Questions tagged [windows-event-log]
"Event log" usually refers to the system/server logs on Microsoft Windows machines.
626
questions
111
votes
6
answers
630k
views
Windows Server restart / shutdown history
How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed?
The Windows Event Log is ...
70
votes
6
answers
302k
views
How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?
I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating
HTTP Error 500.0 - Internal Server Error
The page ...
29
votes
2
answers
136k
views
Who restarted my Windows server? [duplicate]
Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server?
I have found the shutdown event in the System event log, but it does not show which user initiated the ...
29
votes
1
answer
218k
views
Where/how does Windows store the data in the event logs?
We run some financial systems that log error messages to the system logs. I need to find out if we can clean these error messages from a PCI DSS point of view.
I am specificaly interested in the ...
26
votes
3
answers
119k
views
Filtering Security Logs by User and Logon Type
I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
25
votes
7
answers
129k
views
How can I remove specific events from the event log in Windows Server 2008?
Do I need a third party tool for this?
16
votes
2
answers
164k
views
Event 4625 Audit Failure NULL SID failed network logons
In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server:
An account failed to log on.
Subject:
...
15
votes
6
answers
23k
views
How do I passively monitor the Windows Event Log?
How can I monitor the Windows Event Log remotely such that I will be informed automatically when certain events occur?
There are plenty of active monitoring solutions, but they require human ...
14
votes
4
answers
20k
views
What are the implications of exceeding 4 GB in a Windows Event Log?
I found this Microsoft KB that covers recommended Event Log setting maximums for operating systems up to Windows 2008/Vista, which recommends a maximum of 4GB, and have seen some other vague ...
14
votes
1
answer
26k
views
What time zone is displayed in windows event logs? When viewing saved log from another machine?
What time zone is being displayed here?
GMT? System time zone? What happens when I export the log and view it on a second machine. Does it use the first system's time zone or the second?
Thanks!
13
votes
2
answers
73k
views
Server locking up, /var/log/messages reports "backlog limit exceeded"
We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the /var/...
13
votes
6
answers
11k
views
Server 2008 email on Event variables
One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.
This is working ...
12
votes
2
answers
27k
views
How to filter windows event log with wildcard?
According to the document here, the asterisk wildcard is supported and hence it should work in eg.
*[EventData[Data[@Name='TargetUserName'] ='User1*']]
but I cannot get any wildcard filter to work - ...
11
votes
3
answers
84k
views
What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?
I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
10
votes
3
answers
23k
views
Windows Event Log Rotation?
Windows Server 2003.
Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and ...
10
votes
3
answers
10k
views
Where can I see what calls of EXE-programs have been made (including the arguments)?
Is there any log-file within Windows where all EXE-calls are tracked or is it possible to enable such a log? Would this contain the arguments / parameters of these calls?
Thanks
10
votes
5
answers
69k
views
Event 36888: The following fatal alert was generated: 10. The internal error state is 1203
I've searched online, but am unable to find any information; why this error is occurring?
It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the ...
9
votes
1
answer
4k
views
New event log nowhere to be found after creating in PowerShell
Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log:
new-...
9
votes
1
answer
8k
views
Lots of FAILURE AUDIT: an account failed to log on entires in Security Log
I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request?
Do you ...
8
votes
6
answers
34k
views
Windows Event Log - email notification
Is there an easy way to send an email when a particular severity of event from a particular service hits the Windows server event log? This is on Windows Server 2003, if it makes a difference.
n.b. ...
8
votes
1
answer
78
views
Simple solution to get notification when certain events appear in Windows logs [closed]
What is the most simple way to get a notification when specific events appear on Windows logs - anywhere on a windows network.
8
votes
2
answers
30k
views
Is there any way to undo after clearing a log on Windows 2008 server?
I accidentally cleared a event log. Is there any way I can get it back?
8
votes
1
answer
8k
views
Windows Events for Remote Desktop logon failure
According to ref the logon types 10 and 3 in windows events are represnting
Logon Type 10 = RemoteInteractive Logon
&
Logon Type 3 = Network Logon
But when i tried to connect a Windows machine ...
8
votes
2
answers
4k
views
What is a valid destination log for Windows event forwarding
I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid ...
7
votes
8
answers
79k
views
How to tell what time a domain user logged in?
In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day.
Is the first one of ...
7
votes
5
answers
70k
views
How to fix "TCP/IP has reached the security limit..." event message
I get the following warning as a System event: "TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts." on o box running Win XP SP3.
How can I fix this issue? ...
7
votes
6
answers
4k
views
Good Windows event log analyzing/reporting tool?
I'm looking for a Windows eventlog analyzing and monitoring software for Windows Server 2000/2003 (there are some new features in Windows Server 2008.) The feature set should include:
real-time ...
7
votes
3
answers
51k
views
Windows event codes for startup/shutdown lock/unlock
I'm trying to build up a list of event Ids that can be used to determine when the machine has been shutdown, started up, locked and unlocked. So far, I've found 6 event IDs which seem to be best ...
7
votes
4
answers
18k
views
NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134
I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day:
...
7
votes
2
answers
29k
views
Windows Application Experience Service
On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This ...
7
votes
1
answer
12k
views
How to clear the DMI System Event Log from linux?
Is it possible to clear the DMI event log (the one that gets partially shown by dmidecode --type 15) from Linux ?
I know it can be cleared from the bios but it is a server in a remote location and I'...
7
votes
2
answers
8k
views
Export entire Windows Log to XML
I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format.
The print server runs Win2008R2. When I want ...
7
votes
2
answers
3k
views
Unexpected results from an XML query filter for security event log
Folks,
I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
7
votes
1
answer
15k
views
How to allow a domain user to write the Windows Event Log (2008 R2 or newer) without Local Admin privileges?
We are very concerned about security so we don't grant local admin privileges if not fully required or troubleshooted first.
I have an application provider who needs to write the Windows Event Log. ...
7
votes
1
answer
6k
views
Does Windows log a "Member removed" event for security groups when an AD user account is deleted?
We have AD DS security auditing enabled on a Windows Server 2008r2 functional level domain. We use a third party tool to alert us to changes to our administrative group memberships. We recently ...
7
votes
1
answer
4k
views
How do I get as much debugging info as possible out of the Network Policy Server (ias) service?
We are trying to authenticate a client on remote vpn, through a Meraki Z1 teleworker appliance. The Z1 is sending a proper request, the Network Policy Server (ias) service is apparently ...
7
votes
0
answers
3k
views
What is the Task Scheduler syntax for returning the "ComponentStatus" contents in a Windows Server Backup Event
I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
6
votes
4
answers
43k
views
How do I find the reason for the last shutdown in Windows Server 2003?
I have a windows server 2003 system which restarted for no apparent reason. Everything seems to be running fine now, but I want to know why it shutdown. I don't see any obvious signs of problems in ...
6
votes
6
answers
7k
views
Windows Event Log Forwarding
I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
6
votes
3
answers
14k
views
Write to Windows Event Log when an IIS site is started or stopped
Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
6
votes
1
answer
1k
views
Event Log service broken on Windows 8.1 dev machines
On two separate Windows 8.1 installations with Visual Studio 2013 installed, the event log service errors on any attempt to read from/write to it.
When I open Event Viewer I get this message when ...
6
votes
3
answers
70k
views
Schannel: Certificate received from the remote server was issued by an untrusted certificate authority
i'm not sure whether to ask this on dba.stackexchange.com or here.
Periodically following error is logged in Windows Server 2008 Administrative events:
The certificate received from the remote ...
6
votes
2
answers
5k
views
How to monitor Windows Server events with Centreon Nagios
I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
5
votes
2
answers
8k
views
Totally removing Windows Event Logs
I am developing an application that creates Windows event logs and writes to them.
However, during development and testing, I created some event logs by mistake, with sources registered to them.
The ...
5
votes
5
answers
35k
views
Security Log in Event Viewer does not store IPs
I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
5
votes
4
answers
16k
views
"Account locked out" security event at midnight
The last three midnights I've gotten an Event ID 539 in the log...about my own account:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: ...
5
votes
3
answers
31k
views
Event Log > Filter Current Log > XML > where EventData contains text
I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
...
5
votes
2
answers
25k
views
How can I ship Windows Server 2008 event logs to a syslog server?
In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...
5
votes
3
answers
30k
views
Event Viewer Warning: "Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057"
I have Windows Server 2012 R2 Standard running on a Dell PowerEdge T320. The server is near one month in use as a domain controller. I've noticed this warning entry showing in the Application log ...
5
votes
1
answer
8k
views
How to delete event source windows 2008
I would like to delete an event source in windows 2008.
I don't want to delete the log event, just the source.
How do I do that?
I don't find any command i PowerShell that does that.
PS > gcm *...