"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

12
votes
6answers
7k views

Server 2008 email on Event variables

One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server. This is working ...
11
votes
1answer
51k views

Where/how does Windows store the data in the event logs?

We run some financial systems that log error messages to the system logs. I need to find out if we can clean these error messages from a PCI DSS point of view. I am specificaly interested in the ...
10
votes
5answers
13k views

How do I passively monitor the Windows Event Log?

How can I monitor the Windows Event Log remotely such that I will be informed automatically when certain events occur? There are plenty of active monitoring solutions, but they require human ...
9
votes
1answer
621 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
7
votes
5answers
30k views

How can I remove specific events from the event log in Windows Server 2008?

Do I need a third party tool for this?
7
votes
3answers
10k views

Windows Event Log Rotation?

Windows Server 2003. Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and ...
7
votes
2answers
21k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
7
votes
1answer
695 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
6
votes
6answers
2k views

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
6
votes
1answer
9k views

Server locking up, /var/log/messages reports “backlog limit exceeded”

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
5
votes
8answers
42k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
5
votes
6answers
25k views

Windows Event Log - email notification

Is there an easy way to send an email when a particular severity of event from a particular service hits the Windows server event log? This is on Windows Server 2003, if it makes a difference. n.b. ...
5
votes
2answers
4k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
5
votes
2answers
19k views

How can I ship Windows Server 2008 event logs to a syslog server?

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...
5
votes
1answer
517 views

Distributed Server Monitoring Solution [closed]

I belong to an independent IT firm that manages and maintains about 50 business clients networks, ranging from small 5 system networks to 200+ systems. Because we are unable to directly monitor each ...
5
votes
1answer
16k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
4
votes
5answers
51k views

How to fix “TCP/IP has reached the security limit…” event message

I get the following warning as a System event: "TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts." on o box running Win XP SP3. How can I fix this issue? ...
4
votes
4answers
4k views

“Account locked out” security event at midnight

The last three midnights I've gotten an Event ID 539 in the log...about my own account: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 539 Date: ...
4
votes
5answers
496 views

Logs worth to keep and analyze in a central repository

In the need to centralize logs we have selected syslog as the collector and Splunk (free for now) as the analysis tool, but there's always the question about which events should get to the central ...
4
votes
2answers
196 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
4
votes
5answers
1k views

Forwarding Windows log event using TCP

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes ...
4
votes
1answer
347 views

Using Powershell, trigger an action if the most recent Event Log event is over one hour old

We have a server running our backup software, and the software has its own event log. I can retrieve the most recent event log entry with this command: Get-EventLog EventLogName -ComputerName ...
4
votes
2answers
182 views

Forwarded Event Logs

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only ...
4
votes
3answers
5k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
4
votes
3answers
1k views

Best way to do DHCPD event logging?

I'm thinking about building an (experimental) system that depends on realtime information from a 'standard' ISC DHCP server on a Linux box. I want to log (and process) events that are related to PXE ...
4
votes
1answer
3k views

What are the differences between Windows EVT and EVTX log files?

Windows is moving to the *.EVTX format for their logging files, but we still have clients that have versions that write to the older *.EVT format. What are the differences in how those files are ...
4
votes
2answers
2k views

Access denied error 3221225578 with file sharing to Windows server

i'm trying to access the shares on a server. The credential box appears, and i enter in a correct username and password, and i get access denied. The silly thing is that i can Remote Desktop to the ...
4
votes
2answers
5k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
4
votes
1answer
3k views

Where can I view active directory failed logon attempts?

I do not see any failed logon attempts in my windows sever 2003 security event log (I see only successful ones). However, I have a user that is getting locked out very often and I need to try to ...
4
votes
1answer
7k views

Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9}

I'm in the middle of a "swing" migration from Windows SBS 2003 to Server 2003 Standard. It's going okay so far but we're getting event 1058 on client machines: Windows cannot access the file gpt.ini ...
4
votes
2answers
158 views

Is there a way to search all the event-logs on a LAN for a specifc event?

Is there a way to search all the event-logs on a LAN for a specifc event?
4
votes
2answers
1k views

Piping powershell messages to Write-EventLog

I have a powershell script that runs a custom cmdlet. It is run by Task Scheduler and I want to log what it does. This is my current crude version: Add-PsSnapIn MyCmdlets Write-EventLog -LogName ...
4
votes
2answers
1k views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
3
votes
2answers
88 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
3
votes
2answers
742 views

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins ...
3
votes
1answer
328 views

Audit when users log on and off servers

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)? ...
3
votes
3answers
3k views

How to troubleshoot events in the Windows Event Logs?

How do you troubleshoot events that are not clear when you read them? Is there a website to search for those Event IDs and errors? In the following example event it is clear that the gateway ...
3
votes
2answers
5k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
3
votes
1answer
168 views

Using Powershell, compare the TimeCreated values of two events and take action if one is older than the other

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent): Get-WinEvent -FilterHashtable ...
3
votes
2answers
373 views

Novell Netware 6.5 Server Logs

I have inherited a Novell Netware 6.5 server to manage. We had have some users move folders into other folders that they were not supposed to be able to do. Additionally, there have been cases were ...
3
votes
1answer
5k views

Relocating event logs in Windows Server 2008 R2

How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. ...
3
votes
2answers
228 views

What's this odd logon failure I see every day?

I'm having something weird happen on a Windows Server 2008 R2 server. Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
3
votes
2answers
554 views

Open source scripting log analysis: tools for breaking stderr log messages into groups (normal bugs vs abnormal) or looking at trends (we're getting less of this message and more of that one)

Imagine some linux systems with scripts of various kinds (mostly PERL but it could be anything that writes to STDERR) which are run 100s of times by different users with slightly different needs. ...
3
votes
2answers
206 views

Windows Server 2008 R2 Source-Initiated Event Log Forwarding: No Source Servers Reporting

I have a Server 2008 R2 server acting as a collector for two other servers. One is 2008 R2 as well, the other is 2012 R2. Collector Initiated forwarding works just fine, and that's really the only ...
3
votes
1answer
39 views

Creating a System Event for Newly Created 10 Gig Files in a specific directory

I'm looking to find some way that my Windows Small Business Server 2011 machine can auto create system events any time there is a newly created file 10 GBs and larger in a specific directory. It seems ...
3
votes
1answer
2k views

powershell Get-WinEvent cmdlt: Filtering by time-stamp not producing desired results?

I am trying to filter events via Get-WinEvent to get specific logs from the last 24 hours: $EventLogFilter = @{logname='ForwardedEvents'; id=4771,4625,4768; StartTime=(Get-Date).AddHours(-24)} ...
3
votes
1answer
183 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
3
votes
2answers
1k views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
3
votes
1answer
1k views

How to clear the DMI System Event Log from linux?

Is it possible to clear the DMI event log (the one that gets partially shown by dmidecode --type 15) from Linux ? I know it can be cleared from the bios but it is a server in a remote location and ...
3
votes
3answers
2k views

How to export all System event logs of a definite time period

I am working on a Windows Server 2003 SP2 with Powershell v2, and I am looking for a way to export all System event logs of a definite time period, (say, from Saturday 2000 hours to Sunday 1100 ...