This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

2
votes
1answer
2k views

Group Policy settings for Event Logs

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files? And which setting will apply? ...
5
votes
2answers
4k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
3
votes
0answers
96 views

Corrupt General Tab in Event Viewer

Whenever ASP.NET reports a dangerous query string value to the Application log and the request contains a certain combination of characters; the event viewer will not show the error information and ...
2
votes
1answer
437 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
-1
votes
1answer
63 views

Monitor Eventlogs [closed]

Was just wondering how you Sysadmins monitor Windows Events logs on multiple servers. What apps are recommended and what should I be looking for? I'd imagine there must be something that can forward ...
2
votes
1answer
506 views

Mrxsmb (Event 8003) brings down the Network

There a domain with Windows SBS 2003 as the DC. At regular intervals, I am faced with the Mrxsmb (Event 8003) error which brings down the network. We have to other Windows SBS 2003 servers on the ...
1
vote
0answers
99 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
136 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are ...
1
vote
1answer
1k views

Is it possible to filter out (remove) a single Event ID from the Event Viewer?

Let's say I want to remove a single event from the view so I can view the rest. How do I accomplish this? This is on a Server 2003 R2 box.
2
votes
1answer
1k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
5
votes
1answer
16k views

Event 36888 : The following fatal alert was generated: 10. The internal error state is 1203

I search on the Internet, but i am unable to find, Why this error is coming? It has flooded my Event Viewer, after interval of 1 minutes, this Error pops-up. ( means the frequency is 1 minutes ) I ...
2
votes
2answers
5k views

Event Log time when Computer Start up / boot up

Client OS - Window XP Domain Controller:- Window server 2008 Standard R2 I had one Window XP system, i want to find out when the system has started or boot ( at what time and at which date ). I ...
0
votes
2answers
2k views

Server Hanging - Server Event Viewer

We are experiencing problems with our dedicated server, where it is hanging quite often (sometimes in the space after a few hours after a power cycle). I've looked in the Events Viewer and under ...
1
vote
1answer
125 views

IIS EventLog Errors

I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load ...
0
votes
1answer
2k views

Lots of Logon/Logoff events in the event viewer windows 2003

I seem to be getting a lot of these entries in the Security event viewer. Around 8-12 every hour. I am wondering if a) I should be worried about it? or b) what actually is going on, Can anyone help? ...
2
votes
1answer
167 views

Export from Saved system log

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"". Any ideas ?
2
votes
3answers
13k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
1
vote
0answers
774 views

What could cause local folders in a Windows 2008 DFS replication group to randomly obtain system and hidden attributes

We have a Windows 2008 server (not R2) acting as a primary file source in a DFS replication group with a single other server that happens to be Windows Storage Server 2008. All is well in terms of ...
1
vote
1answer
304 views

Custom Event IDs Using NTEventLogAppender

This is my first post on ServerFault, but I love StackOverflow. I'm a coder, and as such I'm more comfortable in an IDE than in the registry, so I've come here for help. Problem: I have a chain of ...
2
votes
0answers
551 views

Why are the results of a chkdsk scan on drive C: not showing in the event viewer, but chkdsk results for N: are?

On a Server 2008 R2 member server I schedule chkdsk to check drives C: and N:. Only the results for the N: drive are seen in event viewer. In previous Windows Servers, chkdsk results for drive C: ...
1
vote
2answers
1k views

.NET 2.0 Application on Windows Server 2003 dies with a File Not Found exception

I need to run a small .NET 2.0 based application on a Windows Server 2003 based server. I have successfully installed .NET 2.0.50727 from here and rebooted the server. When I launch the application ...
1
vote
2answers
852 views

Monitor state of “Startup Type” of services

I would like to be able to monitor when the state of "Startup Type" for a particular service is changed from Automatic to Manual. I haven't been able to find an event that is triggered in event ...
1
vote
1answer
98 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
7
votes
1answer
2k views

Application Event Log keeps getting corrupted

I recently asked about repairing a corrupt event log, because it seemed to be a one-off event. The event log has since exhibited the same behavior 3 times. We have been trying to find patterns, but ...
2
votes
2answers
2k views

Can not see entries in Application Log in Event Viewer

Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and ...
2
votes
1answer
312 views

Missing Application Logs in Event Viewer, Windows 2008

We seem to be missing application logs in event viewer. The log just shows 0 messages. I came across some information attributing this issue to corrupted log files, I cleared the log but the issue is ...
4
votes
2answers
5k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
3
votes
1answer
809 views

how do i find application name using GUID from error in event viewer on Windows Server 2003?

A Windows Serve 2003 machine logged an error in Event Viewer with the COM+ Event System, saying it could not marshal the subscriber for a particular subscription and then gave the SID/GUID, which is: ...
2
votes
3answers
3k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...
0
votes
1answer
414 views

SharePoint Application down in Windows Server

I got a SharePoint environment consist of Web Servers, Index Server and Database Server. The SharePoint application has been down for unknown reason, after I check on the event viewer and the result ...
1
vote
1answer
141 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...
0
votes
1answer
154 views

SS 2005 SP4 install giving vsJitDebugger events

Windows Server 2003, SQL Server 2005 (9.00.3080) I installed SS2005 SP4 without a problem and immediately started getting vsJitDebugger 'unhandled win32 exception' messages in the application log ...
1
vote
1answer
112 views

Back up Event Viewer folder using backup exec without installing the remote agent

How to backup a shared folder without installing the remote agent? I used and enabled the "Enable selection of user shares" but an error appears "Failed to connect to computer"! I appreciate any ...
1
vote
1answer
1k views

Can't open the event viewer in Windows Server 2008?

Yesterday i just finished installing a file server running Windows 2008 to our company. Now i've noticed that somehow i can't open the event viewer with my standard administrative account. I've ...
1
vote
3answers
598 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
1
vote
1answer
3k views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
2
votes
2answers
230 views

What are the codes at the end of some Event Viewer messages?

I am trying to find the cause of some errors in the Windows Event Log I get after a crash. At the end there are two codes. Example: NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error ...
3
votes
2answers
743 views

How can one learn to read the Windows Server event viewer and know what events are normal and which are signs of potential problems?

I have been managing Windows Server 2003 machines at work, but I am a software developer. (Please don't say 'hire a sysadmin', the point of this question is my own learning). How do server admins ...
3
votes
1answer
3k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
0
votes
1answer
322 views

My user name has 1000's of events in Event Viewer

Recently a user asked me if I would look into the VPN connection because they were being booted off constantly. I went to Event Viewer to see the logon/logoff events from last night. Out of the 47k ...
1
vote
0answers
2k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
0
votes
1answer
299 views

Generate Custom View logs for email to admins

I want to create a scheduled task that will take a custom view I have created in Server 2008 Event Viewer and email all the events in a .xml format once a week (Monday morning). Bonus points if you ...
0
votes
1answer
398 views

Why does the Windows Event Viewer sometimes show a human-readable user name, and sometimes an SID?

On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries. On other systems, Event Viewer shows an SID (in the form S-1-5-...). Luckily, the SysInternals ...
1
vote
0answers
159 views

SBS Report displaying critical error events but nothing in Event Viewer

We have a Windows Server server set up running SBS 2008 on a 64-bit architecture. When I run my daily SBS Console reports I am being told there is a critical error on the server with Event ID 56 & ...
0
votes
2answers
1k views

How to find the source of a cryptic event viewer log

I'm looking at the eventviewer logs, and I see a bunch Error entries in the Application log. (Windows Server 2008 R1). There is an error written to the logs about every 4 seconds. I need to find ...
0
votes
1answer
149 views

Is it possible to connect WinServer eventlog from other domain

I have a virtual machine with Windows Server R2 Ent. In this machine runned domain controler test.local. I have admin(doamin and local) account on this machine. I want to get access to event log of ...
1
vote
1answer
200 views

How can I get more information on a Event Viewer - Windows Logs error?

An application i wrote is throwing the error (in my application Log): SocialNetworking.Facebook b0ceb124-b183-4b66-aa10-39fd9e142bn4 Could not load file or assembly 'Microsoft.Contracts, ...
13
votes
2answers
35k views

View Shutdown Event Tracker logs under Windows Server 2008 R2

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server. Where in the Event ...
0
votes
1answer
61 views

aggregate local events in AD

How can I aggregate events from event viewer log (logins with local Administrator) from all computers (atleast the servers - 2003,2008,2008r2) in an AD domain?
1
vote
0answers
419 views

Event viewer filtering - MS Sql server - How to filter logins from outside?

I want to filter event log to show SQL logon that was initiated from other machines, I have thousands of logins from local machine and few ones from other machines. I want to monitor that connections ...