"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
2answers
354 views

Finding the most common errors in event logs using Powershell.

I have the event logs for one of our servers locally in .evtx format. I can load the log file into PS using the command: Get-WinEvent -Path D:\Desktop\serverlogs.evtx What I would like to do is on ...
4
votes
3answers
5k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
2
votes
1answer
207 views

How do I access the Windows Event Logs on a server instance in Windows Azure?

Can the Event Logs be access on Windows Azure for a deployment with multiple instances? It would be able to view the event logs of each server instance if necessary. The "black box" things just ...
1
vote
1answer
141 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...
1
vote
2answers
10k views

Schannell: Certificate received from the remote server was issued by an untrusted certificate authoritythe

i'm not sure whether to ask this on dba.stackexchange.com or here. Periodically following error is logged in Windows Server 2008 Administrative events: The certificate received from the remote ...
0
votes
2answers
219 views

Maximum log file size is reset every x time?

The default size of the maximum lof file in my win7 is 4000 KB. I set it to : 900032 KB and it works. But after a period of time - its coming back to 4000KB. How do I prevent that ?
1
vote
1answer
831 views

using New-EventLog to create logs under Applications and Services Logs

I am trying to get the new log to appear as a node under the Applications and Services Logs node in the event viewer, and I just learned here that the Powershell cmdlet New-EventLog will create a new ...
0
votes
2answers
358 views

creating Event Viewer Applications and Services Logs

On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
4
votes
1answer
3k views

Where can I view active directory failed logon attempts?

I do not see any failed logon attempts in my windows sever 2003 security event log (I see only successful ones). However, I have a user that is getting locked out very often and I need to try to ...
0
votes
1answer
51 views

Apache/Server Logs help

I have this on my apache conf <VirtualHost *:80> ServerAdmin info@myweb.com DocumentRoot /var/www/html/web ServerName web.myweb.com ErrorLog logs/index-error_log CustomLog logs/index-access_log ...
0
votes
1answer
2k views

Windows cannot access the file gpt.ini for GPO error

One of my users had a BSOD this morning, so I looked at the event log to see what could be the cause. I didn't find anything obvious related to the BSOD, but I did find something else which causes me ...
2
votes
2answers
2k views

Listing Users using RDP

Windows Server 2008 R2 I'm trying to use PowerShell to get me a list of users who have logged into Remote Desktop Services (formerly known as Terminal Services) during the past day. With little ...
2
votes
2answers
3k views

New set up DHCP Server on Server 2008 R2 won't work, Event-ID 1046

I just set up a 2008 R2 as DC, and DNS. Both worked fine, DNS works fine forward and reverse lookup. Now I wanted to install DHCP. As soon as the installation of the role is finished, I get this ...
0
votes
1answer
2k views

Using the CheckEventLog module of NSClient++, how do I properly filter in two different eventTypes?

I'm having an odd amount of trouble deducing the proper syntax to "filter=in" two eventTypes, warning and error. The line I am using is as follows: CheckEventLog -a truncate=1023 MaxWarn=1 MaxCrit=1 ...
1
vote
4answers
167 views

application required to view event log on web servers locally

I manage several windows web servers with .net web applications installed on them that log any errors to the event viewer. To view the event viewer I remote to each of the web servers and access it ...
3
votes
1answer
1k views

How to clear the DMI System Event Log from linux?

Is it possible to clear the DMI event log (the one that gets partially shown by dmidecode --type 15) from Linux ? I know it can be cleared from the bios but it is a server in a remote location and ...
0
votes
2answers
730 views

Most efficient way to allow a specific user access to event log?

What is the most efficient way to allow a specific user access to event logs? I have come across a method to enforce permissions using local security policy and group policy, but it seems overly ...
0
votes
1answer
358 views

Track changes to Windows Update settings in registry

Is it possible to track down changes to the Windows Update settings in the event logs (Win2008 R2 Std)? I tried filtering the System event log by Source = WindowsUpdateClient but this seems to list ...
1
vote
2answers
561 views

Troubleshooting event id 5146 “Application pool has been disabled” on IIS7

I have a website running on Windows Server 2008 Web Edition, that has suddenly in the last few days started freezing and giving users a "503 Service Unavailable" message. There's a bunch of errors ...
0
votes
3answers
95 views

Getting Some Specific Types of Log [closed]

I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), ...
3
votes
0answers
816 views

What is the Task Scheduler syntax for returning the “ComponentStatus” contents in a Windows Server Backup Event

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
1
vote
3answers
598 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
2
votes
2answers
474 views

Catch Windows system log events to a text file

I need to capture w32time events to a text file for a silly compliance requirement. Is there a way to that in Windows?
1
vote
1answer
166 views

How to report who, when and which computer has logged on to a domain controller

I'm completing an audit and need to know the following information below. I have a domain controller with active directory, but let me know if you need any more info. I would like something as simple ...
1
vote
2answers
2k views

Does Exchange 2010 SP1 log OWA login attempts anywhere?

We are having issues where users claim that their Outlook Web access login attempts are intermittently unsuccessful. After a few minutes, it works. I suspect user error but I cannot confirm that ...
4
votes
2answers
1k views

Piping powershell messages to Write-EventLog

I have a powershell script that runs a custom cmdlet. It is run by Task Scheduler and I want to log what it does. This is my current crude version: Add-PsSnapIn MyCmdlets Write-EventLog -LogName ...
0
votes
1answer
96 views

how to centerlized Client Machine Event Log Auditing to one server?

We have Windows Server 2003 Enterprise DC for 2000 Windows XP SP3 Client Machine. We just want to centralized audit account logon/logoff event, security event log in windows client on one server. we ...
0
votes
1answer
594 views

Exporting logon/logoff events from Windows event log

Environment: Windows Server 2008 R2 with Samba 3.5 domain & OpenLDAP backend. Background: on our previous Terminal Server (Windows Server 2003) we used logon/logoff scripts to log user logins and ...
1
vote
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
3
votes
2answers
375 views

Novell Netware 6.5 Server Logs

I have inherited a Novell Netware 6.5 server to manage. We had have some users move folders into other folders that they were not supposed to be able to do. Additionally, there have been cases were ...
1
vote
1answer
303 views

IIS Crash/Hang agent Event Viewer logs - are they significant

We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other ...
3
votes
3answers
497 views

Event Logging for RAID fault in 2008 R2

does anyone have a solution for logging an error/critical entry to the event log in 2008 R2 when RAID has an issue? I really want to set up email alerts for when this happens. I'm using the MS builtin ...
0
votes
1answer
270 views

EventLog real-time capture with C++

Is there a way that I can capture Windows EventLog logs in real-time with C++?
0
votes
1answer
481 views

Event log - attaching to some event task which will run a program. Can I pass to this program event params?

I would like to run a program only when a specific ASP.NET event occurs in the event-log. Is there any chance that it will get passed the event details when it is triggered?
2
votes
2answers
230 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
3
votes
1answer
5k views

Relocating event logs in Windows Server 2008 R2

How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. ...
3
votes
2answers
744 views

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins ...
3
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
0
votes
1answer
893 views

How to write proper XPath query for filtering certain application pool errors in Windows 2008 R2 Event log (“Applications” section)

does someone know how to write proper XPath query for filtering certain application pool errors in Windows 2008 R2 Event log ("Applications" section)? EventData in XML view from Application eventlog ...
0
votes
1answer
83 views

How do I find the source of a repeating fault in the System Log in Windows 7?

Every second I get the following fault in the system log in Windows 7. How do I find the source of this error and eliminate it? - <Event ...
2
votes
1answer
753 views

How to differentiate between users and computers in EventID 4768 - Active Directory?

I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers. My problem is, that as far as I can see, I ...
0
votes
1answer
1k views

Server 2003 - Event Viewer 540 Anonymous Logon from strange IPs

The Event Viewer for my Windows Server 2003 machine is flooded with these 540 login attempts from IP addresses in foreign countries. It looks like somebody is trying to access my machine - what sort ...
0
votes
1answer
308 views

Strange logon activity for Administrator in Event Logs

On one of our public facing servers the Administrator account logged in at 6:45am GMT. It wasn't a member of staff. Details from the event logs 1st event Logon attempt by: ...
0
votes
1answer
914 views

What are the diffences between evntwin and evntcmd?

I want to send my eventlog via SNMP trap in order to monitor it, but something is not clear in my mind. I saw i need to configure traps destination in SNMP service in services.msc and then I also ...
0
votes
2answers
8k views

HP ProLiant DL380 G7 iLO error

I have a HP ProLiant DL380 G7 server which sent me an email that's got me worried. The system has detected the following event: SNMP Trap: 9006 Date time: 03/19/2011 11:47:46 PM ...
0
votes
3answers
4k views

Server 2008 R2, Exchange 2010, WMI error event 10

The system is windows 2008 R2, with Exchange 2010 SP1 installed. I am receiving the following event log application error: event 10, WMI Event filter with query "SELECT * FROM ...
4
votes
2answers
3k views

Access denied error 3221225578 with file sharing to Windows server

i'm trying to access the shares on a server. The credential box appears, and i enter in a correct username and password, and i get access denied. The silly thing is that i can Remote Desktop to the ...
1
vote
0answers
2k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
1
vote
0answers
81 views

Monitoring User / Log in events on my file server

I am searching for a solution to monitor access and activities on my web server. There are only a handful of people who are allowed to access my file server via https or ftp/sftp and I would like to ...
1
vote
1answer
2k views

How to filter Remote Desktop connection in Event Log filter

I need to see only success/fail logs for Remote Desktop connection. I want to monitor who (what username), when (datetime) and where (ip address) tried to connect to my remote server. How do I filter ...