126 votes
Accepted

Windows Server restart / shutdown history

The clearest most succinct answer I could find is: How To See PC Startup And Shutdown History In Windows which lists these event ids to monitor (quoted but edited and reformatted from article): ...
user avatar
  • 2,474
21 votes

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

In my case: The Event Log was empty. web.config wasn't corrupt - verified by using same on local machine / using inetmgr Finally... Checking IIS logs showed a request like this ...Chrome/57.0.2987....
user avatar
  • 767
16 votes

Windows Server restart / shutdown history

Turning @user10082 comment into an answer. The proposed solution is a one-liner, as Powershell script: Get-EventLog -LogName System |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft ...
user avatar
12 votes

How to filter windows event log with wildcard?

Use Powershell Get-EventLog -LogName "System" | ?{$_.Message -like "*YourSearchString*"} | Out-GridView
user avatar
  • 121
11 votes

Simple solution to get notification when certain events appear in Windows logs

Event Log Consolidator View, consolidate, and dismiss event logs and correlate issues across multiple systems Tired of having to open Event Viewer and connect to each Windows system to see its event ...
user avatar
10 votes
Accepted

What are the implications of exceeding 4 GB in a Windows Event Log?

Other than the awful performance and ridiculous wait times when you have to load a 4 GB log and the hell it will be if you ever have to search through such a monstrous thing, not much. I think the ...
user avatar
  • 53.2k
8 votes
Accepted

Windows Application Experience Service

This service starts on a trigger. In order to see what the trigger that starts this service is, you can do: C:\Users\Ryan>sc qtriggerinfo AeLookupSvc [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME:...
user avatar
  • 54.9k
8 votes
Accepted

Windows event codes for startup/shutdown lock/unlock

Refering to your request about starting and shutdown event IDs, I made the list below based on a Windows 10 machine. The main point is that depending on the shutdown action (planned reboot, planned ...
user avatar
7 votes

Event 4625 Audit Failure NULL SID failed network logons

This Event is usually caused by a stale hidden credential. Try this from the system giving the error: From a command prompt run: psexec -i -s -d cmd.exe From the new cmd window run: rundll32 ...
user avatar
  • 89
7 votes
Accepted

Windows Events for Remote Desktop logon failure

You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access. You can test ...
user avatar
  • 32.3k
6 votes

Security Log in Event Viewer does not store IPs

Can someone please tell me why the Security Log doesn't know the IP address of people trying to log in and failing? Here is the cause for something like Remote Desktop. http://cyberarms.net/security-...
user avatar
6 votes
Accepted

How to filter the Windows Security event log by SID?

Use the -FilterXPath option instead! In the following example, I've saved all events from the Security log on my machine to seclog.evtx on the Desktop and search for events with SubjectUserSid S-1-5-...
user avatar
5 votes
Accepted

How could I send the windows eventlog to the network logging of a linux server?

I use nxlog for this, which ends up sending Windows event logs, IIS logs, Exchange logs, and more to (in my case) a central nxlog server where it gets written to files and send to an ELK stack. Its ...
user avatar
  • 3,859
5 votes

Where can I see what calls of EXE-programs have been made (including the arguments)?

This can be done using Audit Process Creation policy, which is enabled either in group policy if you're in a domain environment, or in the local policy on an individual workstation. This setting is in ...
user avatar
  • 1,253
4 votes

Server locking up, /var/log/messages reports "backlog limit exceeded"

There is multiple solution: To lengthen the backlog, add or edit /etc/audit/audit.rules by adding or editing "-b 320" to "-b 8192". change the priority by editing priority_boost from 3 to 4 or 5 in /...
user avatar
4 votes

How to diagnose a 500 Internal Server Error on IIS 7.5 when nothing is written to the event log?

The most obvious issue is improper or zero NTFS rights on the web application folder. So make sure the account serving the site has the right permissions. Without proper NTFS rights to the web ...
user avatar
  • 301
4 votes

Write to Windows Event Log when an IIS site is started or stopped

Take a look in the XML View of the event log ID 29. There you can see OldValue and NewValue change from one state to another OldValue>Starting NewValue>Stopped \?\C:\Windows\system32\inetsrv\...
user avatar
  • 41
4 votes
Accepted

Event Viewer Warning: "Installation of the Proof of Purchase from the ACPI table failed. Error code: 0xC004F057"

According to Dell Enterprise Technical Support (which claimed to have consulted Microsoft engineering) the warning can be disregarded. However, they presented these instructions to eliminate the ...
user avatar
4 votes

Windows Server restart / shutdown history

I would simply leave this as a comment since JohnC has basically covered everything, but I am not allowed to do so yet. The events he described have been used for quite a while, so they will work for ...
user avatar
  • 141
4 votes

Windows Server restart / shutdown history

I prefer to accomplish activities from command line. Here's the beginning of a snippet you can leverage. This shows the most recent 30,000 system records and returns the reboots within those records. ...
user avatar
  • 214
4 votes

Windows Server restart / shutdown history

Building on @JohnC s answer and extending it You could use an XML filter like: <QueryList> <Query Id="0" Path="System"> <Select Path="Security">*[System[Provider[@Name='eventlog' ...
user avatar
  • 141
4 votes
Accepted

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

Looks like Windows rotates it, and yes, there is a way to configure the retention policy. And here is a pretty good article on Managing of event logs: https://technet.microsoft.com/en-us/library/...
user avatar
4 votes

Where in the event log is the IIS AppPool recycling events being recorded?

Event viewer / Custom views / Server Roles / Web Server (IIS)
user avatar
4 votes

2012 R2 print server not showing file names on Event id 307

I have found the solution. There's a local computer policy: Computer configuration >> Administrative Templates >> Printers>> allow job name in event logs Then I restarted the server and voilá!
user avatar
4 votes
Accepted

Windows event log export - how to get general description?

Powershell Get-EventLog -LogName System -Newest 100 | select * | Export-Clixml log.xml
user avatar
  • 1,864
4 votes
Accepted

Windows security event log showing lot of firewall rule changed alert

Most likely there are some Firewall rules defined via GPO. Everytime these GPOs are processed, the firewall rules are applied, resulting into the 4946 event in the Event Log. In addition, the message ...
user avatar
4 votes
Accepted

Move Event Log in Windows 2012

You're doing it wrong. Whatever the problem is, the solution is not to relocate the event logs to a network location. You can copy them to a network location, use event forwarding to forward the ...
user avatar
  • 53.2k
4 votes
Accepted

How to filter windows event log with wildcard?

The XPath selector must begin with *, however you cannot use * to filter fields as Xpath 1.0 has no contains operator. https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-...
user avatar
  • 4,473
4 votes
Accepted

Application Event Log Source: SideBySide, Event ID: 35 Lync.exe.Manifest error

I resolved this by amending the manifest file reported in the error (C:\Program Files\Microsoft Office 15\root\office15\LYNC.EXE.MANIFEST), changing the processor architecture of the UccApi DLL. ...
user avatar
  • 1,082
4 votes
Accepted

What time zone does windows event logs show

Windows stores the time stamps for events from the event log in UTC time - regardless of the currently configured time zone of the computer. When viewing the event however, the timestamp is converted ...
user avatar
  • 1,545

Only top scored, non community-wiki answers of a minimum length are eligible