"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

1
vote
3answers
176 views

Logon attempts - Tons of failure audits in Event Viewer on Domain Controller (Server 2003)

This is what the event looks like, under Security logs. There are tons of them. Is someone trying to brute force the network? This server is also used as a terminal services server.. Thanks any advice ...
1
vote
1answer
224 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
1
vote
1answer
133 views

How to record IIS 8 client authentication errors in Windows Events?

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some ...
1
vote
1answer
689 views

Security has requested to process its policy settings again. Error

I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO. Security has requested to process its policy settings ...
1
vote
1answer
5k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
1
vote
1answer
202 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
1
vote
2answers
1k views

how to open a saved eventlog file with display information

i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
1
vote
2answers
864 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...
1
vote
1answer
129 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
1
vote
1answer
4k views

Event ID 8021 The browser was unable to retrieve a list of servers from the browser master

We have a LAN where workstations are randomly losing network connectivity for brief moments of time. The workstations can also take a long time to login to the domain. During our troubleshooting we ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
1
vote
4answers
169 views

application required to view event log on web servers locally

I manage several windows web servers with .net web applications installed on them that log any errors to the event viewer. To view the event viewer I remote to each of the web servers and access it ...
1
vote
3answers
624 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
1
vote
2answers
2k views

Does Exchange 2010 SP1 log OWA login attempts anywhere?

We are having issues where users claim that their Outlook Web access login attempts are intermittently unsuccessful. After a few minutes, it works. I suspect user error but I cannot confirm that ...
1
vote
1answer
2k views

How to filter Remote Desktop connection in Event Log filter

I need to see only success/fail logs for Remote Desktop connection. I want to monitor who (what username), when (datetime) and where (ip address) tried to connect to my remote server. How do I filter ...
1
vote
1answer
908 views

The previous system shutdown at xxxx was unexpected

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message: Event Type: Error Event Source: EventLog Event Category: None ...
1
vote
2answers
2k views

SRMSVC event ID 8197

Update: actual answer was finally found, see self-answer below. I have a Windows 2003 R2 machine that is giving an Event ID 8197 about once an hour and ten minutes. The full error is attached below. ...
1
vote
1answer
816 views

How to troubleshoot Application Popup issues 0XC0000142 and 0XC000009a

I am running randomly into 1 of these popups when our application runs. The machines range from 8GB/8Core to 24GB/24Core and run Windows Server 2008 R2. The application is a bunch of perl scripts and ...
1
vote
2answers
1k views

Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB

The error log on my sql server throws this warning every 5 seconds 'Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB.' From what I can tell this may be due to my ...
1
vote
1answer
777 views

Enable Permissions To Write To Event Log

I have an ASP .Net app running on a windows 2003 server. If the application throws an exception I want the exception to be written to the event log. I have this implemented but when an exception is ...
1
vote
1answer
2k views

Cannot start eventlog service

On a windows 2k8R2 DC box the eventlog service wont start. When i try to start the service the machine returns: "Windows could not start the Windows Event Log service on Local Computer. Error 13: ...
1
vote
1answer
419 views

How to get Unique Log on & Log off event in windows

I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique ...
1
vote
1answer
9k views

How to avoid Master Browser errors, MRxSmb Event ID 8003?

I have a domain with Windows SBS 2003 as domain controller. It's very common to get Master Browser errors in the logs, MRxSmb Event ID 8003. How can I avoid that? What have I done wrong? I know how ...
1
vote
2answers
2k views

Windows Server 2008 Send Error Message on Event Log Error

We currently have a Windows Server 2008 machine that we have configured with a Custom Task to send an email whenever an error occurs in a certain Event Log. The trigger works perfectly, and sends ...
1
vote
1answer
2k views

Why does Windows Event Log stop logging events before maximum log size is reached?

I have a service that produces a lot of event log output. Currently the event log is configured to overwrite any old events to keep the log from ever getting full. We have also increased the event log ...
1
vote
2answers
436 views

A lot of logon/logoffs events in Windows event log

I have a server that contains Team Foundation Server which we use for source control. This server is windows server 2003, however it is not our domain server. When we do a large 'get latest version' ...
1
vote
1answer
359 views

Service failed to start but nothing in event log

I'm getting the warning that a service or driver failed to start, check the event log, but when I do, I can't find any error or warning events on any of the logs ? Is there some way to work out what ...
1
vote
1answer
13k views

Event ID: 861 - The Windows Firewall has detected an application listening for incoming traffic

Firstly, my machines aren't compromised any person suggesting such will be DV'd. The security logs on some of my networks client machines (all Windows Xp Sp3) get filled with these useless error ...
1
vote
0answers
30 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
1
vote
0answers
208 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
1
vote
1answer
60 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
1
vote
0answers
69 views

JAVA task reporting perodic file access issue but windows file auditing says it never tried?

Ok so you've got a JAVA task that reads a file on my local disk when it runs, it immediately closes the handle on the file right after it reads its, less than a second, nothing else on the entire ...
1
vote
0answers
62 views

Getting iLO logs for a specific period

I am fetching iLO event logs remotely using cpqlocfg.exe and script Get_iLO_Log.xml. But this gives complete event logs and there is no parameter that can be set to get the logs only for a specific ...
1
vote
0answers
478 views

What do these IPMI System Event Logs mean?

I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
1
vote
1answer
295 views

Remote Desktop IP missing in Event Log

I was checking my remote desktop event logs and an entry is confusing for me. The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
1
vote
0answers
266 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
1
vote
0answers
104 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
239 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
813 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
1
vote
1answer
331 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
1
vote
1answer
118 views

Determine what exe is running under a given SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may ...
1
vote
1answer
105 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
1
vote
2answers
612 views

Troubleshooting event id 5146 “Application pool has been disabled” on IIS7

I have a website running on Windows Server 2008 Web Edition, that has suddenly in the last few days started freezing and giving users a "503 Service Unavailable" message. There's a bunch of errors ...
1
vote
1answer
311 views

IIS Crash/Hang agent Event Viewer logs - are they significant

We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other ...
1
vote
0answers
2k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
1
vote
0answers
81 views

Monitoring User / Log in events on my file server

I am searching for a solution to monitor access and activities on my web server. There are only a handful of people who are allowed to access my file server via https or ftp/sftp and I would like to ...
1
vote
1answer
894 views

Event Id:8003 The Master Browser Error

I receive the following error on Windows Server 2008 the last a few days. event id 8003 The master browser has received a server announcement from the computer computername that believes that ...
1
vote
0answers
471 views

Cannot open log for source 'blah'. You may not have write access

I'm attempting to write to a custom event log .... but I get the error: Win32Exception Access Is Denied Cannot open log for source 'blah'. You may not have write access. I've trawled the net.. ...
1
vote
1answer
275 views

In xperf (Windows ETW) what's the difference between the 'CPU Sampling by Process' and 'CPU Usage by Process' graphs in the xperf viewer?

The values are tracking very closely, however the 'CPU Sampling by Process' appears to be less fine grained in it's data. I can't find anything in the documentation to differentiate these two.
1
vote
1answer
321 views

search logs for events associated with Task Scheduler

I'm working with a Server08 box (Web Edition) where the Task Scheduler had run a set of unchanged housekeeping scripts for months. Over the last week, Scheduler has failed to start scripts twice. ...