"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
0answers
9 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
0answers
24 views

Customer Experience Improvement sent to Microsoft failure Error 90080108

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 90080108). I'm seeing this error event on a lot of Windows 7 PCs. Once it appears it seems to ...
4
votes
2answers
765 views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
2
votes
1answer
31 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
9
votes
1answer
133 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
1
vote
8answers
7k views

In windows XP, can i log user login/logoff and lock/unlock actions

Let me preface by saying I am extremely forgetful. I would like to have a log when I login, logout, lock and unlock my workstation. (in my case so i can track the nunmber of hours i spend at the PC) ...
2
votes
3answers
3k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
1
vote
1answer
603 views

How to troubleshoot Application Popup issues 0XC0000142 and 0XC000009a

I am running randomly into 1 of these popups when our application runs. The machines range from 8GB/8Core to 24GB/24Core and run Windows Server 2008 R2. The application is a bunch of perl scripts and ...
2
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
0
votes
0answers
19 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
0answers
27 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
1
vote
3answers
37 views

Window's native event forwarding directly to a syslog\sql server

Right now I have events being forwarded to a collector on which I then run a script to pull them out of the collector's event logs as xml and then insert them in a DB. Is there any utility that knows ...
0
votes
1answer
25 views

Can you view an individual events size in the Windows Event Log?

I'm currently using Windows 2008, and would like to view an individual event's size in the Windows Event Log (Application, Security, System logs). I have tried right clicking and selecting ...
3
votes
1answer
30 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
0
votes
1answer
35 views

Windows 2003 Ntfs error Event 55 every 15 minutes

I have Windows 2003 with four errors every 15 minutes in my EventLog. The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume I ran chkdsk and ...
4
votes
2answers
133 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
0
votes
1answer
154 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
0
votes
0answers
5 views

Feature 'SpellingFiles_ESN' does not exist

I'm getting lots of MsiInstaller warnings posted in my event logs for the following error - Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'SpellingFiles_ESN', component ...
3
votes
2answers
458 views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
2
votes
1answer
77 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
1
vote
1answer
34 views

How can I list the Source Network Address for failed FTP attempts in the Security Windows Log on Windows Server 2008 R2?

I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as ...
3
votes
3answers
391 views

Event Logging for RAID fault in 2008 R2

does anyone have a solution for logging an error/critical entry to the event log in 2008 R2 when RAID has an issue? I really want to set up email alerts for when this happens. I'm using the MS builtin ...
0
votes
1answer
15 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
2
votes
1answer
122 views

wevtutil requires Run As Admin for Security log (but not for System), or how to Run As Admin for Task

I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary: wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1 I'm making a batch file ...
1
vote
1answer
98 views

How to get application for application event log

I have some servers that are commonly having error 1000s. I want to find if it's the same application all the time, or if it's different applications. I am using this: Get-EventLog application 1000 ...
2
votes
0answers
23 views

Logging a list of Worker Process Requests when Application Recycle happens

Does anyone know of the best way to log all work process requests that are currently running when an IIS recycle happens. If you go to IIS > Worker Processes > Select an app pool > View Current ...
1
vote
3answers
571 views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
2
votes
1answer
18 views

How to make advanced audit changes in 2008 (non-R2)?

I am trying to configure auditing settings across my domain. My domain controllers are Windows Server 2008 and the rest of my environment is either 2008 or 2008 R2. Some of the audit policies I need ...
1
vote
1answer
35 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
2
votes
1answer
102 views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
1
vote
1answer
2k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
1
vote
2answers
2k views

Event ID for modified GPOs

I have to know, who (usersid or loginname) changed a specified GPO for a specified OU in the Active Directory. Given our audit settings include this, what would be the right Event ID to look for?
0
votes
0answers
23 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
1
vote
1answer
59 views

How to record IIS 8 client authentication errors in Windows Events?

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some ...
2
votes
2answers
300 views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
2
votes
1answer
46 views

Security Log - Overcrossing Maximum size limit

Please check the below print-screen. I have limit maximum log size at 80 MB, still the log size has gone till 10 GB, Why? do you have any idea, why it is happening and how to limit to 80 MB.
0
votes
0answers
30 views

How to record AD EventLog that LDAP authentication failure of account that does not exist?

I tried the LDAP authentication to ActiveDirectory from Linux. I was able to confirm that the authentication of the account to the existing successful / failure remains in the event log. But I do not ...
2
votes
3answers
946 views

Can Windows logoff events be tracked?

I'm working on an application to track network user logon/logoff events in an Active Directory domain; the application will work by auditing security logs on domain controllers. Auditing logon events ...
-2
votes
1answer
1k views

Windows XP clients strange message in event log [closed]

I am getting the following error message in the event log of many of my windows XP clients The COM+ Event System failed to create an instance of the subscriber ...
2
votes
8answers
11k views

How to track down the cause of Windows Server 2008 crashing?

I have Windows Server 2008 running under VMware. Recently, its started to crash roughly every day, with continuous 100% CPU utilization, and no response in the GUI. Is there a step-by-step ...
-1
votes
2answers
95 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
1
vote
1answer
757 views

The previous system shutdown at xxxx was unexpected

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message: Event Type: Error Event Source: EventLog Event Category: None ...
0
votes
2answers
1k views

Permissions needed to read event log messages remotely?

When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error: The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
3
votes
1answer
109 views

Using Powershell, compare the TimeCreated values of two events and take action if one is older than the other

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent): Get-WinEvent -FilterHashtable ...
0
votes
0answers
89 views

Windows server 2003. Windows search service error. Unable to initialize the filter host process

I was trying to install SQL server management studio 2008 on Windows Server 2003 SP2 x86 Standard edition and but I couldn't install it. I got an error saying install "Windows Installer 4.5" so I ...
1
vote
1answer
47 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
0
votes
1answer
277 views

Security has requested to process its policy settings again. Error

I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO. Security has requested to process its policy settings ...
1
vote
1answer
98 views

Automatic Saving of Windows Event Logs [closed]

I'm looking for a way to automatically save off Windows security event logs from several servers to one central location (connected on the network and domain). I want to be able to do this on a ...
1
vote
2answers
110 views

How to use imported text in a variable in powershell

I want an automatic AD unlock with some users. I use this to import the info in a text file Get-EventLog -LogName Security -ComputerName COMP -InstanceId 4740 -Newest 1 | Format-List >> ...
1
vote
2answers
502 views

Eventlog entry for allowed connection in Windows Firewall

I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: ...