Questions tagged [windows-event-log]

"Event log" usually refers to the system/server logs on Microsoft Windows machines.

Filter by
Sorted by
Tagged with
2 votes
1 answer
1k views

How to differentiate between users and computers in EventID 4768 - Active Directory?

I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers. My problem is, that as far as I can see, I ...
Patkos Csaba's user avatar
0 votes
1 answer
2k views

Server 2003 - Event Viewer 540 Anonymous Logon from strange IPs

The Event Viewer for my Windows Server 2003 machine is flooded with these 540 login attempts from IP addresses in foreign countries. It looks like somebody is trying to access my machine - what sort ...
user66827's user avatar
  • 215
0 votes
1 answer
772 views

Strange logon activity for Administrator in Event Logs

On one of our public facing servers the Administrator account logged in at 6:45am GMT. It wasn't a member of staff. Details from the event logs 1st event Logon attempt by: ...
best's user avatar
  • 301
0 votes
1 answer
2k views

What are the diffences between evntwin and evntcmd?

I want to send my eventlog via SNMP trap in order to monitor it, but something is not clear in my mind. I saw i need to configure traps destination in SNMP service in services.msc and then I also ...
Fbo's user avatar
  • 943
0 votes
2 answers
15k views

HP ProLiant DL380 G7 iLO error

I have a HP ProLiant DL380 G7 server which sent me an email that's got me worried. The system has detected the following event: SNMP Trap: 9006 Date time: 03/19/2011 11:47:46 PM Computer:...
Alex's user avatar
  • 3
1 vote
1 answer
3k views

Exchange 2010 EVENT ID 1109, msexchange activesync

the general description is as follows: Some Exchange ActiveSync traffic to the External URL https://owa.domain.com/Microsoft-Server-ActiveSync is being blocked due to a misconfiguration of ...
Jeff's user avatar
  • 1,089
0 votes
3 answers
17k views

Exchange 2010, Event 3145 MSEXCHANGEREPL error

Server 2008 R2 Exchange 2010 SP1 receiving another error in the event log: Event 3154, msexchangeRepl > Active Manager failed to mount database Mailbox Database 1037838543 on server WIN2K8EX....
Jeff's user avatar
  • 1,089
0 votes
3 answers
10k views

Server 2008 R2, Exchange 2010, WMI error event 10

The system is windows 2008 R2, with Exchange 2010 SP1 installed. I am receiving the following event log application error: event 10, WMI Event filter with query "SELECT * FROM ...
Jeff's user avatar
  • 1,089
4 votes
2 answers
5k views

Access denied error 3221225578 with file sharing to Windows server

i'm trying to access the shares on a server. The credential box appears, and i enter in a correct username and password, and i get access denied. The silly thing is that i can Remote Desktop to the ...
Ian Boyd's user avatar
  • 5,373
2 votes
0 answers
5k views

Event ID for moving a file folder in Server 2003 R2

We had a file folder moved in our system last night, causing a ripple effect throughout our network, changing file paths and basically messing up our documents. We are doing an audit on the server ...
Kernel Panic's user avatar
1 vote
1 answer
5k views

How to filter Remote Desktop connection in Event Log filter

I need to see only success/fail logs for Remote Desktop connection. I want to monitor who (what username), when (datetime) and where (ip address) tried to connect to my remote server. How do I filter ...
feronovak's user avatar
  • 171
0 votes
1 answer
606 views

Why does the Windows Event Viewer sometimes show a human-readable user name, and sometimes an SID?

On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries. On other systems, Event Viewer shows an SID (in the form S-1-5-...). Luckily, the SysInternals ...
Patrick's user avatar
  • 227
1 vote
2 answers
3k views

Event Id:8003 The Master Browser Error

I receive the following error on Windows Server 2008 the last a few days. event id 8003 The master browser has received a server announcement from the computer computername that believes that ...
Cell-o's user avatar
  • 327
1 vote
1 answer
2k views

The previous system shutdown at xxxx was unexpected

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message: Event Type: Error Event Source: EventLog Event Category: None ...
m.edmondson's user avatar
4 votes
4 answers
59k views

How can I view login/logoff times for Windows Server 2008?

I use Windows Server 2008 at my workstation and sometimes work from home. Is there an easy way of viewing the login and logoff times from the event viewer so I can see how many hours I was logged in ...
Chris's user avatar
  • 183
0 votes
3 answers
187 views

How can I find who or what deleted files in the system32 directory?

We have a Windows 2003 development server (IIS and SQL Server) with remote desktop access and some employees have admin rights. A couple weeks ago, a lot of important files (dlls, exes, msc and other ...
Jason's user avatar
  • 135
1 vote
2 answers
4k views

SRMSVC event ID 8197

Update: actual answer was finally found, see self-answer below. I have a Windows 2003 R2 machine that is giving an Event ID 8197 about once an hour and ten minutes. The full error is attached below. ...
Godeke's user avatar
  • 131
1 vote
1 answer
3k views

Does IIS have a log?

I have a secure web site but I did not configure permissions to let the IIS worker process access the respective machine certificate's private key. Naturally, navigation to the site does not work. I ...
mark's user avatar
  • 755
2 votes
2 answers
5k views

Enable ASP classic logging to event log

I thought my need was pretty simple, but I couldn't find a solution... How can I make ASP-classic errors appear in Windows Event Log ? I need it on Windows-server-2000 and Windows-Server-2003. ...
fredlegrain's user avatar
0 votes
2 answers
171 views

Windows 2008 server unaccessible without traces in the event log

I am trying to figure out why a Windows 2008 server became inaccessible in terms of RDP and access to a web application. The server was turned off and then on. Look at the event log at the time it ...
Rob's user avatar
  • 1
0 votes
3 answers
12k views

Event ID 17890 (A significant part... paged out.) with SQL Server 2008

I have a machine that has SQL Server 2008 Standard installed on a Windows 2003 R2 server. Periodically (about once an hour) I am getting Event ID 17890 several times in a row. An example: 6:28:54 "A ...
Godeke's user avatar
  • 131
1 vote
1 answer
1k views

How to troubleshoot Application Popup issues 0XC0000142 and 0XC000009a

I am running randomly into 1 of these popups when our application runs. The machines range from 8GB/8Core to 24GB/24Core and run Windows Server 2008 R2. The application is a bunch of perl scripts and ...
R.D's user avatar
  • 111
1 vote
1 answer
5k views

How am I able to figure out why apache/php crashes?

I have a problem which is driving me and a few clients on this server totally nuts. The problem is that PHP (or I guess Apache) seems to be crashing randomly and almost on a daily basis. The ...
NetConstructor.com's user avatar
2 votes
1 answer
5k views

Event Log "Wake Source" when system wakes from sleep

So I've been troubleshooting sleep timers for our systems and have run across an interesting issue. I need a way to report how long a system was awake after a number of different inputs. Now, I've ...
Doltknuckle's user avatar
  • 1,274
0 votes
2 answers
185 views

Extreme slowdown when changing folder permissions

Last Friday I attempted to set permissions on a folder containing multiple folders. I simply deleted one user group's access entry, then clicked Apply and was greeted with an hourglass. Pretty soon ...
Kev's user avatar
  • 984
0 votes
1 answer
169 views

Is it possible to connect WinServer eventlog from other domain

I have a virtual machine with Windows Server R2 Ent. In this machine runned domain controler test.local. I have admin(doamin and local) account on this machine. I want to get access to event log of ...
Stoune's user avatar
  • 101
0 votes
1 answer
165 views

Reporting critical Event ID to email

How do you organize or implement monitoring system in your domain to monitor these critical error on your workstations and servers ? Hardware Related: 7, 9, 11, 51, 52, 55 Potential HD related issue ...
Senior Systems Engineer's user avatar
-1 votes
1 answer
2k views

Windows XP clients strange message in event log [closed]

I am getting the following error message in the event log of many of my windows XP clients The COM+ Event System failed to create an instance of the subscriber partition:{41E90F3E-56C1-4633-81C3-...
Simon Foster's user avatar
  • 2,652
2 votes
0 answers
1k views

Cannot open log for source 'blah'. You may not have write access

I'm attempting to write to a custom event log .... but I get the error: Win32Exception Access Is Denied Cannot open log for source 'blah'. You may not have write access. I've trawled the net.. ...
BIDeveloper's user avatar
2 votes
1 answer
2k views

WMI query of Win32_Product creates events in the W2K8+ Application Event Log

On Windows Server 2008 and Windows Server 2008 R2 querying installed software with WMI and the Win32_Product class events are written to the Application event log. The events are purely informational ...
Greg Wojan's user avatar
0 votes
1 answer
87 views

aggregate local events in AD

How can I aggregate events from event viewer log (logins with local Administrator) from all computers (atleast the servers - 2003,2008,2008r2) in an AD domain?
user avatar
0 votes
1 answer
1k views

Moss 2007 - Event Log EventId:7888 Windows NT user or group not found

I am getting this event in my Application event log: Event Type: Error Event Source: Office SharePoint Server Event Category: Office Server General Event ID: 7888 Date: 11/8/2010 Time: 11:15:36 AM ...
Sylaei's user avatar
  • 3
0 votes
1 answer
2k views

Security Event Log: User field = N/A

In my Windows Server 2008 R2 Enterprise Security Event Log all entries have 'N/A' for the "User:" field. Is there something I can do to have this field filled in? I noticed that this information is ...
Jay Riggs's user avatar
  • 243
1 vote
2 answers
3k views

How do I filter the Security Log using XML for the following data

A manager has asked me to log the start and stop times and dates when a user launches a particular program (Starcraft II). I have enabled logging on the user's machine so that it will report all ...
Bugat's user avatar
  • 69
5 votes
4 answers
16k views

How can I generate Windows Logs for testing purposes?

I'm trying to test some Splunk-y things with my Windows logs. But I want to be sure of the logs that are coming in so I can be sure I'm keeping and discarding logs properly. What I'm really looking ...
thepocketwade's user avatar
4 votes
2 answers
44k views

troubling anonymous Logon events in Windows Security event log

I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ...
blackcoil's user avatar
1 vote
1 answer
491 views

In xperf (Windows ETW) what's the difference between the 'CPU Sampling by Process' and 'CPU Usage by Process' graphs in the xperf viewer?

The values are tracking very closely, however the 'CPU Sampling by Process' appears to be less fine grained in it's data. I can't find anything in the documentation to differentiate these two.
plumpie's user avatar
  • 13
3 votes
2 answers
2k views

How can I create an event trace with logman.exe on W2K8?

For various reasons, I'd like to get a trace of disk accesses on some Windows Server 2008 machines. I can set up a user defined data collector set in the Reliability and Performance Monitor tool to ...
mjcmirr's user avatar
  • 31
3 votes
5 answers
17k views

What is the best tool for to capturing Windows Event Logs centrally?

We have a collection of about 100 Windows 2003 and Windows 2008 R2 domain controllers that I would like to start capturing Event Log data from. Many of the servers are very busy and generate large ...
duffbeer703's user avatar
  • 21.3k
2 votes
1 answer
3k views

IIS, Application Pools and Event Logs

Running IIS 6 on a handful of Windows 2003 Web Ed. servers. Each has some App Pools configured with "Idle Timeout" of x minutes. No recycling, just the idle timeout from the Properties Performance tab....
Chris_K's user avatar
  • 3,434
2 votes
2 answers
9k views

Tracking who installed Software on server

Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the ...
sgmoore's user avatar
  • 652
1 vote
1 answer
529 views

search logs for events associated with Task Scheduler

I'm working with a Server08 box (Web Edition) where the Task Scheduler had run a set of unchanged housekeeping scripts for months. Over the last week, Scheduler has failed to start scripts twice. TS'...
justSteve's user avatar
  • 859
2 votes
1 answer
6k views

Where to grant an account permissions for event log

My asp.net application does not have the permission to write to windows event log. It is running under Network Service account. Is there any tool/management console rather than hack in the registry to ...
Roy's user avatar
  • 121
1 vote
2 answers
2k views

Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB

The error log on my sql server throws this warning every 5 seconds 'Setting database option COMPATIBILITY_LEVEL to 100 for database ReportServerTempDB.' From what I can tell this may be due to my ...
kscott's user avatar
  • 123
0 votes
2 answers
5k views

What could cause a flurry of Microsoft-Windows-Servicing events?

I have a windows 2k8 machine that generated almost 40,000 WinEventLog:System events in the period of about 20 minutes. The breakdown of these events by eventcode was approximately: 4373 46% 4371 ...
MattUebel's user avatar
  • 937
1 vote
2 answers
522 views

Syslog - capturing event logs from Win2k boxes

I asked this question in SuperUser without much luck and so I am posting it here to see if anyone can assist. We have a central syslog server and we want it to capture event log events from Windows ...
molecule's user avatar
1 vote
2 answers
2k views

What's spamming my System event log?

The following event floods the log pretty harshly, pushing out other important events from the record. Is there any way to determine from the data which service is failing? Event Type: Error Event ...
jldugger's user avatar
  • 14.5k
1 vote
1 answer
2k views

Enable Permissions To Write To Event Log

I have an ASP .Net app running on a windows 2003 server. If the application throws an exception I want the exception to be written to the event log. I have this implemented but when an exception is ...
Pieces's user avatar
  • 145
0 votes
5 answers
2k views

Does one usually monitor the Event Log on Windows servers?

I'm a programmer not a sysadmin but as we had a lot of trouble with our servers I thought I would be proactive and help our overworked (and learning) sysadmins. We have 20-25 or so Windows Servers (...
user avatar
0 votes
1 answer
2k views

Get the "source network address" in Event ID 529 audit entries on Windows XP

In windows server 2003 when an Event 529 (logon failure) occures with a logon type of 10 (remote logon), the source network IP address is recorded in the event log. On a windows XP machine, this (and ...
Make it useful  Keep it simple's user avatar

1
9 10
11
12 13