Questions tagged [windows-event-log]
"Event log" usually refers to the system/server logs on Microsoft Windows machines.
45
questions
8
votes
6
answers
34k
views
Windows Event Log - email notification
Is there an easy way to send an email when a particular severity of event from a particular service hits the Windows server event log? This is on Windows Server 2003, if it makes a difference.
n.b. ...
111
votes
6
answers
631k
views
Windows Server restart / shutdown history
How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed?
The Windows Event Log is ...
13
votes
6
answers
11k
views
Server 2008 email on Event variables
One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.
This is working ...
10
votes
3
answers
23k
views
Windows Event Log Rotation?
Windows Server 2003.
Is there any way to easily rotate event logs (or automatically clear and save)? I'm doing a bit of auditing on this machine and my security log gets real big real quick and ...
7
votes
8
answers
79k
views
How to tell what time a domain user logged in?
In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day.
Is the first one of ...
3
votes
2
answers
12k
views
Can not see entries in Application Log in Event Viewer
Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and ...
2
votes
2
answers
9k
views
Tracking who installed Software on server
Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the ...
0
votes
1
answer
3k
views
Parse wevtutil XML into a database?
I'm by no means an XML expert. Ergo, I'm having trouble importing Windows event XML from wevtutil into an SQL database. Prior to Server 2008, we exported event log data to the database directly ...
70
votes
6
answers
303k
views
How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?
I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating
HTTP Error 500.0 - Internal Server Error
The page ...
26
votes
3
answers
120k
views
Filtering Security Logs by User and Logon Type
I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
16
votes
2
answers
165k
views
Event 4625 Audit Failure NULL SID failed network logons
In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server:
An account failed to log on.
Subject:
...
15
votes
6
answers
23k
views
How do I passively monitor the Windows Event Log?
How can I monitor the Windows Event Log remotely such that I will be informed automatically when certain events occur?
There are plenty of active monitoring solutions, but they require human ...
13
votes
2
answers
73k
views
Server locking up, /var/log/messages reports "backlog limit exceeded"
We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the /var/...
12
votes
2
answers
27k
views
How to filter windows event log with wildcard?
According to the document here, the asterisk wildcard is supported and hence it should work in eg.
*[EventData[Data[@Name='TargetUserName'] ='User1*']]
but I cannot get any wildcard filter to work - ...
8
votes
1
answer
8k
views
Windows Events for Remote Desktop logon failure
According to ref the logon types 10 and 3 in windows events are represnting
Logon Type 10 = RemoteInteractive Logon
&
Logon Type 3 = Network Logon
But when i tried to connect a Windows machine ...
7
votes
2
answers
3k
views
Unexpected results from an XML query filter for security event log
Folks,
I am trying to craft a custom XML / Xpath filter to the Windows Event Log viewer to exclude the countless "SYSTEM" Logons from the security log's view. I have managed to get this far with the ...
6
votes
6
answers
7k
views
Windows Event Log Forwarding
I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
5
votes
1
answer
10k
views
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9}
I'm in the middle of a "swing" migration from Windows SBS 2003 to Server 2003 Standard.
It's going okay so far but we're getting event 1058 on client machines:
Windows cannot access the file gpt.ini ...
5
votes
5
answers
36k
views
Security Log in Event Viewer does not store IPs
I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
5
votes
1
answer
6k
views
How do I fix a custom Event Viewer Log that merges automatically with the Application log?
I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to ...
4
votes
2
answers
44k
views
troubling anonymous Logon events in Windows Security event log
I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ...
4
votes
2
answers
10k
views
How does Windows Event forwarding work with non domain computers? (certificates)
In reasearching this question I've looked at the following documents and none of them describe the options or flexibility of the event collector service.
Microsoft's Event Collector Service on ...
3
votes
0
answers
2k
views
New Server 2012 R2 Essentials generating Audit Failure Event 4625 Null SID Logon Attempts
I am researching a failed login issue that is triggering our monitoring software.
Researching the issue, the only other information I could find that was exactly what I was seeing, was on here: Event ...
3
votes
5
answers
14k
views
System State Backups using NTbackup fail with error 0x800423f4 (relating to volume shadow copy)
We have a Windows Server 2003 R2 running Service Pack 2. It is a domain controller (Global Catalog) and our main internal DNS server. We run a System State backup of the machine to back up Active ...
3
votes
1
answer
5k
views
Windows 2008 R2 services not working
EDIT I spawned the Windows events logging service won't start issue to a separate question here
I have a strange problem:
SQLAGENT won't start
Windows events logging service won't start
Today I ...
3
votes
1
answer
22k
views
Event logger won't start: error 2 The system cannot find the file specified, Windows server 2008R2
NOTE: this is a "spawn" of a previous post which dealt with 2 different issues and became too lengthy, so I decided to clean the original question and post this issue in a separate question
When I ...
3
votes
1
answer
4k
views
Windows Forward Events Missing User Data and Description
I have Subscription Events set to forward windows server 2008's Terminal Services/LocalSessionManager/Operational logs to another window's server 2008's Forward Events section.
The Subscription Event ...
3
votes
2
answers
16k
views
Where in the event log is the IIS AppPool recycling events being recorded?
I turned on all the options for IIS AppPool recycling logging and recycled the app pool a few times and I am not seeing the events in the event log. I refreshed a few sections in the event log. Where ...
3
votes
2
answers
9k
views
Listing Users using RDP
Windows Server 2008 R2
I'm trying to use PowerShell to get me a list of users who have logged into Remote Desktop Services (formerly known as Terminal Services) during the past day. With little ...
3
votes
3
answers
2k
views
Event Logging for RAID fault in 2008 R2
does anyone have a solution for logging an error/critical entry to the event log in 2008 R2 when RAID has an issue? I really want to set up email alerts for when this happens. I'm using the MS builtin ...
2
votes
3
answers
31k
views
Event ID 2013 (Disk Is At Or Near Capacity) not getting logged
I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is ...
2
votes
1
answer
4k
views
filtering event logs with specific TIME range of ANY day
How can I query windows server events between two times of any day?
I have tried with PowerShell...
Get-EventLog -Logname xxxx -After 04:00:00 -Before 04:00:30
...but just returns today's events
1
vote
1
answer
12k
views
Events logs are not collected but event collection subscriptions are active
A Windows Server 2008 R2 server is configured to collect Windows Event Logs, via a source initiated event subscription.
The subscription appears to be active but no events are collected.
On the ...
1
vote
2
answers
628
views
Track IP Adress login RDP when shutdown happen
Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has ...
1
vote
0
answers
885
views
Kernel-Power event every 15 minutes
Been having an issue since about 12 hours ago on our Windows Server 2016 instance:
Note the time pattern - every ~2 minutes, then every ~15 minutes. It's been doing this without fail. If I'm RDP'd in ...
1
vote
1
answer
5k
views
Security has requested to process its policy settings again. Error
I am receiving the following error with a yellow exclamation mark in the group policy results wizard when deploying software using a GPO.
Security has requested to process its policy settings again....
1
vote
1
answer
2k
views
What Event ID is generated when a scheduled task fails in Windows Server 2003?
If a scheduled task fails on Windows Server 2003, is anything written to the event log? And if so, what Event ID does it have so I can set an Event Trigger to look for it, and email me?
1
vote
1
answer
18k
views
Account lockouts not in Event Viewer
I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1.
I am able to find Audit Failure events (ID ...
1
vote
2
answers
1k
views
A lot of logon/logoffs events in Windows event log
I have a server that contains Team Foundation Server which we use for source control. This server is windows server 2003, however it is not our domain server.
When we do a large 'get latest version' ...
1
vote
2
answers
3k
views
Event Id:8003 The Master Browser Error
I receive the following error on Windows Server 2008 the last a few days.
event id 8003
The master browser has received a server announcement from the
computer computername that believes that ...
1
vote
1
answer
2k
views
creating Event Viewer Applications and Services Logs
On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
1
vote
2
answers
2k
views
How do I filter Event Viewer down to errors from a single website?
I have used Event Viewer to create a custom view of all ASP.net errors by using the GUI as below
How do I create custom views for a single website?
0
votes
1
answer
1k
views
How to write proper XPath query for filtering certain application pool errors in Windows 2008 R2 Event log ("Applications" section)
does someone know how to write proper XPath query for filtering certain application pool errors in Windows 2008 R2 Event log ("Applications" section)?
EventData in XML view from Application eventlog ...
0
votes
1
answer
626
views
Windows: Audit/View logins from remote networks?
i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures:
>gpedit.msc
Local Computer Policy
Computer ...
0
votes
2
answers
705
views
Determine windows server attack? Should I monitor the server and block IPs all the day?
While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows:
**An account failed to log on.**
Subject:
Security ID: SYSTEM
Account Name: ...