"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

3
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
3
votes
1answer
581 views

App pool gets stuck on reset and takes .net pages out

Several times after our app pool has been told to reset, it gets stuck, the .net pages go down and the following error appears in the application event log: Failed to execute request because the ...
2
votes
1answer
82 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...
2
votes
1answer
97 views

Windows Forward Events Missing User Data and Description

I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section. The Subscription Event ...
2
votes
1answer
663 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
2
votes
1answer
234 views

Server 2003 DNS Auditing

I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx It works. When ever a forward ...
1
vote
1answer
50 views

Which events in the events log should be turned into notifications for windows servers?

Which events should I setup to be notified about in order to: be notified if something that needs to be fixed is detected be notified in particular about various disk problems and other hardware ...
1
vote
1answer
92 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
1
vote
1answer
280 views

IIS Crash/Hang agent Event Viewer logs - are they significant

We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other ...
1
vote
1answer
252 views

In xperf (Windows ETW) what's the difference between the 'CPU Sampling by Process' and 'CPU Usage by Process' graphs in the xperf viewer?

The values are tracking very closely, however the 'CPU Sampling by Process' appears to be less fine grained in it's data. I can't find anything in the documentation to differentiate these two.
1
vote
1answer
275 views

search logs for events associated with Task Scheduler

I'm working with a Server08 box (Web Edition) where the Task Scheduler had run a set of unchanged housekeeping scripts for months. Over the last week, Scheduler has failed to start scripts twice. ...
1
vote
1answer
343 views

logparser Message with error codes

Is there anyway to get complete error message using LogParser? When I run the following query: logparser -i:EVT -o:NAT "SELECT TimeGenerated,EventID,Message from System WHERE EventTypeName='Error ...
0
votes
1answer
36 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
0
votes
1answer
55 views

Windows 2003 Ntfs error Event 55 every 15 minutes

I have Windows 2003 with four errors every 15 minutes in my EventLog. The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume I ran chkdsk and ...
0
votes
1answer
18 views

Log user access in a windows domain

I need to log all users access to computer in a mysql database. I need datetime, user and workstation, how to do it? How to set up an event on domain controllers?
0
votes
1answer
44 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
0
votes
1answer
132 views

SBS 2003 no network connection and acting strangely a bunch of Event ID 13568

I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
0
votes
1answer
448 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
0
votes
1answer
184 views

auditpol starting infinite loop in command prompt

On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors. I did some troubleshooting around the internet and found out that I should stop auditing a ...
0
votes
1answer
57 views

Trying to delete an object from the local group policy editor on a windows 2003 r2 member server in a domain

I've used this Serverfault Article in order to add additional event logs for some webservices to the local group policy on my interfaces server. For 2 objects i added, i had a mistype and it created 2 ...
0
votes
1answer
116 views

Event Logs for Remote Share BruteForce

This command is used to access remote shares. net use \10.31.247.2\share /user:admin password Is there any way to detect(EventLogs/other tools) if someone is trying to BruteForce into a remote ...
0
votes
1answer
292 views

Track changes to Windows Update settings in registry

Is it possible to track down changes to the Windows Update settings in the event logs (Win2008 R2 Std)? I tried filtering the System event log by Source = WindowsUpdateClient but this seems to list ...
0
votes
1answer
94 views

how to centerlized Client Machine Event Log Auditing to one server?

We have Windows Server 2003 Enterprise DC for 2000 Windows XP SP3 Client Machine. We just want to centralized audit account logon/logoff event, security event log in windows client on one server. we ...
3
votes
0answers
763 views

What is the Task Scheduler syntax for returning the “ComponentStatus” contents in a Windows Server Backup Event

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
2
votes
0answers
30 views

Logging a list of Worker Process Requests when Application Recycle happens

Does anyone know of the best way to log all work process requests that are currently running when an IIS recycle happens. If you go to IIS > Worker Processes > Select an app pool > View Current ...
2
votes
0answers
288 views

What is a valid destination log for Windows event forwarding

I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid ...
2
votes
0answers
2k views

Windows Application Experience Service

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This occurs ...
1
vote
0answers
46 views

JAVA task reporting perodic file access issue but windows file auditing says it never tried?

Ok so you've got a JAVA task that reads a file on my local disk when it runs, it immediately closes the handle on the file right after it reads its, less than a second, nothing else on the entire ...
1
vote
0answers
51 views

Getting iLO logs for a specific period

I am fetching iLO event logs remotely using cpqlocfg.exe and script Get_iLO_Log.xml. But this gives complete event logs and there is no parameter that can be set to get the logs only for a specific ...
1
vote
0answers
341 views

What do these IPMI System Event Logs mean?

I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
1
vote
0answers
236 views

Windows Centralized Log Subscription

Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
1
vote
0answers
93 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
177 views

Event log message size 31885? Windows 2008

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message On 2008 servers, ...
1
vote
0answers
631 views

WMI Error in event log every boot: EventID 5605

I have a few servers that I keep getting the EventID error 5605 The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if ...
1
vote
0answers
1k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
1
vote
0answers
80 views

Monitoring User / Log in events on my file server

I am searching for a solution to monitor access and activities on my web server. There are only a handful of people who are allowed to access my file server via https or ftp/sftp and I would like to ...
1
vote
0answers
430 views

Cannot open log for source 'blah'. You may not have write access

I'm attempting to write to a custom event log .... but I get the error: Win32Exception Access Is Denied Cannot open log for source 'blah'. You may not have write access. I've trawled the net.. ...
0
votes
0answers
4 views

WMI command line event log acess

Can someone explain me how to get access to arbitrary system logs in eventlog service files? Now I'm poking around WMI(wmic.exe) and trying to execute following commands: For system services like ...
0
votes
0answers
44 views

Backup program completely disappeared over the weekend

Good morning everyone, I got an email on Friday from my backup software telling me I had some minor errors. I got in today and went to fix the errors but couldn't find ANY trance what so ever of the ...
0
votes
0answers
60 views

Customer Experience Improvement sent to Microsoft failure Error 90080108

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 90080108). I'm seeing this error event on a lot of Windows 7 PCs. Once it appears it seems to ...
0
votes
0answers
104 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
0answers
59 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
0
votes
0answers
9 views

Feature 'SpellingFiles_ESN' does not exist

I'm getting lots of MsiInstaller warnings posted in my event logs for the following error - Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'SpellingFiles_ESN', component ...
0
votes
0answers
25 views

Event Viewer showing 1372 and 1528 errors after unsuccessful Exchange uninstall (SBS 2003)

We recently attempted to uninstall Exchange 2003 from a SBS 2003 server. Unfortunately, the uninstall failed with the following errors: Event Viewer is now showing the following Directory Service ...
0
votes
0answers
36 views

How to record AD EventLog that LDAP authentication failure of account that does not exist?

I tried the LDAP authentication to ActiveDirectory from Linux. I was able to confirm that the authentication of the account to the existing successful / failure remains in the event log. But I do not ...
0
votes
0answers
121 views

Windows server 2003. Windows search service error. Unable to initialize the filter host process

I was trying to install SQL server management studio 2008 on Windows Server 2003 SP2 x86 Standard edition and but I couldn't install it. I got an error saying install "Windows Installer 4.5" so I ...
0
votes
0answers
132 views

Simplify NXLOG Setup for me (or alternative)

I need to automatically save off my event logs. A coworker suggested doing this by using a piece of software called NXLOG. Unfortunately the manual for configuring NXLOG gets kind of complicated and ...
0
votes
0answers
151 views

Is it possible to set the “Configure target subscription manager” event forwarding group policy setting to use an environment variable?

I would like to set every client PC to forward certain events to their authenticating DC. I am trying to track logon events by having all workstations stations forward events to the DC they are ...
0
votes
0answers
98 views

Server Event Log ID 26

I’m running Windows Server 2008 with MPIO clustered shared volume, Failover clustering and TSM running Incremental backup at 3am every day. I was looking at event log as part of my routine and found ...
0
votes
0answers
307 views

Windows 2008R2 Event Log not starting Error

I receive an error: Windows could not start the Windows Event Log service. Error 1747: The authentication service is unkown. Any idea what can cause this? 64bit W2008Web the service is indeed not ...