Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to understand what was occurring I attached a task to that event to send me an email if it occurred again.

I've been receiving emails all weekend, some 200 emails received since Friday evening, and they are still arriving.

This morning I've logged onto the server and opened event viewer and I cannot see any new instances of that event in the log viewer.

If i filter by event ID I can see the series of events from last week but nothing since then.

Get-Eventlog shows the same as the GUI viewer, ie no record of these events, and yet I am still getting the emails generated.

Everything else seems to be being logged as expected, as far as I can tell.

This is a Server 2008 R2 box runnin in an ESXi cluster, latest updates etc. Tools is up to date with ESXi (although I am going to move to 10.0.5 I think).

EDIT: WEVTUTIL qe APPLICATION >>ApplicationLog.log

I can now see the logs triggering hte event. Still no idea why these are not showing in the viewer.

  • I suspect that whatever Windows process is sending those emails has them queued somewhere, and possibly because of a slow mailserver is taking a while? Have they stopped by now? – Lucky Luke Apr 7 '16 at 18:03
  • No, these are absolutely not queued. I'm still receiving them, some 27 received so far today. Mail server is capable of very high volume, and shows no queues. I am still convinced that these are still being generated by incidences of that event. – Patrick Apr 8 '16 at 12:53
  • Don't the events have a timestamp associated with them? When were they generated? Why wouldn't you see them in the actual event logs? Are they coming from a standard log (e.g. Application, System) or from one of the newer Application/Services logs? – Lucky Luke Apr 10 '16 at 23:55
  • > Why wouldn't you see them in the actual event logs? Yes, well thats what I'm asking isn't it, they aren't visible in event logs. As i say in the OP, these events were in the usual application log. Although I realise that they may be showing up in a different one, good point. I'll check now. – Patrick Apr 11 '16 at 7:45
  • 1
    What's the output of WEVTUTIL GL Application? – Tomas Dabasinskas Apr 14 '16 at 10:36

It is most likely the Default setting for EventLog dropping off old items.

See my answer at: https://superuser.com/questions/1414698/does-windows-eventlog-drops-off-old-items-as-new-items-are-added

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.