Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
1 vote
0 answers
493 views

Archiving event logs with wevtutil al not working for some sources

TL/DR: Logs working on system with source installed, but display info not getting archived with wevtutil al. When trying to read messages on system without sources installed I get the "description for ...
Heath Carroll's user avatar
0 votes
1 answer
40 views

Clearing Application Even Logs of specific application

Is it possible to clear event logs of specific application (specific "Source" in Windows Event Log Viewer) via batch file? Thanks.
flamey's user avatar
  • 125
2 votes
0 answers
284 views

File Access Auditing on Server 2012

I'm implementing file auditing on a directory on a IIS server in order to get notification when someone attempts to modify or delete any documents. I set Advanced Auditing Policy\Audit Policies\...
garethTheRed's user avatar
  • 4,779
1 vote
1 answer
607 views

Memory (physical & virtual pages) runs out for unknown reason

Recently our server becomes hanging quite often. I suspect a memory leak, yet still cannot find any suspect. The Event Log records the situation like this: - <SystemInfo> <...
Hoàng Long's user avatar
0 votes
1 answer
879 views

Is there any correlation between the Windows Event logs ans SQL Server Error logging?

Would the SQL Server instance go offline if it couldn't write to any of the Windows Event logs? Found these two errors in the Windows Systems Event Log: The system failed to flush data to the ...
AKDiscer's user avatar
  • 123
0 votes
2 answers
1k views

Windows SNMP Traps

I test SNMP Traps on Windows 10 and Windows 7. Windows 7 has Traps Sender and Windows 10 has Traps Reciever. Enabled SNMP On Windows 10 & 7. Enabled Traps On Windows 7. Installed a Traps ...
M. Rostami's user avatar
-1 votes
1 answer
4k views

Move Event Log in Windows 2012

Ultimately I'm trying to have security logs written to a remote storage, \\Server-Name\Drive-Letter\File_Name.evtx For testing I'm trying to move the default log path from %SystemRoot%\System32\...
selachka's user avatar
1 vote
0 answers
1k views

Is impossible to forwarding event log in workgroup environments?

Hi, all. I want to forward event log from win7(hostname is win7) to win2008(hostname is win2008). So i used "Source Initiated" option on win7. Because "collector initiated" option can choice domain ...
Mr.kang's user avatar
  • 109
1 vote
1 answer
1k views

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event ...
Mike's user avatar
  • 11
0 votes
1 answer
68 views

Windows 2012 Service Removal Log

I have a production server where an application is experiencing an issue. The psexec service is marked for deletion and I want to try and tie the deactivation of the service to the start of the issue. ...
JoeOD's user avatar
  • 61
1 vote
1 answer
47 views

can't find source of user lockout

System "scanner" user keeps locking, and in event viewer there is blank space where is the source. In some cases there is an ip address, wich points to different printers or scanners, but there i ...
user362941's user avatar
1 vote
1 answer
66 views

Archive Eventlog every x days

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only ...
JustAGuy's user avatar
  • 649
1 vote
1 answer
3k views

Auditing Log is Full - Eventlog Archive GPO not working

I am trying to create an Archive for Eventlog but it does not seem to work. Server 2k12 R2 Environment. Following is the GPO I have enabled: I have rebooted the server and made sure it is being ...
JustAGuy's user avatar
  • 649
4 votes
0 answers
1k views

Windows - Log services access to certificate store

I have a software which run as a service (Checkpoint Identity Awareness) which connects to a server and verifies its identity (actually a checkpoint firewall) by checking its certificate, like any ...
thibon's user avatar
  • 141
3 votes
0 answers
6k views

How to filter ObjectName in Windows logs with Advanced XML Filtering?

I want to deploy a centralized log analysis tool on my domain. I'm currently configuring Windows to audit a shared network drive (read, write, access attempt of domain users) to forward Windows events ...
Aexyn's user avatar
  • 31
2 votes
1 answer
75 views

Auditing Registry events through AD

I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately ...
Darktux's user avatar
  • 837
3 votes
4 answers
18k views

Convert saved evtx files to text

I'm looking to export a large quantity of saved Security log files (.evtx) to text or CSV format. I found wevtutil but that only seems to be able to convert .evt to .evtx when dealing with saved log ...
smwk's user avatar
  • 580
2 votes
1 answer
6k views

Windws Server 2012 R2 Event Log / Audit deleted files / Only last minutes visible

My goal: I want to find out who deletes files on a network share. Users are sometimes complaining that a file is missing and as usual the others are to blame. I have file auditing enabled for this ...
AUTxRemoteC's user avatar
3 votes
1 answer
1k views

Create EventLog Source using Group Policy

In our environment we want to force all our system engineers who write scripts to write logging to the EventLog. To keep track of all logging of our scripts we want to write this to a specific source ...
Tomas's user avatar
  • 91
0 votes
1 answer
5k views

AVR Boost Active (APCPBEAgen) Warnings Windows Server 2012 event log

I have a Windows Server 2012 running. In the event log I see constantly a warning from AVR Boost Active (APCPBEAgen). It appears approx. every 6 hours. Question Does anybody know what 'AVR Boost ...
orbitcowboy's user avatar
1 vote
1 answer
356 views

Redirect to new log file selected event id - Manage the security event id 4624 and 4634 flooding

the security logs of the two domain controllers of my network are flooded by security events id 4624 and 4634 and to a lesser extent, 4672. Reading from the internet such a behavior is quite common, ...
Diego A's user avatar
  • 13
0 votes
0 answers
404 views

Is there an Windows Event Viewer Event for "No available connections" or No Ethernet Connection?

I am trying to create a GPO that disables a laptop's wireless card whenever a Ethernet LAN is detected, and Enable the wireless whenever an Ethernet LAN is not detected. Right now I have a GPO that ...
Michael's user avatar
  • 141
3 votes
1 answer
5k views

Event Viewer Filtering does not work - invalid query

First of all, I'd like to rant about how stupidly hard searching for something event logs, but I bet MS is not listening to me so that's about it. My problem is this: I'm trying to find out all the ...
user2629636's user avatar
0 votes
1 answer
737 views

How do you get detailed information on Active Directory logon failures?

In my domain controller event log, I'm getting an account failure from a username of a service account. The info is: Security ID: DOMAIN\serviceaccount Account Name: serviceaccount Additional ...
parsecpython's user avatar
2 votes
1 answer
38 views

Windows Logon Events Description

Is there like any portal/site where I can refer to for the detailed description for WEV logins? Eg. 4625 An account failed to log on, 4723 An attempt was made to change an account's password and 4741 ...
user350410's user avatar
0 votes
1 answer
412 views

Windows security event log showing lot of firewall rule changed alert

n my server i am getting lot of event id 4946. A change has been made to Windows Firewall exception list. A rule was added. i am getting this alert every day. can you help me to reslove this. Regards,...
karthick's user avatar
  • 329
0 votes
1 answer
7k views

windows event log forwarding permission

I am trying to set up an event log collector server in a Domain. I flowed the steps described here: http://zenshaze.com/wp/?p=57 I have added the NETWORK SERVICE to the Event Log Readers group to ...
yoni's user avatar
  • 21
1 vote
1 answer
2k views

Windows event log export - how to get general description?

I am exporting windows Application event logs to XML from one of my servers for offline analysis. I am able to do this...but when I do, I lose the "General" description information. Here is an example ...
David784's user avatar
  • 113
1 vote
1 answer
4k views

Events not visible in Event Log viewer

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to ...
Patrick's user avatar
  • 1,290
3 votes
0 answers
685 views

Error 1606 - MSIs, UNC paths and permissions?

I have a persistent issue with a number of our Windows desktop systems where we see various MSI packages throw up error 1606 (and 1314, in the MSI log), which is a permission issue, when attempting to ...
Trevelyan's user avatar
2 votes
1 answer
12k views

What is "Report ID" in Windows Application Error, event 1000 correlated to?

I'm analyzing an event 1000 error in a third-party enterprise application which shows a "Faulting module name" of ntdll.dll and wondering: What is the "Report ID" GUID correlated to? and How might I ...
Steve C's user avatar
  • 21
-1 votes
1 answer
129 views

EventLog "Access Denied" after installing an additional DC in a 2012 environment

After promoting a new DC into an existing domain, Eventviewer shows the following: I might as well mention that the Installation itself did not experience any issues When looking at the C:\Windows\...
JustAGuy's user avatar
  • 649
1 vote
2 answers
6k views

2012 R2 print server not showing file names on Event id 307

I'm having trouble logging detailed information on my print server. Operational logging is enabled and working. The event ID 307 displays information about the jobs printed, but instead of the file ...
Black Lion's user avatar
2 votes
1 answer
16k views

Event log subscription returns error code (0x138C)

I have been battling getting event log subscriptions to work on my Server 2012 R2 domain controllers. I have created the collector-initiated-subscription using the GUI and selecting the defaults ...
PenNerd's user avatar
  • 21
1 vote
1 answer
2k views

How does one add multiple computer names to a custom view in event viewer?

I'm trying to create a "Custom View" thru eventviewer on Windows 2k8R2-SP1 to see multiple logs from multiple nodes in a cluster in one view. But it doesn't seem to accept the remote computers' names ...
Ayan Mullick's user avatar
3 votes
2 answers
16k views

Where in the event log is the IIS AppPool recycling events being recorded?

I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
Tony_Henrich's user avatar
0 votes
1 answer
273 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW $...
Akshay's user avatar
  • 21
1 vote
1 answer
3k views

Wevtutil equivalent for powershell script to get event logs

I have made a powershell script which is as below but since I won't be able to save it in .evtx format. I want the wevtutil equivalent(using wevtutil epl) for the same.Please help! $ErrorTime=Get-...
Akshay's user avatar
  • 21
0 votes
1 answer
1k views

SideBySide Event ID 63 Error ~ Microsoft SQL Server

I am getting the following repeating errors in event viewer: Does anybody know what is causing these errors and how to fix them?
Linger's user avatar
  • 251
1 vote
2 answers
8k views

Log username of who restarts a service

I'm looking for a simple way to log the username of someone that restarts a service on a server. This was possible in 2003, but I do not see a possibility in 2008 and 2012.
Menga's user avatar
  • 23
3 votes
1 answer
8k views

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems? Does it automatically delete old logs when disk is full. Any way to define log retention period? (e.g. ...
TiCL's user avatar
  • 329
3 votes
1 answer
547 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
EPJK1337's user avatar
2 votes
1 answer
18k views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go wrong?...
youcantexplainthat's user avatar
0 votes
0 answers
181 views

Auditing for User/Machine account logon/logoff events in Child Domain ONLY

I have searched high and low and cannot find an answer to my need. I am in the process of setting up a SIEM for our network and I need to audit for user and machine logon/logoff events. Simple enough ...
DeliriumTrigger's user avatar
0 votes
1 answer
9k views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
JLPH's user avatar
  • 81
1 vote
0 answers
200 views

Strange behavior with Dell Openmanage 8.2 and server 2008 R2 64bit and degraded RAID

I recently had to rebuild a domain controller [DC02] due to AD database being corrupted and not repairable. Additionally, this server had a degraded RAID [RAID 1] due to a hard drive failure. I had to ...
MarkL's user avatar
  • 111
2 votes
4 answers
3k views

Windows Event ID 6011

I am looking into how to track when a computer was renamed and by who. I know you can pull the eventlog from one computer, but I am needing a report generated on over 1000 PC's for a two weeks period ...
Karen's user avatar
  • 21
0 votes
1 answer
4k views

AdsmClientService Event ID 4099

I'm getting a bunch of this erorr message in our server: ANS4987E Error processing '\FE01\c$\Windows\System32\config\RegBack\SECURITY': the object is in use by another process The server has ...
Smiley's user avatar
  • 101
3 votes
1 answer
6k views

How could I see by the event viewer log that the format of date was changed?

I need to see by the eventviewer log that the format of date was changed. I know that have the eventlog of ID 4616, but it's for DATE changing, and not lot when I just change the FORMAT of the date. ...
Only a Curious Mind's user avatar
2 votes
0 answers
230 views

Pass null arguments in an scheduled task xml file

I am trying to run a batch file when some specific events occurs and I want to pass some null arguments to one of my tasks. The problem is that I don't know how. I have tried a lot of combinations ...
Pandoranum's user avatar

1
3 4
5
6 7
13