"Event log" usually refers to the system/server logs on Microsoft Windows machines.
1
vote
2answers
932 views
Including Event description on Windows 2008 OnEvent SendEMail Task
I've got a scheduled task setup in Windows 2008 R2 to send me an email if a specific event is logged to the event log. This works great. However, I'd like to include the event description from the ...
1
vote
1answer
335 views
logparser Message with error codes
Is there anyway to get complete error message using LogParser?
When I run the following query:
logparser -i:EVT -o:NAT "SELECT TimeGenerated,EventID,Message from System WHERE EventTypeName='Error ...
0
votes
2answers
6k views
HP ProLiant DL380 G7 iLO error
I have a HP ProLiant DL380 G7 server which sent me an email that's got me worried.
The system has detected the following event:
SNMP Trap: 9006
Date time: 03/19/2011 11:47:46 PM
...
0
votes
1answer
64 views
Do Windows Events from the Windows Event Log have sensitive information?
I'm looking to start a service where I collect Windows events from consumer computers over an SSL link (https) but I want to make sure that extremely sensitive information wouldn't be contained in the ...
0
votes
3answers
119 views
How can I find who or what deleted files in the system32 directory?
We have a Windows 2003 development server (IIS and SQL Server) with remote desktop access and some employees have admin rights.
A couple weeks ago, a lot of important files (dlls, exes, msc and other ...
0
votes
2answers
117 views
Extreme slowdown when changing folder permissions
Last Friday I attempted to set permissions on a folder containing multiple folders. I simply deleted one user group's access entry, then clicked Apply and was greeted with an hourglass. Pretty soon ...
0
votes
3answers
4k views
Windows Server 2003 - “The security log on this system is full.” message when logging in
When I remote desktop into one Windows Server 2003 machine, I get a popup message saying "The security log on this system is full." When I open the Event Viewer, the security log size is 512.0 KB, ...
0
votes
1answer
45 views
Group Policy Event id [duplicate]
DC - Windows Server 2008 R2
Client OS - Window XP
Which Event id is generated on Window XP, if my Group policy preference is automatically updated after 90 minutes interval.
Sorry, i tried to find ...
0
votes
2answers
1k views
SQL Server database constantly restarting
We have SQL Server 2008 Express installed on a Windows 2003 server. Looking at the event log, one of the databases appears to be restarting anywhere from every couple seconds to every 15 to 30 ...
0
votes
2answers
83 views
Determine windows server attack? Should I monitor the server and block IPs all the day?
While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows:
**An account failed to log on.**
Subject:
Security ID: SYSTEM
Account Name: ...
0
votes
1answer
45 views
Can eventvwr.msc's log files be exported to text or sql server in Windows?
Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files?
Every search I do on Google for this returns how to export ...
0
votes
2answers
51 views
Lots of Failure Alerts on my DC
I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.
Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
0
votes
2answers
245 views
how to open a saved eventlog file with display information
i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
1answer
859 views
Dell Open Manage message in Windows Event Log, should I be worried?
I have a Dell T110 server with a SAS 6i/R controller and two hard disks in RAID 1. Ocasionally a warning appears in the Windows Event Log with the following message:
SAS port report: SAS wide port ...
0
votes
1answer
1k views
NETLOGON Event Warning Dynamic Registration 5781
I've set up a couple of Domain Controllers and the first DC I set up is taking a while to start up and occassionally displaying a warning in the Windows Event Log that I think may be related to the ...
0
votes
1answer
312 views
How to change logging details in W2008R2?
Is there a way to change what OS is logging in the Event Log?
For example I see "The system time has changed" events in numbers but I dont want them (I have time sync every too often and it is ...
0
votes
1answer
245 views
Disable auditing of logon type 3 events
I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)?
This ...
0
votes
3answers
2k views
NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134
I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day:
...
0
votes
2answers
197 views
creating Event Viewer Applications and Services Logs
On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
0
votes
1answer
693 views
Windows cannot access the file gpt.ini for GPO error
One of my users had a BSOD this morning, so I looked at the event log to see what could be the cause. I didn't find anything obvious related to the BSOD, but I did find something else which causes me ...
0
votes
2answers
266 views
Most efficient way to allow a specific user access to event log?
What is the most efficient way to allow a specific user access to event logs?
I have come across a method to enforce permissions using local security policy and group policy, but it seems overly ...
0
votes
3answers
91 views
Getting Some Specific Types of Log [closed]
I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), ...
0
votes
1answer
531 views
What are the diffences between evntwin and evntcmd?
I want to send my eventlog via SNMP trap in order to monitor it,
but something is not clear in my mind.
I saw i need to configure traps destination in SNMP service in services.msc and
then I also ...
0
votes
3answers
2k views
Server 2008 R2, Exchange 2010, WMI error event 10
The system is windows 2008 R2, with Exchange 2010 SP1 installed.
I am receiving the following event log application error:
event 10, WMI
Event filter with query "SELECT * FROM ...
0
votes
1answer
646 views
Special Logon in Vista
I looked at the System logs on my Vista machine. What is "Special Logon"? did an administrator log onto my PC?
0
votes
1answer
2k views
Recommended settings for event log sizes for Windows XP
Microsoft has posted the recommended settings for event log sizes in Windows Server 2003 and in Windows Server 2008 (link), but I was wondering if anyone knew if there was something somewhere which ...
0
votes
1answer
45 views
AD: delegating computer log access
I would like to setup the following audit scenario:
A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
2answers
50 views
Clean up event log by script
Any way to remove all entries from the Windows event logs (Application, System & Software) apart from the last 24 hours?
Via command line such as batch file.
On Windows 2008 R2 Server & ...
0
votes
2answers
48 views
Windows service restart source
I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
0
votes
1answer
27 views
Group Policy Preference Event id in Window XP [closed]
Whenever Group Policy Preference get auto-update after 90 minutes interval on Window XP. Is there any event id generated or not in Window XP?
Please answer in Yes or No.
If yes than what is Event Id ...
0
votes
2answers
538 views
Permissions needed to read event log messages remotely?
When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error:
The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
0
votes
1answer
208 views
Event ID 6009: is this event triggered only when a user-initiated shutdown has occurred?
Like the title says. From what I've briefly read, 6009 occurs when CTRL-ALT-DEL or Start > Shutdown is initiated by a user. If a shutdown sequence is initiated by SYSTEM for example, would this ...
0
votes
2answers
2k views
Cannot login SQL Server after changing machine name
After installing and setting up new machines in a domain, we decided to rename one of them which had a SQL Server instance installed. So I changed the hostname, everything went fine regarding the ...
0
votes
2answers
390 views
Exchange 2010: Event id 9554 for deleted mailbox
I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server:
Unable to update Mailbox SD in the DS. Mailbox Guid: ...
0
votes
1answer
120 views
Creating a custom view for windows log based on a “Contains {text}” rule
I have a server running Windows Server 2008.
I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
0
votes
2answers
173 views
How can I prevent cron from filling up my root partition?
I'm using cron tasks every 3 mins, the result is logged in my cron.log. Also after executing (wget) certain php file, it's name (with 0 bytes filesize) is copied to root, spaming it - see the figure
...
0
votes
1answer
153 views
Rule to block IP address not working
Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
0
votes
2answers
240 views
Finding the most common errors in event logs using Powershell.
I have the event logs for one of our servers locally in .evtx format. I can load the log file into PS using the command:
Get-WinEvent -Path D:\Desktop\serverlogs.evtx
What I would like to do is on ...
0
votes
2answers
109 views
Maximum log file size is reset every x time?
The default size of the maximum lof file in my win7 is 4000 KB.
I set it to : 900032 KB and it works.
But after a period of time - its coming back to 4000KB.
How do I prevent that ?
0
votes
1answer
1k views
Using the CheckEventLog module of NSClient++, how do I properly filter in two different eventTypes?
I'm having an odd amount of trouble deducing the proper syntax to "filter=in" two eventTypes, warning and error.
The line I am using is as follows:
CheckEventLog -a truncate=1023 MaxWarn=1 MaxCrit=1 ...
0
votes
1answer
2k views
Why is the user name “N/A” for most of the event log entries? How to get it filled in?
In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
0
votes
1answer
762 views
Server 2003 - Event Viewer 540 Anonymous Logon from strange IPs
The Event Viewer for my Windows Server 2003 machine is flooded with these 540 login attempts from IP addresses in foreign countries. It looks like somebody is trying to access my machine - what sort ...
0
votes
1answer
311 views
Why does the Windows Event Viewer sometimes show a human-readable user name, and sometimes an SID?
On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries.
On other systems, Event Viewer shows an SID (in the form S-1-5-...).
Luckily, the SysInternals ...
0
votes
2answers
73 views
Windows 2008 server unaccessible without traces in the event log
I am trying to figure out why a Windows 2008 server became inaccessible in terms of RDP and access to a web application. The server was turned off and then on. Look at the event log at the time it ...
0
votes
1answer
790 views
How am I able to figure out why apache/php crashes?
I have a problem which is driving me and a few clients on this server totally nuts.
The problem is that PHP (or I guess Apache) seems to be crashing randomly and almost on a daily basis.
The ...
0
votes
1answer
105 views
Reporting critical Event ID to email
How do you organize or implement monitoring system in your domain to monitor these critical error on your workstations and servers ?
Hardware Related:
7, 9, 11, 51, 52, 55 Potential HD related issue
...
0
votes
1answer
57 views
aggregate local events in AD
How can I aggregate events from event viewer log (logins with local Administrator) from all computers (atleast the servers - 2003,2008,2008r2) in an AD domain?
0
votes
1answer
810 views
Security Event Log: User field = N/A
In my Windows Server 2008 R2 Enterprise Security Event Log all entries have 'N/A' for the "User:" field.
Is there something I can do to have this field filled in?
I noticed that this information is ...
0
votes
2answers
1k views
What could cause a flurry of Microsoft-Windows-Servicing events?
I have a windows 2k8 machine that generated almost 40,000 WinEventLog:System events in the period of about 20 minutes. The breakdown of these events by eventcode was approximately:
4373 46%
4371 ...
0
votes
1answer
985 views
Get the “source network address” in Event ID 529 audit entries on Windows XP
In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log.
On a windows XP machine, this (and ...
