This tag is for questions about Windows' Event Viewer. Event Viewer is where Windows stores logs generated by the Operating System and certain applications.

learn more… | top users | synonyms

1
vote
2answers
442 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
0
votes
2answers
348 views

How do I filter Event Viewer down to errors from a single website?

I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below How do I create custom views for a single website?
-1
votes
2answers
697 views

Event Viewer Task for a specific task

I can create Event Viewer Tasks to react to Event IDs, but I'm having a tough time getting the XML working to react to an event ID to a specific task. I've been testing using the filter. The task ...
3
votes
1answer
4k views

How do I fix a custom Event Viewer Log that merges automatically with the Application log?

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
1
vote
1answer
414 views

Event log subscription returns error code (0x138C)

I have been battling getting Event log subscriptions to work on my server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1answer
71 views

Visualization of Windows Event Logs

Are there specific tools (like rrdtool) or powershell commands to generate graphs of windows event logs? For the first I want to visualize the Windows Server 2008 R2 event log "PrintService". There ...
1
vote
1answer
883 views

Backup/export custom view automatically from Event Viewer

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically ...
1
vote
1answer
968 views

What could cause local folders in a Windows 2008 DFS replication group to randomly obtain system and hidden attributes

We have a Windows 2008 server (not R2) acting as a primary file source in a DFS replication group with a single other server that happens to be Windows Storage Server 2008. All is well in terms of 2-...
1
vote
1answer
165 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
0
votes
1answer
73 views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
0
votes
1answer
36 views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
0
votes
1answer
22 views

Standard Setting for Audit Policy in Local Group Policy Editor

Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company. For Eg:- Should i set ' Success & Failure ' for ' Audit ...
0
votes
1answer
611 views

Windows event viewer application logs lost after reboot

I need to check event viewer's application logs for uninstall events. So, I filtered them on MSIInstaller. Turns out I can see logs only upto last reboot which was just a few hours ago from writting ...
0
votes
1answer
86 views

Reading logs from Event viewer 2008 server

I found the path as to where the logs are stored -> %SystemRoot%\system32\winevt\logs When double clicking one of the .evtx logs it opens it in the event log viewer. Is there a way to open it without ...
0
votes
1answer
1k views

7024 event on Windows service shutdown

I am seeing the following event in event viewer: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-...
0
votes
1answer
2k views

What is the Event id for File & folder creation in Window Server 2008

I have enabled Object level access in event viewer, but i am unable to find the exact date & time, when the user create a file or folder. Do you know, how to find out the time & date in event ...
0
votes
1answer
173 views

SS 2005 SP4 install giving vsJitDebugger events

Windows Server 2003, SQL Server 2005 (9.00.3080) I installed SS2005 SP4 without a problem and immediately started getting vsJitDebugger 'unhandled win32 exception' messages in the application log ...
0
votes
1answer
161 views

Is it possible to connect WinServer eventlog from other domain

I have a virtual machine with Windows Server R2 Ent. In this machine runned domain controler test.local. I have admin(doamin and local) account on this machine. I want to get access to event log of ...
0
votes
1answer
272 views

Event ID 3009 on SBS 2003 R2

Getting the following error on my SBS 2003 R2 Server: Server ActiveSync: Unexpected Exchange mailbox Server error: Server: [celeritympp.mpp1.local] User: [jwhalen@mpp1.com] HTTP status code: [409]. ...
-1
votes
1answer
16 views

Events Log source

I am doing a critical review of some software which gathers information about activities on a system. some of the information that is displayed to user is available in the events viewer. This is all ...
4
votes
0answers
108 views

Corrupt General Tab in Event Viewer

Whenever ASP.NET reports a dangerous query string value to the Application log and the request contains a certain combination of characters; the event viewer will not show the error information and ...
2
votes
0answers
1k views

Powershell 3.0 Enter-PSSession fails randomly, reboot solves it. DCOM error in Event Viewer on target machine

Using PowerShell's Enter-PSSession (even locally, against the local computer) fails randomly with the following message. Running Windows 2012 Standard with all updates. The error message takes a while ...
2
votes
0answers
764 views

Why are the results of a chkdsk scan on drive C: not showing in the event viewer, but chkdsk results for N: are?

On a Server 2008 R2 member server I schedule chkdsk to check drives C: and N:. Only the results for the N: drive are seen in event viewer. In previous Windows Servers, chkdsk results for drive C: ...
2
votes
0answers
3k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
1
vote
0answers
25 views

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
1
vote
0answers
83 views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
1
vote
0answers
134 views

Forwarded events not showing file path on event collector

I've set up one of the servers in our domain to be an event collector for AppLocker events from the client computers. I've then (via a GPO) configured two clients to forward their events to the event ...
1
vote
0answers
279 views

Windows Server 2008 R2 - Failed login auditing

I am having issue with configuring Auditing on the server in order to catch failed and successful network logins. This morning we found one of our test machines with a strange login on the locked ...
1
vote
0answers
106 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> <...
1
vote
0answers
162 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
1
vote
0answers
725 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
1
vote
0answers
163 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
149 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are missing....
1
vote
0answers
167 views

SBS Report displaying critical error events but nothing in Event Viewer

We have a Windows Server server set up running SBS 2008 on a 64-bit architecture. When I run my daily SBS Console reports I am being told there is a critical error on the server with Event ID 56 & ...
1
vote
0answers
464 views

Event viewer filtering - MS Sql server - How to filter logins from outside?

I want to filter event log to show SQL logon that was initiated from other machines, I have thousands of logins from local machine and few ones from other machines. I want to monitor that connections ...
0
votes
0answers
23 views

Is there an Windows Event Viewer Event for “No available connections” or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
0
votes
0answers
63 views

Windows task scheduler event viewer trigger 0x800704DD

I am creating a Windows task in Windows 2008 R2 for an Event Viewer event. I wish for it to display a dialog box. However the task will only trigger if a user is logged in. I wish for the task to ...
0
votes
0answers
14 views

Event Forwarding

I am taking the MCITP 70-685 Windows 7 Enterprise Desktop Support Technician and am trying to set up Event Forwarding. My setup (As I need three separate OS' which I'm running on two computers) is ...
0
votes
0answers
18 views

Windows Log size Policy

I have implement the policy for Windows log size as follows ( Please see the print-screen ) But, when i click on Event Viewer -- Application -- Properties, i see below size ( please see below print-...
0
votes
0answers
44 views

Event Viewer, Network Address empty

I receive empty Network Address with value - from an unknown attacker that attack my RDP. I have searched from previous questions but no correct answer. I have set the Remote Desktop Host to use RDP ...
0
votes
0answers
88 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
0
votes
0answers
63 views

Event 1033 in Windows Event Viewer for SQL Server 2008

Every single morning I come in to find that SQL Server has logged another 3 or 4 of the following events on one of our servers: Log Name: Application Source: MsiInstaller Date: ...
0
votes
0answers
269 views

Filtering Event viewer based on access list, object name, etc. Windows server 2012

need your help please, i tried to do filtering in event viewer based on access list & object name ( below is the one i tried). below filter to filter event delete but without to capture tmp ...
0
votes
0answers
291 views

event 4656 even though handle manipulation auditing is disabled

windows server 2012R2 auditpol /set /subcategory:"Handle Manipulation" /Success:Disabled /Failure:Disabled still getting events 4656 "A handle to an object was requested." any ideas?
0
votes
0answers
142 views

File Auditing in Cluster Shared Volumes

I'm trying to simply enable file auditing on a windows share (2012 R2)on top of cluster shared volume. But it doesn't behave as I expected it to behave. Here's the story: I enabled file auditing ...
0
votes
0answers
202 views

Windows Server Audit Failure from Client

Every several minutes I get an audit failure from one of my clients running Windows 8 on ports 56280 to 56294 in the event log of my server which provides DHCP/DNS/DC for that client. Do you have any ...