"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
1answer
4k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
1
vote
2answers
679 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...
1
vote
1answer
124 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
1
vote
1answer
3k views

Event ID 8021 The browser was unable to retrieve a list of servers from the browser master

We have a LAN where workstations are randomly losing network connectivity for brief moments of time. The workstations can also take a long time to login to the domain. During our troubleshooting we ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
1
vote
4answers
166 views

application required to view event log on web servers locally

I manage several windows web servers with .net web applications installed on them that log any errors to the event viewer. To view the event viewer I remote to each of the web servers and access it ...
1
vote
3answers
594 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
1
vote
2answers
2k views

Does Exchange 2010 SP1 log OWA login attempts anywhere?

We are having issues where users claim that their Outlook Web access login attempts are intermittently unsuccessful. After a few minutes, it works. I suspect user error but I cannot confirm that ...
1
vote
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
1
vote
1answer
2k views

How to filter Remote Desktop connection in Event Log filter

I need to see only success/fail logs for Remote Desktop connection. I want to monitor who (what username), when (datetime) and where (ip address) tried to connect to my remote server. How do I filter ...
1
vote
1answer
842 views

The previous system shutdown at xxxx was unexpected

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message: Event Type: Error Event Source: EventLog Event Category: None ...
1
vote
2answers
2k views

SRMSVC event ID 8197

Update: actual answer was finally found, see self-answer below. I have a Windows 2003 R2 machine that is giving an Event ID 8197 about once an hour and ten minutes. The full error is attached below. ...
1
vote
1answer
770 views

How to troubleshoot Application Popup issues 0XC0000142 and 0XC000009a

I am running randomly into 1 of these popups when our application runs. The machines range from 8GB/8Core to 24GB/24Core and run Windows Server 2008 R2. The application is a bunch of perl scripts and ...
1
vote
2answers
1k views

Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB

The error log on my sql server throws this warning every 5 seconds 'Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB.' From what I can tell this may be due to my ...
1
vote
1answer
745 views

Enable Permissions To Write To Event Log

I have an ASP .Net app running on a windows 2003 server. If the application throws an exception I want the exception to be written to the event log. I have this implemented but when an exception is ...
1
vote
1answer
2k views

Cannot start eventlog service

On a windows 2k8R2 DC box the eventlog service wont start. When i try to start the service the machine returns: "Windows could not start the Windows Event Log service on Local Computer. Error 13: ...
1
vote
1answer
417 views

How to get Unique Log on & Log off event in windows

I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique ...
1
vote
1answer
9k views

How to avoid Master Browser errors, MRxSmb Event ID 8003?

I have a domain with Windows SBS 2003 as domain controller. It's very common to get Master Browser errors in the logs, MRxSmb Event ID 8003. How can I avoid that? What have I done wrong? I know how ...
1
vote
2answers
2k views

Windows Server 2008 Send Error Message on Event Log Error

We currently have a Windows Server 2008 machine that we have configured with a Custom Task to send an email whenever an error occurs in a certain Event Log. The trigger works perfectly, and sends ...
1
vote
1answer
2k views

Why does Windows Event Log stop logging events before maximum log size is reached?

I have a service that produces a lot of event log output. Currently the event log is configured to overwrite any old events to keep the log from ever getting full. We have also increased the event log ...
1
vote
2answers
428 views

A lot of logon/logoffs events in Windows event log

I have a server that contains Team Foundation Server which we use for source control. This server is windows server 2003, however it is not our domain server. When we do a large 'get latest version' ...
1
vote
1answer
352 views

Service failed to start but nothing in event log

I'm getting the warning that a service or driver failed to start, check the event log, but when I do, I can't find any error or warning events on any of the logs ? Is there some way to work out what ...
1
vote
1answer
13k views

Event ID: 861 - The Windows Firewall has detected an application listening for incoming traffic

Firstly, my machines aren't compromised any person suggesting such will be DV'd. The security logs on some of my networks client machines (all Windows Xp Sp3) get filled with these useless error ...
1
vote
0answers
17 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
1
vote
0answers
75 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
1
vote
1answer
56 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
1
vote
0answers
54 views

JAVA task reporting perodic file access issue but windows file auditing says it never tried?

Ok so you've got a JAVA task that reads a file on my local disk when it runs, it immediately closes the handle on the file right after it reads its, less than a second, nothing else on the entire ...
1
vote
0answers
61 views

Getting iLO logs for a specific period

I am fetching iLO event logs remotely using cpqlocfg.exe and script Get_iLO_Log.xml. But this gives complete event logs and there is no parameter that can be set to get the logs only for a specific ...
1
vote
0answers
419 views

What do these IPMI System Event Logs mean?

I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
1
vote
1answer
269 views

Remote Desktop IP missing in Event Log

I was checking my remote desktop event logs and an entry is confusing for me. The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
1
vote
0answers
252 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
1
vote
0answers
98 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
206 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
717 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
1
vote
1answer
297 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
1
vote
1answer
115 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
1
vote
1answer
98 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
1
vote
2answers
542 views

Troubleshooting event id 5146 “Application pool has been disabled” on IIS7

I have a website running on Windows Server 2008 Web Edition, that has suddenly in the last few days started freezing and giving users a "503 Service Unavailable" message. There's a bunch of errors ...
1
vote
1answer
298 views

IIS Crash/Hang agent Event Viewer logs - are they significant

We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other ...
1
vote
0answers
2k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
1
vote
0answers
81 views

Monitoring User / Log in events on my file server

I am searching for a solution to monitor access and activities on my web server. There are only a handful of people who are allowed to access my file server via https or ftp/sftp and I would like to ...
1
vote
1answer
834 views

Event Id:8003 The Master Browser Error

I receive the following error on Windows Server 2008 the last a few days. event id 8003 The master browser has received a server announcement from the computer computername that believes that ...
1
vote
0answers
443 views

Cannot open log for source 'blah'. You may not have write access

I'm attempting to write to a custom event log .... but I get the error: Win32Exception Access Is Denied Cannot open log for source 'blah'. You may not have write access. I've trawled the net.. ...
1
vote
1answer
269 views

In xperf (Windows ETW) what's the difference between the 'CPU Sampling by Process' and 'CPU Usage by Process' graphs in the xperf viewer?

The values are tracking very closely, however the 'CPU Sampling by Process' appears to be less fine grained in it's data. I can't find anything in the documentation to differentiate these two.
1
vote
1answer
304 views

search logs for events associated with Task Scheduler

I'm working with a Server08 box (Web Edition) where the Task Scheduler had run a set of unchanged housekeeping scripts for months. Over the last week, Scheduler has failed to start scripts twice. ...
1
vote
2answers
2k views

Where to grant an account permissions for event log

My asp.net application does not have the permission to write to windows event log. It is running under Network Service account. Is there any tool/management console rather than hack in the registry to ...
1
vote
2answers
383 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
1
vote
1answer
88 views

I would like to prevent these entries from being added to the eventlog

Our client's application EventLog is getting filled up with warnings due to a bug in the Microsoft SQL Server report viewer control, http://support.microsoft.com/kb/973219. They have thousands of ...
1
vote
2answers
1k views

Including Event description on Windows 2008 OnEvent SendEMail Task

I've got a scheduled task setup in Windows 2008 R2 to send me an email if a specific event is logged to the event log. This works great. However, I'd like to include the event description from the ...
1
vote
1answer
344 views

logparser Message with error codes

Is there anyway to get complete error message using LogParser? When I run the following query: logparser -i:EVT -o:NAT "SELECT TimeGenerated,EventID,Message from System WHERE EventTypeName='Error ...