92
The clearest most succinct answer I could find is:
How To See PC Startup And Shutdown History In Windows
which lists these event ids to monitor (quoted but edited and reformatted from article):
Event ID 6005 (alternate): “The event log service was started.” This is synonymous to system startup.
Event ID 6006 (alternate): “The event log service was stopped....
49
In the System event log, filter by event id 1074, this will show by which process and on behalf of which user a reboot was initiated.
This was tested on Windows Server 2008.
40
Take a look at IIS7's Failed Request Tracing feature:
Troubleshooting Failed Requests Using Tracing in IIS 7
Troubleshoot with Failed Request Tracing
The other thing I would do is tweak your <httpErrors> setting because IIS may be swallowing an error message from further up the pipeline:
<configuration>
<system.webServer>
<...
15
You're on the right track - one of the mistakes in your query is the space in 'Logon Type', it should just be 'LogonType'.
I pasted a query below that I have just verified works. It's a bit simplified but you get the idea. It shows you all 4624 events with logon type 2, from user 'john.doe'.
<QueryList>
<Query Id="0" Path="Security">
<...
13
All times displayed for event log events are computed as offsets to Greenwich Mean Time (GMT). When you set the time on your system, you are setting the value for GMT. When you select your local time zone for the system, the appropriate number of hours are added or subtracted to the stored GMT value. This adjusted time is displayed. When "Automatically ...
12
In my case:
The Event Log was empty.
web.config wasn't corrupt - verified by using same on local machine / using inetmgr
Finally...
Checking IIS logs showed a request like this
...Chrome/57.0.2987.133+Safari/537.36 500 19 5 312
The key being:
sc-status sc-substatus sc-win32-status
500 19 5
which with some googling pointed me to the ...
11
Event Log Consolidator View, consolidate, and dismiss event logs and correlate issues across multiple systems
Tired of having to open Event Viewer and connect to each Windows system to see its event logs? Don’t have a centralized way to view events from multiple servers?
Download SolarWinds Event Log Consolidator to organize event logs from several Windows ...
9
Do it programmatically, like this (C#):
System.Diagnostics.EventLog.Delete("WrongNamedEventLog");
You don't have to compile a C# application to do it though, just invoke the Delete(string logname) method from PowerShell if you like:
[System.Diagnostics.EventLog]::Delete("WrongNamedEventLog");
9
Other than the awful performance and ridiculous wait times when you have to load a 4 GB log and the hell it will be if you ever have to search through such a monstrous thing, not much. I think the largest one I've seen in my environments was 10 GB, and although I gave up waiting on it to load, it didn't seem to harm anything.
The 4GB caution for Server ...
8
This service starts on a trigger. In order to see what the trigger that starts this service is, you can do:
C:\Users\Ryan>sc qtriggerinfo AeLookupSvc
[SC] QueryServiceConfig2 SUCCESS
SERVICE_NAME: AeLookupSvc
START SERVICE
CUSTOM : 18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e [ETW PROVIDER UUID]
An Event Tracing for Windows event ...
8
They are gone, unless you either:
Saved the logs as it suggested you do when you clicked clear
Have a full system backup
It's also possible but unlikely data recovery software could undelete them. They are stored in C:\Windows\System32\winevt\Logs if you want to use software like GetDataBack or similar to try to recover them.
7
We can't answer that. Applications can put whatever they want into the logs; you could write a key logger that logged every keystroke on the system into the event log, or a web app that dumped every user's plaintext password into a log entry.
You also haven't defined what "extremely sensitive" means to you. By default, Windows isn't logging anything that ...
7
Configuring each DC to use only itself for DNS via 127.0.0.1 is your problem.
Configure DC1 to use DC2 as the first try for DNS resolution. Configure DC2 to use DC1 as the first try for DNS resolution. Configure each DC to use itself as a secondary DNS source.
You could also take the action described here about making the Netlogon service depend on the DNS ...
7
Terrible reason: I needed to close the Event Viewer and re-open. That's completely insane. Thanks for help.
7
Use C:\Windows\Sysnative\winevt
In most cases, whenever a 32-bit application attempts to access %windir%\System32, the access is redirected to %windir%\SysWOW64.
32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file ...
7
Use Powershell
Get-EventLog -LogName "System" | ?{$_.Message -like "*YourSearchString*"} | Out-GridView
6
First I would suggest using the Get-WinEvent and passing a hash to do as much filtering as possible there (and thus avoid creating lots of objects Where-Object will throw away):
Get-WinEvent -filterHashtable @{LogName='Security'; StartTime=$a; Id=4624; Level=0}
Level 0 is success audit. This can be performed remotely with the -computer parameter. Then ...
6
I know it's an old question but my own research came across this post on technet.
It says that the reason for the long delay is due to an output bug in the event viewer. Event viewer is misinterpreting the raw data of the string value "15" in the registry as a number.
You could find the value of registry NtpClient\ResolvePeerBackoffMinutes is 15, the ...
6
It's not that Get-EventLog doesn't get the Task Category, it's just that it's not the default behavior of the Cmdlet to display it. But the data is still there.
Import-Module ActiveDirectory
foreach($server in Get-ADComputer -Filter *)
{
Get-EventLog -LogName Security -ComputerName $server | ? { $_.CategoryNumber -EQ 12544 }
}
This is further ...
6
You can use Remove-EventLog to unregister one or more event sources:
Remove-EventLog -Source "My Custom Source"
Remove-EventLog -Source "ASource","Another one","CustomApp123"
6
There are multiple login sources that could possibly be generating these errors:
FTP logins - check your FTP log to see if login failures are showing up at the same time. This was the source in my case, which took me entirely too long to figure out, and which is why I'm posting this.
Logins via Basic Authentication over http or https (simple, but possibly ...
6
Use the -FilterXPath option instead!
In the following example, I've saved all events from the Security log on my machine to seclog.evtx on the Desktop and search for events with SubjectUserSid S-1-5-18 (LOCAL SYSTEM):
$events = Get-WinEvent -Path "$HOME\Desktop\seclog.evtx" -FilterXPath '*[EventData[Data[@Name="SubjectUserSid"] = "S-1-5-18"]]'
In a script,...
6
You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access.
You can test this by changing the security layer to RDP Security Layer. Instructions and detailed information on how to do so are found here: Configure Server ...
5
The event logs are a clearing-house for any messages or errors thrown by the OS, its components, and any software installed on the system. So we can't fully cover all it's potential contents because there's unlimited potential things it could contain and they all require individual treatment.
One way to analyze event logs is:
Filter out the informational ...
5
SEL (System Event Log) can be cleared from Linux. Depending on which interfaces you have available will determine how it can be done.
My supermirco workstation as well as most servers have IPMI.
You can check if your system registered an IPMI device with dmidecode.
dmidecode --type 38
Failure to query the interface, does not necessarily mean your system ...
5
You can try this:
WECUtil SS "SubscriptionName" /cm:custom /ree:true
This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate
http://blog.zenshaze.com/2011/06/13/event-forwarding-of-security-logs/
5
There should be a log at:
%windir%\system32\LogFiles\Shutdown
(which should be C:\WINDOWS\system32\LogFiles\Shutdown on a "standard" Windows Server 2000/2003 install)
5
You can use Attach task to this log or simply create a new scheduled task.
Use the trigger When a specific event is logged
Choose the log you want to monitor (you can choose multiple logs in the advanced task settings)
Set the action to Send an e-mail (and provide the nescessary information)
If you want any error sending a message you have to refine the ...
5
Can someone please tell me why the Security Log doesn't know the IP address of people trying to log in and failing?
Here is the cause for something like Remote Desktop.
http://cyberarms.net/security-insights/security-lab/remote-desktop-logging-of-ip-address-%28security-event-log-4625%29.aspx
There is no option in Windows to enable or disable the logging ...
5
Audit Logon Events
So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server.
To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a ...
Only top voted, non community-wiki answers of a minimum length are eligible
