"Event log" usually refers to the system/server logs on Microsoft Windows machines.

learn more… | top users | synonyms

0
votes
0answers
14 views

Reading Hyper-V event logs using C# [migrated]

I need to be able to retrieve event log entries for Hyper-V as part of a monitoring system we use. At the moment I use VBScript and WMI and do something like: query = "Select * from Win32_NTLogEvent ...
0
votes
1answer
22 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW ...
1
vote
1answer
62 views

Wevtutil equivalent for powershell script to get event logs

I have made a powershell script which is as below but since I won't be able to save it in .evtx format. I want the wevtutil equivalent(using wevtutil epl) for the same.Please help! ...
0
votes
1answer
21 views

SideBySide Event ID 63 Error ~ Microsoft SQL Server

I am getting the following repeating errors in event viewer: Does anybody know what is causing these errors and how to fix them?
0
votes
0answers
18 views

client can't connect to sftp server, can that be due to Event ID 7036: The Application Experience service entered the stopped/running state?

I have a sftp server running in Windows Server 2008R2. A client said they tried to connect to the server several times, but failed. My colleagues and others can connect and use the sftp. The next ...
0
votes
0answers
10 views

How to forward UserData field with nxlog?

I have a simple nxlog configuration that writes applocker events to a file as JSON. The events are captured: <Input applocker> Module im_msvistalog Query <QueryList>\ ...
0
votes
2answers
55 views

Log username of who restarts a service

I'm looking for a simple way to log the username of someone that restarts a service on a server. This was possible in 2003, but I do not see a possibility in 2008 and 2012.
1
vote
1answer
37 views

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems? Does it automatically delete old logs when disk is full. Any way to define log retention period? (e.g. ...
2
votes
1answer
47 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
0
votes
1answer
30 views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go ...
0
votes
1answer
31 views

Auditing for User/Machine account logon/logoff events in Child Domain ONLY

I have searched high and low and cannot find an answer to my need. I am in the process of setting up a SIEM for our network and I need to audit for user and machine logon/logoff events. Simple enough ...
0
votes
1answer
55 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
1
vote
0answers
131 views

Strange behavior with Dell Openmanage 8.2 and server 2008 R2 64bit and degraded RAID

I recently had to rebuild a domain controller [DC02] due to AD database being corrupted and not repairable. Additionally, this server had a degraded RAID [RAID 1] due to a hard drive failure. I had to ...
0
votes
2answers
56 views

Windows Event ID 6011

I am looking into how to track when a computer was renamed and by who. I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period ...
0
votes
1answer
69 views

AdsmClientService Event ID 4099

I'm getting a bunch of this erorr message in our server: ANS4987E Error processing '\FE01\c$\Windows\System32\config\RegBack\SECURITY': the object is in use by another process The server has ...
3
votes
1answer
35 views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
2
votes
0answers
27 views

Pass null arguments in an scheduled task xml file

I am trying to run a batch file when some specific events occurs and I want to pass some null arguments to one of my tasks. The problem is that I don't know how. I have tried a lot of combinations ...
0
votes
1answer
404 views

Event ID: 36888 The following fatal alert was generated: 10. The internal error state is 10

We are experiencing the following schannel errors most frequently on our Remote Desktop Terminal Servers. Log Name: System Source: Schannel Date: 11/18/2015 1:04:56 PM Event ...
1
vote
1answer
20 views

How to filter Windows 2003 security log from file?

I have a Windows 2003 Security log file in evt format. I need to filter the log by EventID 540 and produce a list of unique Users from it. I am working on a Windows 7 machine to do this. Any ideas on ...
2
votes
0answers
210 views

New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts

I am researching a failed login issue that is triggering our monitoring software. Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
0
votes
0answers
41 views

Windows Event Log Service Crash

I have an Active Directory Domain with Win2008R2 DCs and Win7 clients. From about 2 months ago some of my clients are complaining one after another about time of their systems which is behind the DC ...
1
vote
0answers
261 views

The Diagnostic Service Host failed to start due to the following error

I am receiving the following error in my System event log: Service Control Manager, Event ID 7000 The Diagnostic Service Host failed to start due to the following error: A privilege that the ...
0
votes
0answers
45 views

Export display information for windows event log

I saved a Windows event log as .evtx file, specifying that I want to include display information: This has created an .evtx file and a LocaleMetadata folder, which contains an .MTA file. Is there ...
1
vote
2answers
42 views

Waht could cause the eventlog service to consume memory?

I'm running a bunch of Windows Server 2008 R2 on a 64 bits hardware. I recently noticed that the eventlog service is going wild about memory consumption. The service on its own can consume about 4GB ...
0
votes
0answers
170 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
4
votes
3answers
117 views

Where can I see what calls of EXE-programs have been made (including the arguments)?

Is there any log-file within Windows where all EXE-calls are tracked or is it possible to enable such a log? Would this contain the arguments / parameters of these calls? Thanks
0
votes
0answers
35 views

AD DS audit event log when using RSAT

Got a query about AD DS audit event log when using Remote Server Administration Tools (AD User and Computer tool) On DC, already turn on Audit log for AD DS change (enable, disable, create, delete ...
0
votes
0answers
25 views

Windows Server 2008 HPC Edition is permanently logging Audit Success for RDP sessions

A Windows Server 2008 HPC Edition box is permanently logging Logon and Logoff tasks for the user who is connected to it via RDP every few seconds. Is there a way to just log the user initiated logon ...
0
votes
0answers
19 views

Server2012 Eventlogs details xml copy

Good day, I have a question if its possible to extract Provider name from event log. ValueQueries Value name="EventRecordID">Event/System/EventRecordID /Value /ValueQueries By this I managed ...
1
vote
1answer
54 views

How to log the IP that connects from outside of company to terminal server?

We have users RDP to company's terminal servers. Is there a way that I can track the ip address outside of company where users connect from? I know there are logs avaliable under under terminal ...
0
votes
0answers
51 views

Security Log Event ID 5136 - Attribute Value field is limited when attribute is gPLink

I encountered some problem while trying to analyze GPO link modifications using Microsoft security log. In event 5136, AttributeValue field is cut, seems to be limited to 1000 characters. It seems ...
0
votes
1answer
110 views

Track down source of event 4771: Kerberos pre-authentication failed

Some process on a remote server is generating failed log-on attempts for a specific user account. I want to know what process it is. The account in question started generating these bad password ...
0
votes
1answer
23 views

AD log message showing E-mail of user object creation

I am referencing the active directory log message (4720) which shows 'User Principal Name' as an email address. However there is another email address found when viewing the actual User Object ...
3
votes
1answer
105 views

Windows Events for Remote Desktop logon failure

According to ref the logon types 10 and 3 in windows events are represnting Logon Type 10 = RemoteInteractive Logon & Logon Type 3 = Network Logon But when i tried to connect a Windows machine ...
0
votes
1answer
419 views

What does Microsoft-Windows-Security-Auditing event with NULL SID mean?

On a Windows Server 2012 machine, in Event Viewer, there was some unusual behaviour on a system, a service was stopping and I was unsure if it "stopped itself" or was forced to stop by a user action. ...
1
vote
0answers
76 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
1
vote
1answer
1k views

I can't find information on 2012 R2 Event ID's 257, 258, 265 Win32K errors

2012 R2 as a Hyper-V host only Last night this machine began running very slowly. I shut down the VM's and then the host. That also took forever. When I restarted the vm host machine it operated ...
1
vote
2answers
77 views

Check backpressure live on Exchange2010 server

I am working a lot with exchange servers at the moment and would like to make sure there is no backpressure built up on them. Right know I have a powershell script running every 4h to check the ...
0
votes
1answer
169 views

Event viewer missing logs following unexpected reboot

One of our Server 2012 boxes lost power unexpectedly recently. We're still not sure how it happened, but given its suddenness I suspect someone in the data centre tripped over a power cable. I went ...
0
votes
2answers
227 views

Forwarding Application and Services Logs using nxlog

Using nxlog 'im_mseventlog' module I'm able to forward all Windows Logs (Application, Security, System... ) logs to the remote syslog server. But I'm not able to forward eventlogs present under ...
1
vote
2answers
198 views

How to retrieve previous IP/DNS information from Domain Controller logs?

I unfortunately have DNS scavenging on; information I need to retrieve could have been in Event Viewer DNS logs, but that's not there anymore, or maybe I am not looking for it properly. Story: I ...
3
votes
2answers
8k views

Windows Server restart / shutdown history

How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed? The Windows Event Log is ...
1
vote
0answers
228 views

AD DC - Error 4625 Status 0x80090308

I recognzie a small amount of Event 4625 entries with a status of 0x80090308 and substatus 0x0; 2% over all 4625's. It is basically a failed logon but without any information I could use to look ...
0
votes
0answers
2k views

How to fix: The description for event ID %i from source %s cannot be found?

I need to troubleshoot some WMI crashes we are suffering from. Unfortunately the event log doesn't show any details as the descriptions are missing. This is what the log says: The description for ...
0
votes
0answers
212 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
0
votes
0answers
105 views

Domain Administrator Login - Unknown Source

I'm trying to clear out all traces of old legacy settings from a new Domain I've inherited. One of my pet hates is using the Domain Administrator account for tasks, services, etc. I've managed to get ...
0
votes
0answers
100 views

Windows Event Log folder permissions change after wevtutil clear

After running the following as administrator: wevtutil cl System /bu:c:\backup\log.evtx I notice that the permissions on C:\windows\system32\winevt\Logs change and eventlog service account no ...
0
votes
0answers
190 views

How can i create a trigger for a task in task scheduler which should start the task for some event ID but not for some other event ID

I have a few tasks created in task scheduler for which i wish to create auto recovery mechanism if the tasks are terminated from outside the task scheduler. Basically each of these tasks create a java ...
3
votes
1answer
430 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
1
vote
0answers
241 views

Using WMI to query Windows Event Collector logs

Using WMI to query the eventlog is quite simple, using Win32_NTLogEvent, for example: Get-WmiObject -query "SELECT *FROM Win32_NTLogEvent WHERE (logfile='Application' and SourceName='Something') ...