About

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

By default, they are located in the %WINDIR%\system32\config\ directory, and (most notably) separated into Application, System, and Security logs, all of which are stored in separate log files. There are other event logs as well, varying on the specific operating system and options installed, and despite the presence of an Application event log, not all native Windows applications are logged by default in the Application event log. The default extension for pre-2008 event logs (also know as "classic" or "legacy" event logs) is .evt, whereas the newer event logs are .evtx.

Unlike system logs in *nix systems, Windows event logs are not stored in plain text, but are encoded, and are intended to be accessed or written to through a Windows API. More details can be found on MSDN, here.

history | show excerpt | excerpt history