows Event Log, should I be worried?

I have a Dell T110 server with a SAS 6i/R controller and two hard disks in RAID 1. Ocasionally a warning appears in the Windows Event Log with the following message: SAS port report: SAS wide port ...
1
vote
2answers
928 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...
3
votes
2answers
97 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
0
votes
2answers
2k views

Permissions needed to read event log messages remotely?

When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error: The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
1
vote
0answers
268 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
2
votes
2answers
2k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
5
votes
2answers
4k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
2
votes
1answer
63 views

How can I remove the sorting in the Event Log?

I made the mistake of clicking the Date and Time column in the event log. Now, whenever I open that log, it takes like 10 seconds for it to sort all entries. This is highly annoying, especially since ...
2
votes
1answer
514 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
3
votes
1answer
409 views

Audit when users log on and off servers

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)? ...
1
vote
0answers
106 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
0
votes
1answer
228 views

auditpol starting infinite loop in command prompt

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors. I did some troubleshooting around the internet and found out that I should stop auditing a ...
2
votes
1answer
2k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
1
vote
1answer
6k views

NETLOGON Event Warning Dynamic Registration 5781

I've set up a couple of Domain Controllers and the first DC I set up is taking a while to start up and occassionally displaying a warning in the Windows Event Log that I think may be related to the ...
8
votes
2answers
27k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
0
votes
1answer
98 views

Do Windows Events from the Windows Event Log have sensitive information?

I'm looking to start a service where I collect Windows events from consumer computers over an SSL link (https) but I want to make sure that extremely sensitive information wouldn't be contained in the ...
2
votes
1answer
1k views

40k Event Log Errors an hour Unknown Username or bad password

I am getting about 200k of these an hour: An account failed to log on. Subject: Security ID: SYSTEM Account Name: TGSERVER$ Account Domain: WORKGROUP Logon ID: ...
4
votes
1answer
19k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
1
vote
2answers
351 views

Tool to aggregate error messages in Windows event logs?

Is there a simple way to filter out only errors and warnings in a Windows event log, and apply aggregate functions like 'count and group by error type', 'message' or 'code'?
1
vote
0answers
251 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
844 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
2
votes
3answers
2k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
395 views

How to change logging details in W2008R2?

Is there a way to change what OS is logging in the Event Log? For example I see "The system time has changed" events in numbers but I dont want them (I have time sync every too often and it is ...
2
votes
2answers
1k views

Event viewer email alerts

Windows Server 2008 Event viewer there is an option to Attach task to this event. Is there a Microsoft solution, to send an email alert for any Error messages that flag up in the event viewer?
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...
1
vote
1answer
132 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
2
votes
0answers
3k views

Windows Application Experience Service

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This occurs ...
0
votes
1answer
1k views

Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?

Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this ...
2
votes
1answer
176 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
3
votes
3answers
2k views

How to export all System event logs of a definite time period

I am working on a Windows Server 2003 SP2 with Powershell v2, and I am looking for a way to export all System event logs of a definite time period, (say, from Saturday 2000 hours to Sunday 1100 ...
2
votes
1answer
645 views

Failed Account Logon Events

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account. On ...
0
votes
2answers
5k views

Cannot login SQL Server after changing machine name

After installing and setting up new machines in a domain, we decided to rename one of them which had a SQL Server instance installed. So I changed the hostname, everything went fine regarding the ...
0
votes
3answers
2k views

Exchange 2010: Event id 9554 for deleted mailbox

I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server: Unable to update Mailbox SD in the DS. Mailbox Guid: ...
0
votes
1answer
167 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
1
vote
1answer
345 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
2
votes
2answers
2k views

Totally removing Windows Event Logs

I am developing an application that creates Windows event logs and writes to them. However, during development and testing, I created some event logs by mistake, with sources registered to them. The ...
0
votes
1answer
60 views

Trying to delete an object from the local group policy editor on a windows 2003 r2 member server in a domain

I've used this Serverfault Article in order to add additional event logs for some webservices to the local group policy on my interfaces server. For 2 objects i added, i had a mistype and it created 2 ...
2
votes
2answers
9k views

How to find log about uninstalling program on windows server 2008 R2? [closed]

I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!
1
vote
1answer
119 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...