Event Viewer

With Event Viewer, you can monitor events recorded in event logs. Typically a computer stores the Application, Security, and System logs. It could also contain other logs, depending on the computer's role and the applications installed.

  • For tips about using Event Viewer, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Enable security logging for security-critical objects and actions, and then periodically review the security logs on computers in your network.

  • By setting up an auditing policy and reviewing your security logs, you can detect unauthorized activity or intrusion attempts by malicious users or attackers on computers in your network.
  • For more information about setting auditing policies, see Auditing security events.
  • For more information about viewing event logs, see View Event Logs.


How to...

  • View event logs
  • Manage event logs
  • Customize event logs
  • Use the security log


View event logs

  • View an event log
  • Add another view of an event log
  • Search for specific events
  • Select another computer
  • Specify a sort order in an event log
  • Filter events


View an event log

Microsoft Windows Graphic

To view an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to view.
  3. In the details pane, view the list of individual events.
  4. If you want to see more details about a specific event, in the details pane, double-click the event.

Notes

  • XOX. However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • To refresh the view, on the Action menu, click Refresh. When you open a log, Event Viewer displays the current information for the log. While you view the log, the display is not updated unless you refresh the Event Viewer window. If you switch to another log and then return to the first log, the display for the first log is automatically refreshed. When you refresh the view of an event log, only the view is updated, no changes are made to the log. The Refresh command is not available for archived logs, because those files can no longer be updated.
  • For more information about the event header in the details pane, click "The event header" in Related Topics.

Related Topics


Add another view of an event log

Microsoft Windows graphic

To add another view of an event log

  1. Open Event Viewer.
  2. In the console tree, click the log of which you want to add another view.
  3. On the Action menu, click New Log View. A copy of the log appears in the console tree with a default name. For example, if you selected the Application log, the default name of the copy would be Application (2).
  4. If you want to change the name of the new log view, on the Action menu, click Rename.
  5. Type the name as you want it to appear in the console tree, and then press ENTER.

Notes

  • XOX. However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • By creating a new log view, you can customize how Event Viewer displays the information of an existing log and then apply a new name to the new log view, while keeping the defaults or the options you set for the original log intact. Log views added to the console tree can be managed and customized in the same way as the default logs.

Related Topics


Search for specific events

Microsoft Windows graphic

To search for specific events

  1. Open Event Viewer.
  2. In the console tree, click the log you want to search.
  3. On the View menu, click Find.
  4. Under Event types, select the types of events you want to find.
  5. In Event source, Category, Event ID, User, Computer, or Description, specify additional information about the event or events you want to find.
  6. Click Find Next.

Notes

  • XOX However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • In Description, you can type any text that matches a portion of an event record description.
  • To restore the default search criteria, click Restore Defaults before clicking Find Next.
  • Your search parameters remain in Find throughout the current session. The default settings are restored the next time you start Event Viewer.
  • If you are looking for groups of events instead of a small number of individual events, you can also filter the log. For more information, see "Filter events" in Related Topics.

Related Topics


Connect to another computer

Microsoft Windows graphic

To connect to another computer

  1. Open Event Viewer.
  2. In the console tree, right click Event Viewer (Local), and then click Connect to another computer
  3. Click Another computer, type the name of the computer, and then click OK. You can also find another computer on the network by clicking Browse.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • The other computer can be a workstation running XOX, XOX, Windows 2000 Professional, or Windows NT Workstation, or a server or domain controller running Windows 2000 Server, Windows NT Server, or a Windows Server 2003 family operating system.

Related Topics


Specify a sort order in an event log

Microsoft Windows graphic

To specify a sort order in an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to sort.
  3. Click the column heading you want to sort by.

Notes

  • XOX. However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • To reverse the sort order, click the column heading a second time.
  • To sort chronologically, on the View menu, click Newest First or Oldest First. The default is Newest First.

Related Topics


Filter events

Microsoft Windows graphic

To filter events

  1. Open Event Viewer.
  2. In the console tree, select the log you want to filter.
  3. On the View menu, click Filter.
  4. On the Filter tab, specify the characteristics you want to use in the filter.

Notes

  • XOX. However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • Filtering changes only the view, and has no effect on the actual contents of the log. All events are logged continuously, whether the filter is active or not. If you archive a log from a filtered view, all records are saved, even if you select a text format or comma-delimited text format file.
  • To return to the default criteria, click Restore Defaults.
  • To turn off event filtering, on the View menu, click All Records.

Related Topics


Manage event logs

  • Clear an event log
  • Archive an event log
  • Open an archived event log


Clear an event log

Microsoft Windows graphic

To clear an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to clear.
  3. On the Action menu, click Clear all Events.
  4. If you want to save the log before clearing it, click Yes.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • You cannot clear archived logs; instead, delete the archived log file.

Related Topics


Archive an event log

Microsoft Windows graphic

To archive an event log

  1. Open Event Viewer.
  2. In the console tree, right-click the log you want to archive, and then click Save Log File As.
  3. In File name, enter a name for the archived log file.
  4. In Save as type, select a file format, and then click Save.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Backup Operators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • If you archive a log in log-file format (.evt), you can reopen it in Event Viewer. If you archive a log in text (.txt) or comma-delimited (.csv) format, you can reopen the log in other programs, such as word processing or spreadsheet programs, but not with Event Viewer.
  • You can only save event logs in log-file format on the computer on which the events occur; for example, when using Event Viewer to view event logs on a remote computer.
  • To save a local event log in log-file format on another computer, in File name, type \\remotecomputername\share, and then type the path to and name for your archive file.
  • When you archive a log file, the entire log is saved, regardless of filtering options. The sort order is not retained when logs are saved. However, you can filter and sort the archived log again when you open it in Event Viewer.
  • Archiving has no effect on the current contents of the active log.
  • To remove an archived log file from your system, delete the file in Windows Explorer.

Related Topics


Open an archived event log

Microsoft Windows graphic

To open an archived event log

  1. Open Event Viewer.
  2. On the Action menu, click Open Log File.
  3. Click the file you want to open. You may need to search for the drive or folder that contains the document.
  4. In Log type, select the type of log to be opened.
  5. In Display name, enter the name as you want it to appear in the console tree, and then click Open.

Notes

  • Performing this task does not require you to have administrative credentials. However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • You can use Event Viewer to open an archived log in log-file format (.evt). If an archived log was saved in text (.txt) or comma-delimited (.csv) format, you can open the log using other programs, such as word processing or spreadsheet programs, but not Event Viewer.
  • To remove an archived log file from your system, delete the file in Windows Explorer.
  • For more information about event log settings, see "Understanding event logging options" in Related Topics.

Related Topics


Customize event logs

  • Set event logging options
  • Reset an event log to default settings
  • Change the maximum event log size


Set event logging options

Microsoft Windows graphic

To set event logging options

  1. Open Event Viewer.
  2. In the console tree, click the log you want to set options for.
  3. On the Action menu, click Properties.
  4. On the General tab, specify the options you want.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX

Related Topics


Reset an event log to default settings

Microsoft Windows graphic

To reset an event log to default settings

  1. Open Event Viewer.
  2. In the console tree, click the log you want to reset.
  3. On the Action menu, click Properties.
  4. On the General tab, click Restore Defaults.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • For more information about event log settings, see Understanding event logging options in Related Topics.

Related Topics


Change the maximum event log size

Microsoft Windows graphic

To change the maximum event log size

  1. Open Event Viewer.
  2. In the console tree, click the log you want to change.
  3. On the Action menu, click Properties.
  4. On the General tab, in Maximum log size, specify the new log size in kilobytes.
  5. To put the new setting in effect, click Clear Log.

    6. If you want to retain the information currently in the log, click Yes when a message appears asking if you want to save the original log before clearing it, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • For more information about event log settings, see Understanding event logging options in Related Topics.

Related Topics


Use the security log

  • View the security log
  • Define or modify auditing policy settings for an event category
  • Apply or modify auditing policy settings for a local file or folder
  • Apply or modify auditing policy settings for an object using Group Policy


Concepts

This section provides general background information about Event Viewer:

  • Event Viewer overview
  • Auditing security events
  • Event log overview
  • Using Event Viewer
  • Managing event logs from the command-line


Event Viewer Overview

Using Event Viewer, you can view and set logging options for event logs in order to gather information about hardware, software, and system problems.

  • For information about event logs, see Event log overview.
  • For information about events, see The event header or Types of events.
  • For information about event logging options you can set using Event Viewer, see Understanding event logging options.
  • For information about setting up auditing policies, see Auditing security events.


Event log overview

By default, a computer running a Windows Server 2003 family operating system records events in three kinds of logs:

Application log

The application log contains events logged by applications or programs. For example, a database program might record a file error in the application log. Application developers decide which events to log.

Security log

The security log records events such as valid and invalid logon attempts, as well as events related to resource use such as creating, opening, or deleting files or other objects. For example, if logon auditing is enabled, attempts to log on to the system are recorded in the security log.

System log

The system log contains events logged by Windows system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. The event types logged by system components are predetermined by the server.

A computer running a Windows Server 2003 family operating system which is configured as a domain controller records events in two additional logs:

Directory service log

The directory service log contains events logged by the Windows Active Directory service. For example, connection problems between the server and the global catalog are recorded in the directory service log.

File Replication service log

The File Replication service log contains events logged by the Windows File Replication service. For example, file replication failures and events that occur while domain controllers are being updated with information about system volume changes are recorded in the file replication log.

A computer running Windows configured as a Domain Name System (DNS) server records events in an additional log:

DNS server log

The DNS server log contains events logged by the Windows DNS service.

Other types of events and event logs might be available on a computer, depending on what services are installed.

The Event Log service starts automatically when you start Windows.

If you are a member of the Administrators group on the local computer, you can set access permissions on event logs using Group Policy. For more information, see Settings for event logs.

For more information about viewing events, see Types of events and Interpreting an event.


Using Event Viewer

This section covers:

  • Interpreting an Event
  • Viewing and Archiving Log Files


Interpreting an event

This section covers:

  • The event header
  • Types of events
  • Linking to Microsoft for Help and Support


The event header

The event header contains the following information:

Information | Meaning
Date | The date the event occurred. The date and time of an event are stored in Universal Time Coordinate (UTC) but always display in the viewer's locale.
Time | The time the event occurred. The date and time of an event are stored in UTC but always display in the viewer's locale.
User | The name of the user on whose behalf the event occurred. This name is the client ID if the event was actually caused by a server process, or the primary ID if impersonation is not taking place. Where applicable, a security log entry contains both the primary and impersonation IDs. Impersonation occurs when the server allows one process to take on the security attributes of another.
Computer | The name of the computer where the event occurred. This is usually the name of your own computer, unless you are viewing an event log on another computer.
Source | The software that logged the event, which can be either a program name such as "SQL Server," or a component of the system (such as a driver name) or of a large program. For example, "Elnkii" indicates an EtherLink II driver. The Source always remains in its original language.
Event | A number identifying the particular event type for this source. The first line of the description usually contains the name of the event type. For example, 6005 is the ID of the event that occurs when the Event log service is started. The first line of the description of such an event is "The Event log service was started." Using the values of Source and Event together, product support representatives can troubleshoot system problems.
Type | A classification of the event severity: Error, Information, or Warning in the system and application logs; Success Audit or Failure Audit in the security log. In the Event Viewer normal list view, these are represented by a symbol.
Category | A classification of the event by the event source. This information is primarily used in the security log. For example, for security audits, this corresponds to one of the event types for which success or failure auditing can be enabled in Group Policy by a member of the Administrators group.

For more information, see

  • Event log overview
  • View an event log
  • Types of events
  • Understanding event logging options


Types of events

Event Viewer displays five types of events:

Event type | Description
Error | A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an Error will be logged.
Warning | An event that is not necessarily significant, but might indicate a possible future problem. For example, when disk space is low, a Warning might be logged.
Information | An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.
Success Audit | Any audited security event that succeeds. For example, a user's successful attempt to log on the system will be logged as a Success Audit event.
Failure Audit | Any audited security event that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.

For more information, see:

  • Event log overview
  • View an event log
  • The event header
  • Setting options for logging events


Linking to Microsoft for Help and Support

For more details about an event, you can double-click it in the details pane to open the Event Properties dialog box. The Event Properties dialog box contains a Uniform Resource Locator (URL) link in the Description dialog box.

If you click the URL in the Event Properties dialog box of an event generated by a Microsoft application or service, information related to the event display is sent over the Internet to Microsoft in the form of a query, which locates more detailed information from the Microsoft Web site. The collected data is limited to only what is needed to retrieve more information about the event. User names and e-mail addresses, names of files unrelated to the logged event, machine addresses, and any other forms of personally identifiable information are not collected.

Note

  • Events not generated by Microsoft applications or services might also contain a URL, and might take you to non-Microsoft web sites.


Viewing and archiving log files

This section covers:

  • Understanding event logging options
  • File formats for archived logs


Understanding event logging options

Using Event Viewer, you can define logging parameters for each kind of event log. To define parameters, right-click a log in the console tree, and then click Properties. On the General tab, you can set the maximum size of the log and specify whether the events are overwritten or stored for a certain period of time.

The default logging policy is that if a log is full, the oldest events are deleted to make room for new events, provided events are at least seven days old. You can customize this policy, or event log wrapping options, for different logs.

Event log wrapping options include the following.

Use | To
Overwrite events as needed | Have new events continue to be written when the log is full. Each new event replaces the oldest event in the log. This option is a good choice for low-maintenance systems.
Overwrite events older than [x] days | Retain the log for the number of days you specify before overwriting events. The default is seven days. This option is the best choice if you want to archive log files weekly. This strategy minimizes the chance of losing important log entries and at the same time keeps log sizes reasonable.
Do not overwrite events | Clear or archive the log manually rather than automatically. Select this option only if you cannot afford to miss an event (for example, for the security log at a site where security is extremely important).

You can also use Group Policy to set the maximum log sizes and log wrapping options, as well as set access permissions on event logs. For more information, see Settings for event logs.

Application and system logging start automatically when you start the computer. For information about configuring security logging, see Auditing security events.

Notes

  • To perform these procedures, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the local computer. As a security best practice, consider using Run as to perform these procedures.
  • For information about how to set event logging options using Event Viewer, see Set event logging options.


File formats for archived logs

When you archive an event log, you save it in one of three file formats:

  • Log-file format (.evt), which enables you to view the archived log again in Event Viewer.
  • Text-file format (.txt), which enables you to use the information in a program such as a word processing program. You cannot use Event Viewer to open a log file saved in .txt format.
  • Comma-delimited text-file format (.csv), which enables you to use the information in a program such as a spreadsheet or a flat-file database. You cannot use Event Viewer to open a log file saved in .csv format.

The event description is saved in all archived logs. The data within each individual event record is recorded in the following order:

  1. Date
  2. Time
  3. Source
  4. Type
  5. Category
  6. Event
  7. User
  8. Computer
  9. Description

For more information, see:

  • Archive an event log
  • Open an archived event log
  • Event log overview
  • Types of events


Managing event logs from the command-line

Opening Event Viewer from the command-line

You can launch Event Viewer from the command-line using eventvwr.exe or mmc.exe. Either command opens Event Viewer.

Syntax for eventvwr.exe

eventvwr.exe

Parameters

computername

Specifies the computer you want to target, where computername is the name of the target computer. If you do not specify a computer, Event Viewer displays the logs on the local computer. You can specify a remote computer for computername, if you are a member of the Administrators group, or have been delegated the appropriate authority, on the remote computer.

or

Syntax for mmc.exe

mmc.exe X:\WINDOWS\system32\eventvwr.msc

Where X:\WINDOWS\System32 is the default path to eventvwr.msc, and X is the folder where Windows is installed.

Parameters

/computer=computername

Specifies the computer you want to target, where computername is the name of the target computer. If you do not specify a computer, Event Viewer displays the logs on the local computer. You can specify a remote computer for computername, if you are a member of the Administrators group, or have been delegated the appropriate authority, on the remote computer.

/auxsource=computername

Enables Event Viewer to obtain the information about events from a computer on which the event log service is installed. This can be the computer that generated the log or another computer on the network. You can use the /auxsource=computername parameter on computers running a XOX or later operating system. You must be a member of the Administrators group, or have been delegated the appropriate authority, on the computer you specify for computername. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as.

Using command-line tools to manage events and event logs

You can also use command-line utilities to create and query event logs and associate programs with particular logged events. For example, you can use Eventcreate.exe to customize an event entry to a specified event log. Eventquery.vbs is used to list the events and event properties from one or more event logs. Eventtriggers.exe enables you to create event triggers that will run programs upon the occurrence of specific events.

For information about other command-line utilities, see Command-Line Reference.


Troubleshooting

What problem are you having?

When viewing an event in a saved event log on a remote computer, you are unable to view the Description or Category fields in the properties dialog box. Instead of a description in the Description field, you see an error message, or instead of a category in the Category field, you see a number.

Cause: Event Viewer obtains event description and category information from the computer that contains the log. The event log might have been copied from the computer on which it was generated, to another computer, on which the service that logged these events is not installed.

Solution: Open Event Viewer from the command-line using mmc.exe, and use the /auxsource=computername parameter. The /auxsource=computername parameter enables Event Viewer to obtain the information about events from a computer on which the event log service is installed. This can be the computer which generated the log or another computer on the network. You can use the /auxsource=computername parameter on computers running a XOX or later operating system. You must be a member of the Administrators group, or have been delegated the appropriate authority, on the computer you specify for computername. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as.

Syntax

mmc.exe X:\WINDOWS\system32\eventvwr.msc /auxsource=computername

Where X:\WINDOWS\System32 is the default path to eventvwr.msc, and X is the drive where Windows is installed.

Notes

  • To run a command-line utility, click Start, and then click Run. In the Open box, enter the command-line utility and parameters, and then click OK.
  • If category information is not available, you will also see a number instead of text in the Category field in the Event Viewer details pane for an event listing.

See also: Mmc; Managing event logs from the command-line

or

Cause: You are attempting to view a log on a remote computer and are not a member of the Administrators group, or have not been delegated the appropriate authority on the remote computer.

Solution: Run Event Viewer as a member of the Administrators group, or have the appropriate authority delegated to you on the remote computer. As a security best practice, consider using Run as to perform this procedure.

You might also be able to obtain the same information from a different computer on your network. To do this, run Event Viewer at a command prompt (Eventvwr.msc) with the auxsource=ComputerName parameter. You can use this parameter to enable Event Viewer to obtain information from a computer on which the service is installed. This can be either the computer that generated the log or another computer on the network.

or

Cause: You are attempting to view a log on a remote computer and the Remote Registry service on the remote computer is stopped. If the remote computer is running a XOX or later operating system, the Remote Registry service must be started for you to be able to see the Description or Category fields in the property page for an event log.

Solution: On the remote computer, start the Remote Registry Service. You can manage the Remote Registry service through the Services and Applications snap-in in Computer Management.

To start the Remote Registry service

  1. In Computer Management, verify that you are in the console for the remote computer.
  2. In the console tree, under Services and Applications, click Services.
  3. In the details pane, double-click Remote Registry.
  4. In the General tab, under Service status, click Start. Click OK.

You might also be able to obtain the same information from a different computer on your network. To do this, run Event Viewer at a command prompt (Eventvwr.msc) with the auxsource=ComputerName parameter. You can use this parameter to enable Event Viewer to obtain information from a computer on which the service is installed. This can be either the computer that generated the log or another computer on the network.

Notes

  • You must be a member of the Administrators group, or have been delegated the appropriate authority, on the computer you specify for computername. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as.
  • This parameter is available on computers running XOX or a product in the Windows Server 2003 family.

See also: Remote Administration;Computer Management; Microsoft Management Console

When viewing an event in the details pane, you see a globally unique identifier (GUID) or security ID (SID) in the User field. You should see a user name.

Cause: The computer on which you are running Event Viewer is unable to translate the GUID or SID into the user name.

Solution: Run Event Viewer on the computer on which the event log was generated.

or

Cause: The user account referenced by the event has been deleted.

Solution: You will not be able to retrieve this information through Event Viewer.

You are unable to view the Security log, but can view other logs.

Cause: You are not a member of the Administrators group, or have not been delegated the appropriate authority on the target computer.

Solution: Become a member of the Administrators group, or have the appropriate authority delegated to you, on the target computer. As a security best practice, consider using Run as to perform this procedure.

See also: Use the Security log

You are able to view the Security log, but are unable to view other logs.

Cause: Your account has been added to the Guests group on the target computer, and is also a member of the Administrators group.

Solution: Remove your account from the Guests group on the target computer:

  1. Open Computer Management. If the target computer is a remote computer, right-click Computer Management (Local), and then click Connect to another computer.
  2. Under Local Users and Groups, click Groups.
  3. In the details pane, double-click Guests.
  4. Select the account, and then click Remove.
  5. Click OK.

Notes

  • This problem typically develops when an administrator adds a group containing a broad category of users (such as the Everyone, INTERACTIVE, OR Authenticated users group) to the Guests group.
  • By default, members of the Guests group are explicitly denied access to resources such as event logs. Therefore, avoid adding groups containing users with administrative privileges to the Guests group.
  • You might need to log off, and then log back on for these changes to take effect.

See also: Connect to to another computer.

You cannot access the Computer Management extension snap-ins on a remote computer.

Cause: The Remote Registry service is not running on the remote computer.

Solution: Ensure that the Remote Registry service is started on the remote computer. For more information, see To start, stop, pause, resume, or restart a service. You need appropriate permissions on the remote computer to start the service.

Note

  • You might also receive this error message if the remote computer is running Windows 95. Computer Management does not support remote access to computers that are running Windows 95.