Event Viewer

Event Viewer Log

Event Viewer in Windows 10
Developer(s)	Microsoft
Operating system	Microsoft Windows
Service name	Windows Event log (eventlog)
Type	Utility software

Event Vieweris a component ofMicrosoft'sWindows NToperating systemthat lets administrators and users view theevent logs,typically file extensions.evtand.evtx,on a local or remote machine.Applicationsand operating-system components can use this centralized log service to report events that have taken place, such as a failure to start a component or to complete an action. InWindows Vista,Microsoft overhauled the event system.

Due to the Event Viewer's routine reporting of minor start-up and processing errors (which do not, in fact, harm or damage the computer), the software is frequently used bytechnical support scammersto trick the victim into thinking that their computer contains critical errors requiring immediate technical support.An example is the "Administrative Events" field under "Custom Views" which can have over a thousand errors or warnings logged over a month's time.

Overview

Windows NT has featured event logs since its release in 1993.

The Event Viewer uses event IDs to define the uniquely identifiable events that a Windows computer can encounter. For example, when a user'sauthenticationfails, the system may generate Event ID 672.

Windows NT 4.0added support for defining "event sources" (i.e. the application which created the event) and performing backups of logs.

Windows 2000added the capability for applications to create their own log sources in addition to the three system-defined "System", "Application", and "Security" log-files. Windows 2000 also replaced NT4's Event Viewer with aMicrosoft Management Console(MMC)snap-in.

Windows Server 2003added theAuthzInstallSecurityEventSource()API calls so that applications could register with the security-event logs, and write security-audit entries.

Versions of Windows based on the Windows NT 6.0 kernel (Windows VistaandWindows Server 2008) no longer have a 300-megabyte limit to their total size. Prior to NT 6.0, the system opened on-disk files asmemory-mapped filesin kernel memory space, which used the same memory pools as other kernel components.

Event Viewer log-files withfilename extensionevtxtypically appear in a directory such asC:\Windows\System32\winevt\Logs\

Command-line interface

eventquery.vbs, eventcreate, eventtriggers

Developer(s)	Microsoft
Initial release	October 25, 2001(2001-10-25)
Operating system	Microsoft Windows
Type	Command
License	Proprietarycommercial software
Website	docs.microsoft/en-us/windows-server/administration/windows-commands/eventcreate

Windows XPintroduced a set of threecommand-line interfacetools, useful to task automation:

• eventquery.vbs– Official script to query, filter and output results based on the event logs.Discontinued after XP.
• eventcreate– a command (continued in Vista and 7) to put custom events in the logs.
• eventtriggers– a command to create event driven tasks.Discontinued after XP, replaced by the "Attach task to this event" feature, that is, from within the list of events,Right-Clickon a single event and select from the pop-up menu.

Windows Vista

Event Viewer consists of a rewrittenevent tracing and loggingarchitecture on Windows Vista.It has been rewritten around a structuredXMLlog-format and a designated log type to allow applications to more precisely log events and to help make it easier for support technicians and developers to interpret the events.

The XML representation of the event can be viewed on theDetailstab in an event's properties. It is also possible to view all potential events, their structures, registeredevent publishersand their configuration using thewevtutilutility, even before the events are fired.

There are a large number of different types of event logs including Administrative, Operational, Analytic, and Debug log types. Selecting theApplication Logsnode in theScopepane reveals numerous new subcategorized event logs, including many labeled as diagnostic logs.

Analytic and Debug events which are high frequency are directly saved into a trace file while Admin and Operational events are infrequent enough to allow additional processing without affecting system performance, so they are delivered to the Event Log service.

Events are published asynchronously to reduce the performance impact on theevent publishingapplication. Event attributes are also much more detailed and show EventID, Level, Task, Opcode, and Keywords properties.

Users can filter event logs by one or more criteria or by a limitedXPath 1.0expression, and custom views can be created for one or more events. Using XPath as the query language allows viewing logs related only to a certain subsystem or an issue with only a certain component, archiving select events and sending traces on the fly to support technicians.

Filtering using XPath 1.0

1. Open Windows Event Log
2. Expand outWindows Logs
3. Select the log file that is of interest (In the example below, theSecurityevent log is used)
4. Right-click on the Event Log and selectFilter Current Log...
5. Change the selected tab fromFiltertoXML
6. Check the box toEdit query manually'
7. Paste the query into the text box. Sample queries can be found below.

Here are examples of simple custom filters for the new Window Event Log:

1. Select all events in the Security Event Log where the account name involved (TargetUserName) is "JUser"

   <QueryList><Query Id= "0" Path= "Security" ><Select Path= "Security" >*[EventData[Data[@Name= "TargetUserName" ]= "JUser" ]]</Select></Query></QueryList>

2. Select all events in the Security Event Log where any Data node of the EventData section is the string "JUser"

   <QueryList><Query Id= "0" Path= "Security" ><Select Path= "Security" >*[EventData[Data= "JUser" ]]</Select></Query></QueryList>

3. Select all events in the Security Event Log where any Data node of the EventData section is "JUser" or "JDoe"

   <QueryList><Query Id= "0" Path= "Security" ><Select Path= "Security" >*[EventData[Data= "JUser" or Data= "JDoe" ]]</Select></Query></QueryList>

4. Select all events in the Security Event Log where any Data node of the EventData section is "JUser" and the Event ID is "4471"

   <QueryList><Query Id= "0" Path= "Security" ><Select Path= "Security" >*[System[EventID= "4471" ]] and *[EventData[Data= "JUser" ]]</Select></Query></QueryList>

5. Real-world example for a package called Goldmine which has two @Names

   <QueryList><Query Id= "0" Path= "Application" ><Select Path= "Application" >*[System[Provider[@Name='GoldMine' or @Name='GMService']]]</Select></Query></QueryList>

Caveats:

• There arelimitationsto Microsoft's implementation of XPath
• Queries usingXPath string functionswill result in error

Event subscribers

Majorevent subscribersinclude the Event Collector service andTask Scheduler2.0. The Event Collector service can automatically forward event logs to other remote systems, runningWindows Vista,Windows Server 2008orWindows Server 2003 R2on a configurable schedule. Event logs can also be remotely viewed from other computers or multiple event logs can be centrally logged and monitored without an agent and managed from a single computer. Events can also be directly associated with tasks, which run in the redesignedTask Schedulerand trigger automated actions when particular events take place.

See also

• Common Log File System(CLFS)
• List of Microsoft Windows components
• Microsoft Management Console
• Technical support scam

External links

• Official sources:
  • Event Viewer - Inside ShowonMicrosoft Learn
  • Events and Errors(Windows Server 2008) onMicrosoft Learn