AdminXP.com: The Event Viewer

The Event Viewer

The Event Viewer is an administrative tool for viewing important events recorded by the system

The events are recorded in different logs:

Application log (AppEvent.Evt) - events recorded when starting, using and closing applications. Type of the recorded events is set by the developer of the particular application.
Security Log (SecEvent.Evt) - recording of security events in the same way as the successful and unsuccessful logons to the computer, events occurring when working with files, successful attempts for deleting or reading files..... Default in ´Do not audit the security events´.
System Log (SysEvent.Evt) - events recorded by the system - successful and unsuccessful installation of drivers and other system errors.
Directory Service (on the domain´s controller) ( NTDS.Evt) - records of the Active Directory service
DNS Server (on the domain´s controller) ( DnsEvent.Evt) - records of the DNS service
File Replication Service (on the domain´s controller) (NtFrs.Evt)- records of the file replication activity

Basic information

Start: 1. Administrative Tools - Event Viewer, 2. Computer management - Event viewer

When you choose a protocol in the left part, you can see particular events in the right part of the window - each type has its own icon and contains further information.

Types of events

Error	Critical system event - driver or HW failure, severe error of a part of the system. In case an error appears at the system start, there is a message displayed right after the start telling about problems and recommending to use the Event Viewer.
Warning	Potential problem - Not enough space in the system, some change in the configuration.
Information	Info message - record of a successful event after installation of a controller, running services
Success Audit	Successful audited event - logon to the system, access to files, deleting files
Failure Audit	Unsuccessful audited event - wrong password, unauthorized access to files

When you click on an event, a detailed description of the error will appear. In some cases also binary data are displayed which help the developers to find out the cause of the event. The arrow buttons serve to moving between the next and the previous message, the third button serves to copying the content of the message to the clipboard.

Further information about event records

Date and Time - Date and time of when the event happened
Source - an application, a part of the system or a device driver recording to a log (MSSQL Server, License Service, Browser, eventlog, DHCP....)
Category - more detailed specification of the event category; especially important for auditing.
Event ID - event code helping in identifying the problem (finding the event ID - more later in this article)
User - Name of the user who caused that the event happened.
Computer - Name of the computer on which the event happened. In most cases it is the name of the local computer. When logging on to the domain server, you can see the name of the logging on computer in the message description.

Log properties

By clicking the right mouse button on the log you get the local menu and "Properties".

By help of the log properties you can find out detailed information about the log and adjust the size and the way of recording.
Maximum log size - it enables to adjust the size of the log - working with smallish logs is much easier and faster. The change will be noticeable after having used the "Clear Log" button. (values from 64kB to 4 194 240 kB)
Overwrite events as needed - If the size of the log exceeds the limit the oldest events will be deleted
Overwrite events older than x days - Events older than x days will be automatically deleted. Unfortunately, if the maximum size of the log is reached during less than x days, new events will not be recorded.
Do not overwrite events - Events will not be overwritten and when a warning appears the administrator is bounden to delete the content of the log. If the maximum limit is reached, new data will not be recorded. In combination with this setup it is possible to activate the function of turning off the computer in case the security log has been filled up.
Clear Log - deleting of all events; before you do it you are asked if you want this log to be archived.

Filters a searching events

Searching and filtering can be done in several ways

For searching you can use an extended filter or the function of searching from the "Display" menu. This function do not enable to search by time, but it can search in the descriptions of the messages and enables to set the direction of the search (up or down).
Filtering you can also make by clicking on the heading. The entries are listed by the type of information and enable easy listing by time, event, source or user.

Notes

The administration of the logs can be done by a user having the administrator rights
Records can be stored in files ending with *.evt - default in save to directory %SystemRoot%\system32\config\*.evt. The archived logs ending with *.evt can be later opened.
Records can be saved by help of "Save file to log as..." in the "Action" menu to files ending with *.txt and *.csv (textual values separated by commas). The textual files can be opened in different editors or table processors (602Tab, Excel). There is a disadvantage in case you save the log into other format type than *.evt - loss of binary data and impossibility of reopening it in the Event Viewer ("Action" menu - "Open log file".
By help of that "Export" command, the currently displayed information will be saved - E. g. List of logs, active log listing or even just information about one event.
As in case of most other administrative tools, you can create your own administrative tool by help of a module for the local computer or several modules for several distant computers. The result will be a MMC console with the Event Viewer on the local computer and several distant computers.
You can also connect a distant computer through the "Connect to another computer" in the "Action" menu (In the tree structure you have to select the item referring to the viewer of the local or a distant computer)
In Windows 2000 or in Windows XP you can sometimes find a link to some Internet sites - a lot of people are disappointed when they do not immediately get a detailed answer to the specific error number. Such a link only serves as a link to a site containing Windows support. This sites serve as a crossroad from which you can get to other information sources such as ´knowledgebase´, newsgroup or links to many specialized articles.
A lot of users in the domain look for some data on the local computers, while most of the events happen on the domain controller. This refer especially to the security log in which the logons to the domain are recorded. So, if you want to get the information about the domain logons of some of the users, searching around the computers will not help you. Look into the security log of the domain controller that verifies particular users.
Basic and other information you will find in the Help of the Event Viewer application.

Finding out the ID meaning

- in the Windows2000Events.exe program from the Resource Kit or downloaded from - www.microsoft.com/windows2000/techinfo/reskit/ErrorandEventMessages - list of error events. Here, you will find out that besides the ID number, there are also other important factors - type of the event, log and the source in which the error occurs; the code itself can have several meanings.
Error and Event Messages Help - the help file "w2000msgs.chm" stored on the installation CD of the server in the Support\tools directory in the Support.cab file. It contains error messages gotten from different components of Windows 2000, including explanation of some messages in the Event Viewer.
By help of the command line and the "net helpmsg error code no." command - command providing a brief description of the error code that is usually represented by binary numbers or directly by the error code in the description.

Example of searching the error code meaning

In this case the hexadecimal number 1f is converted to decimal number 31 that means "Device connected to the system do not function" (which you can see in the description). But in other cases this do not work this way and it is necessary to know the application in which the binary data determining the error appeared. In complex binary codes you have to turn to a qualified technical support (or the developer of the application).