1
vote
0answers
30 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
1
vote
1answer
36 views

Windows Event Log wrong Source column value

In the Event Viewer in Windows 7 there is a Source column that is set by my Windows Service application. The value is set to TOS and usually when a log entry is associated to my application, it has ...
0
votes
1answer
95 views

Windows Event Viewer AppLocker XPath filter

I'm running AppLocker and would like to filter out some noise from the events being logged in Event Viewer using XPath. Specifically, I want to hide any events which related to CMD.exe Here's an ...
2
votes
1answer
45 views

Offline Windows Event ID Solution? [closed]

In my work i have many buildings with no internet , is there a program or an offline database for errors with event ID for Microsoft , so that will save my time for calling my assistants to search for ...
9
votes
1answer
404 views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
2
votes
1answer
155 views

How does Windows Event forwarding work with non domain computers? (certificates)

In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service. Microsoft's Event Collector Service on ...
-1
votes
2answers
172 views

Windows Event Log SystemTime format [closed]

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
0
votes
0answers
127 views

Windows server 2003. Windows search service error. Unable to initialize the filter host process

I was trying to install SQL server management studio 2008 on Windows Server 2003 SP2 x86 Standard edition and but I couldn't install it. I got an error saying install "Windows Installer 4.5" so I ...
2
votes
1answer
225 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
0
votes
3answers
343 views

Windows Server 2003: start program on event in event viewer

With windows server 2008 you can start a program using scheduled task triggered by event on event viewer. Is there a way to emulate this with Windows Server 2003? Thank you in advance
7
votes
1answer
547 views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
0
votes
1answer
47 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
4
votes
2answers
172 views

Opening an archived “Application Event Log” (Hidden Directory)

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders". I can see this folder in Windows Explorer: ...
0
votes
1answer
111 views

Can eventvwr.msc's log files be exported to text or sql server in Windows?

Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files? Every search I do on Google for this returns how to export ...
1
vote
1answer
3k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
3
votes
1answer
165 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
2
votes
1answer
224 views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: ...
0
votes
2answers
616 views

Moving Windows event logs without corrupting them

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs. Whenever I move an event log it ...
3
votes
2answers
85 views

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
5
votes
2answers
3k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
2
votes
1answer
394 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
1
vote
0answers
96 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
2
votes
1answer
886 views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
4
votes
1answer
15k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...
1
vote
1answer
120 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
2
votes
1answer
165 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
1
vote
1answer
281 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
1
vote
1answer
96 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
4
votes
2answers
4k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
1
vote
1answer
133 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...
1
vote
3answers
577 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
1
vote
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
2
votes
2answers
229 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
3
votes
2answers
723 views

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins ...
3
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
1
vote
0answers
2k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
0
votes
1answer
292 views

Generate Custom View logs for email to admins

I want to create a scheduled task that will take a custom view I have created in Server 2008 Event Viewer and email all the events in a .xml format once a week (Monday morning). Bonus points if you ...
0
votes
1answer
390 views

Why does the Windows Event Viewer sometimes show a human-readable user name, and sometimes an SID?

On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries. On other systems, Event Viewer shows an SID (in the form S-1-5-...). Luckily, the SysInternals ...
0
votes
1answer
149 views

Is it possible to connect WinServer eventlog from other domain

I have a virtual machine with Windows Server R2 Ent. In this machine runned domain controler test.local. I have admin(doamin and local) account on this machine. I want to get access to event log of ...
0
votes
1answer
61 views

aggregate local events in AD

How can I aggregate events from event viewer log (logins with local Administrator) from all computers (atleast the servers - 2003,2008,2008r2) in an AD domain?
1
vote
2answers
379 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
1answer
7k views

Is it possible to enable logging of RDP connections / disconnections under Windows XP and Windows 7?

As the title suggests, I'm trying to keep an eye on RDP connections / disconnections to a couple of machines. One's running Windows XP and one's running Windows 7. I've checked the event logs on the ...
1
vote
2answers
6k views

WinXP Event Viewer: Internet Explorer - how to log events?

I'm trying to debug a strange rendering/interaction issue with a web application in IE and thought I'd peek at the event viewer in Windows (XP) to see if anything odd was happening at the same time. ...