This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

9
votes
1answer
133 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
0
votes
0answers
68 views

Event log with thousands of Audit Success events regarding cryptography

I have a Windows Server 2008 R2 Standard running IIS web apps, today the websites were operating fine however when I tried to use Teamviewer on it, it was extremely slow and was losing connection all ...
1
vote
1answer
169 views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
2
votes
1answer
77 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
1
vote
2answers
82 views

Suspicious Login Success in Event Viewer

Hope you can help. We have been noticing another user's local machine creating logon entries in the event viewer of our machine. The message received is "An account was successfully logged on". The ...
2
votes
2answers
46 views

GPO set to trigger in response to an event?

I want to trigger an action/task when an event is raised in any computer of the domain. It this possible via GPO, do or I need to deploy script to all machines on the domain?
1
vote
0answers
530 views

“Unable to open the Server service performance object.”

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log: Unable to open the Server service performance ...
0
votes
0answers
18 views

Sbs 2003 health monitor - EmbeddedStatusEvent

Masters, We use SBS 2003 Healt Monitor to trigger some alert when specified event occured on event log. In the HM we have to set the e-mail settings, if we would like to get e-mail notificaton from ...
-1
votes
2answers
95 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
0
votes
0answers
89 views

Windows server 2003. Windows search service error. Unable to initialize the filter host process

I was trying to install SQL server management studio 2008 on Windows Server 2003 SP2 x86 Standard edition and but I couldn't install it. I got an error saying install "Windows Installer 4.5" so I ...
2
votes
1answer
95 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
0
votes
0answers
55 views

Windows Server Audit Failure from Client

Every several minutes I get an audit failure from one of my clients running Windows 8 on ports 56280 to 56294 in the event log of my server which provides DHCP/DNS/DC for that client. Do you have any ...
0
votes
3answers
206 views

Windows Server 2003: start program on event in event viewer

With windows server 2008 you can start a program using scheduled task triggered by event on event viewer. Is there a way to emulate this with Windows Server 2003? Thank you in advance
1
vote
1answer
321 views

Security Audit Failures in Event Viewer Windows Server 2008R2

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for ...
4
votes
1answer
306 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
0
votes
1answer
56 views

Windows event viewer application logs lost after reboot

I need to check event viewer's application logs for uninstall events. So, I filtered them on MSIInstaller. Turns out I can see logs only upto last reboot which was just a few hours ago from writting ...
0
votes
0answers
72 views

sharepoint 2010 search error give me correlation id and event viewer is empty and no log there

we have a farm of SharePoint 2010 that worked properly since last week. we configure and start the search service last week and it is also worked and when we test it with some criteria , worked , and ...
-1
votes
2answers
115 views

Event Viewer Task for a specific task

I can create Event Viewer Tasks to react to Event IDs, but I'm having a tough time getting the XML working to react to an event ID to a specific task. I've been testing using the filter. The task ...
0
votes
1answer
41 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
0
votes
0answers
86 views

Windows 7 wmiprvse 70% CPU and attached to “system idle”

I have wmiprvse.exe process taking up 70% of my cpu power. I;ve followed instructions elsewhere to find which process it is attached to and by running a log on: Event Viewer -> Applications and ...
4
votes
2answers
133 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
0
votes
0answers
71 views

Error accessing server logs

Few weeks in a row I am noticing the following problem on my Windows 2008 Server event viewer cannot open the event log or custom view. verify that event log service is running or query too long. ...
1
vote
0answers
260 views

Powershell 3.0 Enter-PSSession fails randomly, reboot solves it. DCOM error in Event Viewer on target machine

Using PowerShell's Enter-PSSession (even locally, against the local computer) fails randomly with the following message. Running Windows 2012 Standard with all updates. The error message takes a while ...
0
votes
1answer
150 views

7024 event on Windows service shutdown

I am seeing the following event in event viewer: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" ...
0
votes
1answer
85 views

Event Viewer Custom View Different Paths

I'm having trouble with a custom Event Viewer filter to show events that match both selects. Here is what I have so far: <QueryList> <Query Id="0" Path="System"> <Select ...
0
votes
1answer
102 views

Can eventvwr.msc's log files be exported to text or sql server in Windows?

Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files? Every search I do on Google for this returns how to export ...
1
vote
1answer
2k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
3
votes
1answer
128 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
1
vote
1answer
1k views

Remote Desktop Services login history

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server? The closest Event Viewer logs I can find are under Application and Services Logs --> ...
-4
votes
1answer
91 views

Inject events in the event viewer in an old date [closed]

I need to inject some event in my event viewer in an old date, how event viewer data are stored, and can I change it? ** EDIT ** I need it to know that if any one, In any way can fool me and do ...
1
vote
1answer
336 views

Send mail on event log error trigger safe check frequency

I want to use powershell to alert me when an error occurs in the event viewer on my new Win2k12 Standard Server, I was thinking I could have the script execute every 10mins but don't want to put any ...
2
votes
1answer
171 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
4
votes
1answer
635 views

Can I disable Windows Event Logging for a certain service?

We have a legacy application running on a Windows Server 2008 VM from Azure that is spamming our windows event log every minute or so. I do not have access to the source for the bit of code that is ...
0
votes
2answers
514 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...
1
vote
1answer
281 views

What is the Event id for File & folder creation in Window Server 2008

I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event ...
3
votes
2answers
77 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
0
votes
1answer
154 views

Kernel-General events missing in the eventlog of Windows 2008 Standard Edition

I can't find any Microsoft-Windows-Kenel-General events in the event log. It is a Windows 2008 Standard Edition server. Is there any setting that has to be switched on for them to be logged? The ...
2
votes
1answer
1k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
5
votes
2answers
2k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
3
votes
0answers
92 views

Corrupt General Tab in Event Viewer

Whenever ASP.NET reports a dangerous query string value to the Application log and the request contains a certain combination of characters; the event viewer will not show the error information and ...
2
votes
1answer
301 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
-1
votes
1answer
60 views

Monitor Eventlogs [closed]

Was just wondering how you Sysadmins monitor Windows Events logs on multiple servers. What apps are recommended and what should I be looking for? I'd imagine there must be something that can forward ...
2
votes
1answer
385 views

Mrxsmb (Event 8003) brings down the Network

There a domain with Windows SBS 2003 as the DC. At regular intervals, I am faced with the Mrxsmb (Event 8003) error which brings down the network. We have to other Windows SBS 2003 servers on the ...
1
vote
0answers
85 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
121 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
1
vote
1answer
876 views

Is it possible to filter out (remove) a single Event ID from the Event Viewer?

Let's say I want to remove a single event from the view so I can view the rest. How do I accomplish this? This is on a Server 2003 R2 box.
2
votes
1answer
370 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
3
votes
1answer
12k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
2
votes
2answers
3k views

Event Log time when Computer Start up / boot up

Client OS - Window XP Domain Controller:- Window server 2008 Standard R2 I had one Window XP system, i want to find out when the system has started or boot ( at what time and at which date ). I ...
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...