Questions tagged [windows-event-log]
"Event log" usually refers to the system/server logs on Microsoft Windows machines.
626
questions
1
vote
0
answers
493
views
Archiving event logs with wevtutil al not working for some sources
TL/DR: Logs working on system with source installed, but display info not getting archived with wevtutil al. When trying to read messages on system without sources installed I get the "description for ...
0
votes
1
answer
40
views
Clearing Application Even Logs of specific application
Is it possible to clear event logs of specific application (specific "Source" in Windows Event Log Viewer) via batch file?
Thanks.
2
votes
0
answers
284
views
File Access Auditing on Server 2012
I'm implementing file auditing on a directory on a IIS server in order to get notification when someone attempts to modify or delete any documents.
I set Advanced Auditing Policy\Audit Policies\...
1
vote
1
answer
607
views
Memory (physical & virtual pages) runs out for unknown reason
Recently our server becomes hanging quite often. I suspect a memory leak, yet still cannot find any suspect. The Event Log records the situation like this:
- <SystemInfo>
<...
0
votes
1
answer
879
views
Is there any correlation between the Windows Event logs ans SQL Server Error logging?
Would the SQL Server instance go offline if it couldn't write to any of the Windows Event logs?
Found these two errors in the Windows Systems Event Log:
The system failed to flush data to the ...
0
votes
2
answers
1k
views
Windows SNMP Traps
I test SNMP Traps on Windows 10 and Windows 7.
Windows 7 has Traps Sender and Windows 10 has Traps Reciever.
Enabled SNMP On Windows 10 & 7.
Enabled Traps On Windows 7.
Installed a Traps ...
-1
votes
1
answer
4k
views
Move Event Log in Windows 2012
Ultimately I'm trying to have security logs written to a remote storage,
\\Server-Name\Drive-Letter\File_Name.evtx
For testing I'm trying to move the default log path from %SystemRoot%\System32\...
1
vote
0
answers
1k
views
Is impossible to forwarding event log in workgroup environments?
Hi, all.
I want to forward event log from win7(hostname is win7) to win2008(hostname is win2008).
So i used "Source Initiated" option on win7. Because "collector initiated" option can choice domain ...
1
vote
1
answer
1k
views
Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server
I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
0
votes
1
answer
68
views
Windows 2012 Service Removal Log
I have a production server where an application is experiencing an issue.
The psexec service is marked for deletion and I want to try and tie the deactivation of the service to the start of the issue.
...
1
vote
1
answer
47
views
can't find source of user lockout
System "scanner" user keeps locking, and in event viewer there is blank space where is the source. In some cases there is an ip address, wich points to different printers or scanners, but there i ...
1
vote
1
answer
66
views
Archive Eventlog every x days
I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days.
I was looking for a centralized solution, possibly a GPO.
But from what I saw it's only ...
1
vote
1
answer
3k
views
Auditing Log is Full - Eventlog Archive GPO not working
I am trying to create an Archive for Eventlog but it does not seem to work.
Server 2k12 R2 Environment.
Following is the GPO I have enabled:
I have rebooted the server and made sure it is being ...
4
votes
0
answers
1k
views
Windows - Log services access to certificate store
I have a software which run as a service (Checkpoint Identity Awareness) which connects to a server and verifies its identity (actually a checkpoint firewall) by checking its certificate, like any ...
3
votes
0
answers
6k
views
How to filter ObjectName in Windows logs with Advanced XML Filtering?
I want to deploy a centralized log analysis tool on my domain.
I'm currently configuring Windows to audit a shared network drive (read, write, access attempt of domain users) to forward Windows events ...
2
votes
1
answer
75
views
Auditing Registry events through AD
I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately ...
3
votes
4
answers
18k
views
Convert saved evtx files to text
I'm looking to export a large quantity of saved Security log files (.evtx) to text or CSV format. I found wevtutil but that only seems to be able to convert .evt to .evtx when dealing with saved log ...
2
votes
1
answer
6k
views
Windws Server 2012 R2 Event Log / Audit deleted files / Only last minutes visible
My goal: I want to find out who deletes files on a network share. Users are sometimes complaining that a file is missing and as usual the others are to blame.
I have file auditing enabled for this ...
3
votes
1
answer
1k
views
Create EventLog Source using Group Policy
In our environment we want to force all our system engineers who write scripts to write logging to the EventLog.
To keep track of all logging of our scripts we want to write this to a specific source ...
0
votes
1
answer
5k
views
AVR Boost Active (APCPBEAgen) Warnings Windows Server 2012 event log
I have a Windows Server 2012 running. In the event log I see constantly a warning from AVR Boost Active (APCPBEAgen). It appears approx. every 6 hours.
Question
Does anybody know what 'AVR Boost ...
1
vote
1
answer
356
views
Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding
the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
0
votes
0
answers
404
views
Is there an Windows Event Viewer Event for "No available connections" or No Ethernet Connection?
I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected.
Right now I have a GPO that ...
3
votes
1
answer
5k
views
Event Viewer Filtering does not work - invalid query
First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it.
My problem is this: I'm trying to find out all the ...
0
votes
1
answer
737
views
How do you get detailed information on Active Directory logon failures?
In my domain controller event log, I'm getting an account failure from a username of a service account.
The info is:
Security ID: DOMAIN\serviceaccount
Account Name: serviceaccount
Additional ...
2
votes
1
answer
38
views
Windows Logon Events Description
Is there like any portal/site where I can refer to for the detailed description for WEV logins? Eg. 4625 An account failed to log on, 4723 An attempt was made to change an account's password and 4741 ...
0
votes
1
answer
412
views
Windows security event log showing lot of firewall rule changed alert
n my server i am getting lot of event id 4946. A change has been made to Windows Firewall exception list. A rule was added. i am getting this alert every day. can you help me to reslove this.
Regards,...
0
votes
1
answer
7k
views
windows event log forwarding permission
I am trying to set up an event log collector server in a Domain.
I flowed the steps described here: http://zenshaze.com/wp/?p=57
I have added the NETWORK SERVICE to the Event Log Readers group to ...
1
vote
1
answer
2k
views
Windows event log export - how to get general description?
I am exporting windows Application event logs to XML from one of my servers for offline analysis. I am able to do this...but when I do, I lose the "General" description information. Here is an example ...
1
vote
1
answer
4k
views
Events not visible in Event Log viewer
Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
3
votes
0
answers
685
views
Error 1606 - MSIs, UNC paths and permissions?
I have a persistent issue with a number of our Windows desktop systems where we see various MSI packages throw up error 1606 (and 1314, in the MSI log), which is a permission issue, when attempting to ...
2
votes
1
answer
12k
views
What is "Report ID" in Windows Application Error, event 1000 correlated to?
I'm analyzing an event 1000 error in a third-party enterprise application which shows a "Faulting module name" of ntdll.dll and wondering: What is the "Report ID" GUID correlated to? and How might I ...
-1
votes
1
answer
129
views
EventLog "Access Denied" after installing an additional DC in a 2012 environment
After promoting a new DC into an existing domain, Eventviewer shows the following:
I might as well mention that the Installation itself did not experience any issues
When looking at the C:\Windows\...
1
vote
2
answers
6k
views
2012 R2 print server not showing file names on Event id 307
I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
2
votes
1
answer
16k
views
Event log subscription returns error code (0x138C)
I have been battling getting event log subscriptions to work on my Server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
1
vote
1
answer
2k
views
How does one add multiple computer names to a custom view in event viewer?
I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
3
votes
2
answers
16k
views
Where in the event log is the IIS AppPool recycling events being recorded?
I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
0
votes
1
answer
273
views
Pass arguements as parameter to -filterXPath get-wineventLogs
Hi I made powershell script in which I am taking three arguements(in param block)
and passing them as parameters to -FilterXPath. But I am not able to get the result.
$eventID=7036 $ServiceName=PW $...
1
vote
1
answer
3k
views
Wevtutil equivalent for powershell script to get event logs
I have made a powershell script which is as below but since I won't be able to save it in .evtx format. I want the wevtutil equivalent(using wevtutil epl) for the same.Please help!
$ErrorTime=Get-...
0
votes
1
answer
1k
views
SideBySide Event ID 63 Error ~ Microsoft SQL Server
I am getting the following repeating errors in event viewer:
Does anybody know what is causing these errors and how to fix them?
1
vote
2
answers
8k
views
Log username of who restarts a service
I'm looking for a simple way to log the username of someone that restarts a service on a server. This was possible in 2003, but I do not see a possibility in 2008 and 2012.
3
votes
1
answer
8k
views
What is the default retention and archiving mechanism for Windows 2012 Event Logs?
How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems?
Does it automatically delete old logs when disk is full.
Any way to define log retention period? (e.g. ...
3
votes
1
answer
547
views
My event log has corrupted DACL 'Write Attributes' in 4656 file audit events
I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
2
votes
1
answer
18k
views
Filter Windows Event Security logs by Source IP Address
I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go wrong?...
0
votes
0
answers
181
views
Auditing for User/Machine account logon/logoff events in Child Domain ONLY
I have searched high and low and cannot find an answer to my need. I am in the process of setting up a SIEM for our network and I need to audit for user and machine logon/logoff events. Simple enough ...
0
votes
1
answer
9k
views
Event ID 521 - Critical Logging Failure on Domain Controllers
I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm.
I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
1
vote
0
answers
200
views
Strange behavior with Dell Openmanage 8.2 and server 2008 R2 64bit and degraded RAID
I recently had to rebuild a domain controller [DC02] due to AD database being corrupted and not repairable. Additionally, this server had a degraded RAID [RAID 1] due to a hard drive failure. I had to ...
2
votes
4
answers
3k
views
Windows Event ID 6011
I am looking into how to track when a computer was renamed and by who.
I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period ...
0
votes
1
answer
4k
views
AdsmClientService Event ID 4099
I'm getting a bunch of this erorr message in our server:
ANS4987E Error processing
'\FE01\c$\Windows\System32\config\RegBack\SECURITY': the
object is in use by another process
The server has ...
3
votes
1
answer
6k
views
How could I see by the event viewer log that the format of date was changed?
I need to see by the eventviewer log that the format of date was changed.
I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
2
votes
0
answers
230
views
Pass null arguments in an scheduled task xml file
I am trying to run a batch file when some specific events occurs and I want to pass some null arguments to one of my tasks. The problem is that I don't know how.
I have tried a lot of combinations ...