"Event log" usually refers to the system/server logs on Microsoft Windows machines.
1
vote
1answer
2k views
How do I fix a custom Event Viewer Log that merges automatically with the Application log?
I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
3
votes
2answers
4k views
How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?
I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating
HTTP Error 500.0 - Internal Server Error
The page ...
2
votes
1answer
47 views
What's this odd logon failure I see every day?
I'm having something weird happen on a Windows Server 2008 R2 server.
Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
0
votes
1answer
60 views
SBS 2003 no network connection and acting strangely a bunch of Event ID 13568
I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
1
vote
1answer
591 views
The previous system shutdown at xxxx was unexpected
For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message:
Event Type: Error Event
Source: EventLog Event
Category: None
...
0
votes
3answers
2k views
NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134
I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day:
...
0
votes
1answer
45 views
Can eventvwr.msc's log files be exported to text or sql server in Windows?
Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files?
Every search I do on Google for this returns how to export ...
0
votes
1answer
45 views
AD: delegating computer log access
I would like to setup the following audit scenario:
A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
2answers
83 views
Determine windows server attack? Should I monitor the server and block IPs all the day?
While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows:
**An account failed to log on.**
Subject:
Security ID: SYSTEM
Account Name: ...
2
votes
2answers
39 views
Event 34 on Windows 2008 R2 write cache and sysvol on system drive
I have Windows Server 2008 R2 running as Active Directory Primary Domain Controller.
Since our domain is not large, I put the SYSVOL and NTDS folders in the default location on the system drive (SSD ...
1
vote
1answer
69 views
How do I query the contents of an error message in the Windows event log?
So I've got an application event log...let's call it "CustomApplicationLog"
I've also got an awesome application...let's call it "MyAwesomeApplication"
Assuming this application were to ever throw ...
0
votes
0answers
25 views
Create Windows 2012 Event Viewer custom view
I have folders that I'm tracking with object access auditing. I'd like to create a custom view to see just a specific folder path.
I created a custom filter to just take the Object Access event ...
0
votes
2answers
50 views
Clean up event log by script
Any way to remove all entries from the Windows event logs (Application, System & Software) apart from the last 24 hours?
Via command line such as batch file.
On Windows 2008 R2 Server & ...
1
vote
2answers
932 views
Including Event description on Windows 2008 OnEvent SendEMail Task
I've got a scheduled task setup in Windows 2008 R2 to send me an email if a specific event is logged to the event log. This works great. However, I'd like to include the event description from the ...
0
votes
2answers
48 views
Windows service restart source
I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
0
votes
1answer
58 views
security_error_ring_buffer_recorded in system health log - what does it mean?
Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012.
Today I was checking the log files located in:
...
1
vote
4answers
10k views
How can I view login/logoff times for Windows Server 2008?
I use Windows Server 2008 at my workstation and sometimes work from home. Is there an easy way of viewing the login and logoff times from the event viewer so I can see how many hours I was logged in ...
1
vote
1answer
562 views
How to differentiate between users and computers in EventID 4768 - Active Directory?
I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers.
My problem is, that as far as I can see, I ...
1
vote
1answer
42 views
How to automatically backup Windows event logs?
There doesn't appear to be a way to backup (archive) Windows event logs automatically via the GUI. Is there a way via a script that can be set as a scheduled task to do this? If so, can someone ...
3
votes
2answers
673 views
Piping powershell messages to Write-EventLog
I have a powershell script that runs a custom cmdlet. It is run by Task Scheduler and I want to log what it does.
This is my current crude version:
Add-PsSnapIn MyCmdlets
Write-EventLog -LogName ...
0
votes
1answer
73 views
Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role
Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this:
The message repeats every second and the port number is increased by one the range ...
4
votes
2answers
168 views
How to monitor Windows Server events with Centreon Nagios
I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
0
votes
1answer
61 views
How to fix automatic random restart with Windows Server 2008? [closed]
I'm experiencing random automatic server reboot. I'm trying solve the listed errors on event log. Currently I'm facing the error with:
Event ID: 1
Source : AeLookupSvc
General details : The ...
0
votes
1answer
157 views
Track changes to Windows Update settings in registry
Is it possible to track down changes to the Windows Update settings in the event logs (Win2008 R2 Std)?
I tried filtering the System event log by Source = WindowsUpdateClient but this seems to list ...
0
votes
1answer
27 views
Group Policy Preference Event id in Window XP [closed]
Whenever Group Policy Preference get auto-update after 90 minutes interval on Window XP. Is there any event id generated or not in Window XP?
Please answer in Yes or No.
If yes than what is Event Id ...
0
votes
0answers
108 views
Windows SharePoint Services 3 Error — Event ID 6398
Every Minute I'm getting an error from Windows SharePoint Services 3. Below is the error text. The access denied part indicates to me that there is a permissions problem.
I have already tried (after ...
0
votes
1answer
45 views
Group Policy Event id [duplicate]
DC - Windows Server 2008 R2
Client OS - Window XP
Which Event id is generated on Window XP, if my Group policy preference is automatically updated after 90 minutes interval.
Sorry, i tried to find ...
0
votes
1answer
215 views
Event Log > Filter Current Log > XML > where EventData contains text
I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
...
1
vote
0answers
110 views
What do these IPMI System Event Logs mean?
I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
0
votes
0answers
91 views
Event id 5723 netlogon when joining a new pc to domain
Is there any reason I would get the event id 5723 when joining a new windows 7 professional notebook to an existing windows server 2003 domain?
The notebook eventually did join successfully but that ...
11
votes
5answers
4k views
Server 2008 email on Event variables
One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.
This is working ...
0
votes
0answers
54 views
Solaris 10 Auditing of HTTP / HTTPS Request Logs
I need to gather data about HTTP/S requests made to the server. However, the application server (IBM WebSphere 7) running on it doesn't have any auditing turned on, and the applications on it don't ...
2
votes
1answer
72 views
Discrepancy between Event Log taken from Powershell and with Event Log Viewer
Domain Controller OS - Window Server 2008 R2
Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
0
votes
2answers
245 views
how to open a saved eventlog file with display information
i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
2answers
228 views
Event ID 2013 (Disk Is At Or Near Capacity) not getting logged
I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is ...
0
votes
0answers
18 views
Unexpected two consecutive event id 6009 in logFile windows server 2003
i'm analizing a log file from windows server 2003 i have found two consecutive logs with eventID 6009. Between this logs and after the second, there aren't other any logs like 6006, 6008 or similar ...
0
votes
1answer
52 views
BINLSVC warning in event log - netclass.inf parsing Manufacture
So I am trying to get Remote Installation Service Running on a Windows Server 2003 R2 Standard Edition with Service Pack 2 installed. I am trying to integrate network drivers into the image and I keep ...
1
vote
0answers
18 views
Clear specific entries in Security Log, Event Log in Windows 8 [duplicate]
Possible Duplicate:
How can I remove specific events from the event log in Windows Server 2008?
Is it possible to remove specific entries in Event Log of Windows 8? Which tools could I use? ...
1
vote
1answer
1k views
Event ID 8021 The browser was unable to retrieve a list of servers from the browser master
We have a LAN where workstations are randomly losing network connectivity for brief moments of time. The workstations can also take a long time to login to the domain.
During our troubleshooting we ...
2
votes
1answer
102 views
New event log nowhere to be found after creating in PowerShell
Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log:
...
2
votes
1answer
900 views
Tracking which computer printed a document on Windows 2003 domain
Currently, when a user prints a document there is an Event ID 10 recorded in our event log. We have mostly XP Clients on a Win2003 domian. However, I cannot tell which computer this user printed a ...
0
votes
2answers
51 views
Lots of Failure Alerts on my DC
I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.
Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
0
votes
1answer
985 views
Get the “source network address” in Event ID 529 audit entries on Windows XP
In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log.
On a windows XP machine, this (and ...
3
votes
2answers
60 views
What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?
Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
2
votes
1answer
193 views
Lots of FAILURE AUDIT: an account failed to log on entires in Security Log
I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request?
Do you ...
1
vote
2answers
267 views
Is it possible to export Windows event logs from multiple servers to a non-windows host, without running event manager on each of the Windows servers?
I want to export event logs from Windows to a non-Windows host. I was considering using Logstash, but that would seem to require that I install and run Logstash on each server. Is it possible to do ...
1
vote
1answer
132 views
Remote Desktop IP missing in Event Log
I was checking my remote desktop event logs and an entry is confusing for me.
The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
0
votes
2answers
198 views
Moving Windows event logs without corrupting them
I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs.
Whenever I move an event log it ...
0
votes
1answer
662 views
Errors Event 7888, 6102, 6641 MOSS [closed]
I'm getting this errors on my Server. Version MOSS 2007, on Windows Server Standar 2008 and this message appear every minute. Next, you can find its descriptions:
Can any one help me with this?
...
0
votes
1answer
142 views
Cisco Nexus syslog messages format?
I'm trying to normalize Syslog messages generated by a Cisco Nexus box.
Problem: Messages have the following format:
<189>: yyyy mm dd hh:mm:ss UTC: text
This is not a standard Syslog message, no ...
