"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

4
votes
2answers
986 views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
2
votes
1answer
23 views

How to find core dumps mentioned in event log

When I search for the files the event log mentions they are not there. Well, the bottom one is there but there's no helpful information in that file. This event was created by the Windows Error ...
2
votes
1answer
45 views

WMI command line event log acess

Can someone explain me how to get access to arbitrary system logs in eventlog service files? Now I'm poking around WMI(wmic.exe) and trying to execute following commands: For system services like ...
2
votes
1answer
735 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
0
votes
3answers
1k views

Exchange 2010: Event id 9554 for deleted mailbox

I've deleted a mailbox and it's user in Exchange 2010. Now I'm getting the following warnings in the event log of the Exchange server: Unable to update Mailbox SD in the DS. Mailbox Guid: ...
1
vote
3answers
1k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
1answer
74 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
3
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
7
votes
1answer
486 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
1
vote
3answers
41 views

Event logs saved on network share

I'm currently working on a project and having problems with saving event logs where i specify them. My problem is i want to have them saved on our file-server in a specified folder, however they wont ...
1
vote
1answer
28 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
2
votes
1answer
90 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...
3
votes
3answers
4k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
1
vote
1answer
693 views

How to troubleshoot Application Popup issues 0XC0000142 and 0XC000009a

I am running randomly into 1 of these popups when our application runs. The machines range from 8GB/8Core to 24GB/24Core and run Windows Server 2008 R2. The application is a bunch of perl scripts and ...
2
votes
1answer
112 views

Windows Forward Events Missing User Data and Description

I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section. The Subscription Event ...
0
votes
0answers
44 views

Backup program completely disappeared over the weekend

Good morning everyone, I got an email on Friday from my backup software telling me I had some minor errors. I got in today and went to fix the errors but couldn't find ANY trance what so ever of the ...
2
votes
1answer
43 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
1
vote
2answers
87 views

Write to Windows Event Log when an IIS site is started or stopped

Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
0
votes
1answer
38 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
0answers
62 views

Customer Experience Improvement sent to Microsoft failure Error 90080108

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 90080108). I'm seeing this error event on a lot of Windows 7 PCs. Once it appears it seems to ...
2
votes
1answer
88 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
9
votes
1answer
291 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
1
vote
8answers
7k views

In windows XP, can i log user login/logoff and lock/unlock actions

Let me preface by saying I am extremely forgetful. I would like to have a log when I login, logout, lock and unlock my workstation. (in my case so i can track the nunmber of hours i spend at the PC) ...
0
votes
0answers
118 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
0answers
62 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
1
vote
3answers
133 views

Window's native event forwarding directly to a syslog\sql server

Right now I have events being forwarded to a collector on which I then run a script to pull them out of the collector's event logs as xml and then insert them in a DB. Is there any utility that knows ...
0
votes
1answer
37 views

Can you view an individual events size in the Windows Event Log?

I'm currently using Windows 2008, and would like to view an individual event's size in the Windows Event Log (Application, Security, System logs). I have tried right clicking and selecting ...
3
votes
1answer
36 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
0
votes
1answer
57 views

Windows 2003 Ntfs error Event 55 every 15 minutes

I have Windows 2003 with four errors every 15 minutes in my EventLog. The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume I ran chkdsk and ...
4
votes
2answers
155 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
0
votes
1answer
161 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
0
votes
0answers
9 views

Feature 'SpellingFiles_ESN' does not exist

I'm getting lots of MsiInstaller warnings posted in my event logs for the following error - Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'SpellingFiles_ESN', component ...
3
votes
2answers
2k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
2
votes
1answer
137 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
1
vote
1answer
61 views

How can I list the Source Network Address for failed FTP attempts in the Security Windows Log on Windows Server 2008 R2?

I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as ...
3
votes
3answers
430 views

Event Logging for RAID fault in 2008 R2

does anyone have a solution for logging an error/critical entry to the event log in 2008 R2 when RAID has an issue? I really want to set up email alerts for when this happens. I'm using the MS builtin ...
0
votes
1answer
18 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
2
votes
1answer
347 views

wevtutil requires Run As Admin for Security log (but not for System), or how to Run As Admin for Task

I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary: wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1 I'm making a batch file ...
1
vote
1answer
158 views

How to get application for application event log

I have some servers that are commonly having error 1000s. I want to find if it's the same application all the time, or if it's different applications. I am using this: Get-EventLog application 1000 ...
2
votes
0answers
30 views

Logging a list of Worker Process Requests when Application Recycle happens

Does anyone know of the best way to log all work process requests that are currently running when an IIS recycle happens. If you go to IIS > Worker Processes > Select an app pool > View Current ...
1
vote
3answers
1k views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
2
votes
1answer
21 views

How to make advanced audit changes in 2008 (non-R2)?

I am trying to configure auditing settings across my domain. My domain controllers are Windows Server 2008 and the rest of my environment is either 2008 or 2008 R2. Some of the audit policies I need ...
1
vote
1answer
66 views

Maximum Setup Log Size in Group Policy?

I want to set a maximum size for the setup log across all the machines in my domain but within group policy I only see GPO settings for maximum application, security, and system logs. Is there a way ...
2
votes
1answer
333 views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm ...
1
vote
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
2
votes
2answers
2k views

Event ID for modified GPOs

I have to know, who (usersid or loginname) changed a specified GPO for a specified OU in the Active Directory. Given our audit settings include this, what would be the right Event ID to look for?
0
votes
0answers
25 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
1
vote
1answer
90 views

How to record IIS 8 client authentication errors in Windows Events?

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some ...
2
votes
2answers
608 views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
2
votes
1answer
90 views

Security Log - Overcrossing Maximum size limit

Please check the below print-screen. I have limit maximum log size at 80 MB, still the log size has gone till 10 GB, Why? do you have any idea, why it is happening and how to limit to 80 MB.