Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
111 votes
6 answers
630k views

Windows Server restart / shutdown history

How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed? The Windows Event Log is ...
JohnC's user avatar
  • 2,644
70 votes
6 answers
302k views

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating HTTP Error 500.0 - Internal Server Error The page ...
Greg B's user avatar
  • 1,608
29 votes
2 answers
136k views

Who restarted my Windows server? [duplicate]

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server? I have found the shutdown event in the System event log, but it does not show which user initiated the ...
joar's user avatar
  • 911
29 votes
1 answer
218k views

Where/how does Windows store the data in the event logs?

We run some financial systems that log error messages to the system logs. I need to find out if we can clean these error messages from a PCI DSS point of view. I am specificaly interested in the ...
Ron Tuffin's user avatar
26 votes
3 answers
119k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
Trido's user avatar
  • 363
25 votes
7 answers
129k views

How can I remove specific events from the event log in Windows Server 2008?

Do I need a third party tool for this?
JC.'s user avatar
  • 363
16 votes
2 answers
164k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
mythofechelon's user avatar
15 votes
6 answers
23k views

How do I passively monitor the Windows Event Log?

How can I monitor the Windows Event Log remotely such that I will be informed automatically when certain events occur? There are plenty of active monitoring solutions, but they require human ...
Rym's user avatar
  • 539
14 votes
4 answers
20k views

What are the implications of exceeding 4 GB in a Windows Event Log?

I found this Microsoft KB that covers recommended Event Log setting maximums for operating systems up to Windows 2008/Vista, which recommends a maximum of 4GB, and have seen some other vague ...
lgaud's user avatar
  • 253
14 votes
1 answer
26k views

What time zone is displayed in windows event logs? When viewing saved log from another machine?

What time zone is being displayed here? GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second? Thanks!
samecodes's user avatar
  • 143
13 votes
2 answers
73k views

Server locking up, /var/log/messages reports "backlog limit exceeded"

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the /var/...
YWCA Hello's user avatar
13 votes
6 answers
11k views

Server 2008 email on Event variables

One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server. This is working ...
Jeff Miles's user avatar
  • 2,085
12 votes
2 answers
27k views

How to filter windows event log with wildcard?

According to the document here, the asterisk wildcard is supported and hence it should work in eg. *[EventData[Data[@Name='TargetUserName'] ='User1*']] but I cannot get any wildcard filter to work - ...
A_L's user avatar
  • 223
11 votes
3 answers
84k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
kevinmicke's user avatar
10 votes
3 answers
23k views

Windows Event Log Rotation?

Windows Server 2003. Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and ...
Boden's user avatar
  • 5,008
10 votes
3 answers
10k views

Where can I see what calls of EXE-programs have been made (including the arguments)?

Is there any log-file within Windows where all EXE-calls are tracked or is it possible to enable such a log? Would this contain the arguments / parameters of these calls? Thanks
MartinHappyCoding's user avatar
10 votes
5 answers
69k views

Event 36888: The following fatal alert was generated: 10. The internal error state is 1203

I've searched online, but am unable to find any information; why this error is occurring? It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the ...
Param's user avatar
  • 1,367
9 votes
1 answer
4k views

New event log nowhere to be found after creating in PowerShell

Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log: new-...
Matt's user avatar
  • 311
9 votes
1 answer
8k views

Lots of FAILURE AUDIT: an account failed to log on entires in Security Log

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request? Do you ...
Param's user avatar
  • 1,367
8 votes
6 answers
34k views

Windows Event Log - email notification

Is there an easy way to send an email when a particular severity of event from a particular service hits the Windows server event log? This is on Windows Server 2003, if it makes a difference. n.b. ...
Matt Howells's user avatar
8 votes
1 answer
78 views

Simple solution to get notification when certain events appear in Windows logs [closed]

What is the most simple way to get a notification when specific events appear on Windows logs - anywhere on a windows network.
Steffen Maier's user avatar
8 votes
2 answers
30k views

Is there any way to undo after clearing a log on Windows 2008 server?

I accidentally cleared a event log. Is there any way I can get it back?
Duk's user avatar
  • 83
8 votes
1 answer
8k views

Windows Events for Remote Desktop logon failure

According to ref the logon types 10 and 3 in windows events are represnting Logon Type 10 = RemoteInteractive Logon & Logon Type 3 = Network Logon But when i tried to connect a Windows machine ...
apm's user avatar
  • 183
8 votes
2 answers
4k views

What is a valid destination log for Windows event forwarding

I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid ...
MikeSec's user avatar
  • 81
7 votes
8 answers
79k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
ℳ                            .'s user avatar
  • 173
7 votes
5 answers
70k views

How to fix "TCP/IP has reached the security limit..." event message

I get the following warning as a System event: "TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts." on o box running Win XP SP3. How can I fix this issue? ...
alexs's user avatar
  • 173
7 votes
6 answers
4k views

Good Windows event log analyzing/reporting tool?

I'm looking for a Windows eventlog analyzing and monitoring software for Windows Server 2000/2003 (there are some new features in Windows Server 2008.) The feature set should include: real-time ...
splattne's user avatar
  • 28.6k
7 votes
3 answers
51k views

Windows event codes for startup/shutdown lock/unlock

I'm trying to build up a list of event Ids that can be used to determine when the machine has been shutdown, started up, locked and unlocked. So far, I've found 6 event IDs which seem to be best ...
Dan Atkinson's user avatar
7 votes
4 answers
18k views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
Abel's user avatar
  • 1,047
7 votes
2 answers
29k views

Windows Application Experience Service

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This ...
floyd's user avatar
  • 1,530
7 votes
1 answer
12k views

How to clear the DMI System Event Log from linux?

Is it possible to clear the DMI event log (the one that gets partially shown by dmidecode --type 15) from Linux ? I know it can be cleared from the bios but it is a server in a remote location and I'...
b0fh's user avatar
  • 3,323
7 votes
2 answers
8k views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
user1169051's user avatar
7 votes
2 answers
3k views

Unexpected results from an XML query filter for security event log

Folks, I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
the-wabbit's user avatar
7 votes
1 answer
15k views

How to allow a domain user to write the Windows Event Log (2008 R2 or newer) without Local Admin privileges?

We are very concerned about security so we don't grant local admin privileges if not fully required or troubleshooted first. I have an application provider who needs to write the Windows Event Log. ...
MEXLG's user avatar
  • 71
7 votes
1 answer
6k views

Does Windows log a "Member removed" event for security groups when an AD user account is deleted?

We have AD DS security auditing enabled on a Windows Server 2008r2 functional level domain. We use a third party tool to alert us to changes to our administrative group memberships. We recently ...
Thomas's user avatar
  • 880
7 votes
1 answer
4k views

How do I get as much debugging info as possible out of the Network Policy Server (ias) service?

We are trying to authenticate a client on remote vpn, through a Meraki Z1 teleworker appliance. The Z1 is sending a proper request, the Network Policy Server (ias) service is apparently ...
Peter Grace's user avatar
  • 3,486
7 votes
0 answers
3k views

What is the Task Scheduler syntax for returning the "ComponentStatus" contents in a Windows Server Backup Event

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
Dominic Fitzpatrick's user avatar
6 votes
4 answers
43k views

How do I find the reason for the last shutdown in Windows Server 2003?

I have a windows server 2003 system which restarted for no apparent reason. Everything seems to be running fine now, but I want to know why it shutdown. I don't see any obvious signs of problems in ...
railmeat's user avatar
  • 371
6 votes
6 answers
7k views

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
Lars's user avatar
  • 458
6 votes
3 answers
14k views

Write to Windows Event Log when an IIS site is started or stopped

Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
LWixson's user avatar
  • 163
6 votes
1 answer
1k views

Event Log service broken on Windows 8.1 dev machines

On two separate Windows 8.1 installations with Visual Studio 2013 installed, the event log service errors on any attempt to read from/write to it. When I open Event Viewer I get this message when ...
dmo's user avatar
  • 2,100
6 votes
3 answers
70k views

Schannel: Certificate received from the remote server was issued by an untrusted certificate authority

i'm not sure whether to ask this on dba.stackexchange.com or here. Periodically following error is logged in Windows Server 2008 Administrative events: The certificate received from the remote ...
Tim Schmelter's user avatar
6 votes
2 answers
5k views

How to monitor Windows Server events with Centreon Nagios

I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
Miss M's user avatar
  • 129
5 votes
2 answers
8k views

Totally removing Windows Event Logs

I am developing an application that creates Windows event logs and writes to them. However, during development and testing, I created some event logs by mistake, with sources registered to them. The ...
bzamfir's user avatar
  • 367
5 votes
5 answers
35k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
kmarks2's user avatar
  • 192
5 votes
4 answers
16k views

"Account locked out" security event at midnight

The last three midnights I've gotten an Event ID 539 in the log...about my own account: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 539 Date: ...
Kev's user avatar
  • 984
5 votes
3 answers
31k views

Event Log > Filter Current Log > XML > where EventData contains text

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below: ...
JohnLBevan's user avatar
  • 1,312
5 votes
2 answers
25k views

How can I ship Windows Server 2008 event logs to a syslog server?

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...
TrueDuality's user avatar
  • 1,894
5 votes
3 answers
30k views

Event Viewer Warning: "Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057"

I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
TheMessenger's user avatar
5 votes
1 answer
8k views

How to delete event source windows 2008

I would like to delete an event source in windows 2008. I don't want to delete the log event, just the source. How do I do that? I don't find any command i PowerShell that does that. PS > gcm *...
Oualid's user avatar
  • 163

1
2 3 4 5
13