Event Viewer

Short description: Component of Microsoft's Windows NT operating system

Event Viewer Log

Event Viewer in Windows 10

Developer(s)| Microsoft
Operating system| Microsoft Windows
Service name| Windows Event log (eventlog)
Type| Utility software

Event Viewer is a component of Microsoft's Windows NT operating system that lets administrators and users view the event logs on a local or remote machine. Applications and operating-system components can use this centralized log service to report events that have taken place, such as a failure to start a component or to complete an action. In Windows Vista, Microsoft overhauled the event system.[1]

Due to the Event Viewer's routine reporting of minor start-up and processing errors (which do not, in fact, harm or damage the computer), the software is frequently used by technical support scammers to trick the victim into thinking that their computer contains critical errors requiring immediate technical support.[2] An example is the "Administrative Events" field under "Custom Views" which can have over a thousand errors or warnings logged over a month's time.

## Contents

* 1 Overview
* 2 Command-line interface
* 3 Windows Vista
* 3.1 Filtering using XPath 1.0
* 3.2 Event subscribers
* 4 See also
* 5 References
* 6 External links

## Overview

Windows NT has featured event logs since its release in 1993.

The Event Viewer uses event IDs to define the uniquely identifiable events that a Windows computer can encounter. For example, when a user's authentication fails, the system may generate Event ID 672.

Windows NT 4.0 added support for defining "event sources" (i.e. the application which created the event) and performing backups of logs.

Windows 2000 added the capability for applications to create their own log sources in addition to the three system-defined "System", "Application", and "Security" log-files. Windows 2000 also replaced NT4's Event Viewer with a Microsoft Management Console (MMC) snap-in.

Windows Server 2003 added the `AuthzInstallSecurityEventSource()` API calls so that applications could register with the security-event logs, and write security-audit entries.[3]

Versions of Windows based on the Windows NT 6.0 kernel (Windows Vista and Windows Server 2008) no longer have a 300-megabyte limit to their total size. Prior to NT 6.0, the system opened on-disk files as memory-mapped files in kernel memory space, which used the same memory pools as other kernel components.

Event Viewer log-files with filename extension `evtx` typically appear in a directory such as `C:\Windows\System32\winevt\Logs\`

## Command-line interface

eventquery.vbs, eventcreate, eventtriggersDeveloper(s)| Microsoft

|

Initial release| October 25, 2001; 24 years ago (2001-10-25)
Operating system| Microsoft Windows
Type| Command
License| Proprietary commercial software
Website| docs.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate

Windows XP introduced set of three command-line interface tools, useful to task automation:

* `eventquery.vbs` – Official script to query, filter and output results based on the event logs.[4] Discontinued after XP.
* `eventcreate` – a command (continued in Vista and 7) to put custom events in the logs.[5]
* `eventtriggers` – a command to create event driven tasks.[6] Discontinued after XP, replaced by the "Attach task to this event" feature.

## Windows Vista

Event Viewer consists of a rewritten event tracing and logging architecture on Windows Vista.[1] It has been rewritten around a structured XML log-format and a designated log type to allow applications to more precisely log events and to help make it easier for support technicians and developers to interpret the events.

The XML representation of the event can be viewed on the Details tab in an event's properties. It is also possible to view all potential events, their structures, registered event publishers and their configuration using the wevtutil utility, even before the events are fired.

There are a large number of different types of event logs including Administrative, Operational, Analytic, and Debug log types. Selecting the Application Logs node in the Scope pane reveals numerous new subcategorized event logs, including many labeled as diagnostic logs.

Analytic and Debug events which are high frequency are directly saved into a trace file while Admin and Operational events are infrequent enough to allow additional processing without affecting system performance, so they are delivered to the Event Log service.

Events are published asynchronously to reduce the performance impact on the event publishing application. Event attributes are also much more detailed and show EventID, Level, Task, Opcode, and Keywords properties.

Users can filter event logs by one or more criteria or by a limited XPath 1.0 expression, and custom views can be created for one or more events. Using XPath as the query language allows viewing logs related only to a certain subsystem or an issue with only a certain component, archiving select events and sending traces on the fly to support technicians.

### Filtering using XPath 1.0

This section contains instructions, advice, or how-to content. The purpose of Wikipedia is to present facts, not to train. Please help improve this article either by rewriting the how-to content or by moving it to Wikiversity, Wikibooks or Wikivoyage. (August 2019)

|

1. Open Windows Event Log
2. Expand out Windows Logs
3. Select the log file that is of interest (In the example below, the Security event log is used)
4. Right-click on the Event Log and select Filter Current Log...
5. Change the selected tab from Filter to XML
6. Check the box to Edit query manually'
7. Paste the query into the text box. Sample queries can be found below.

Here are examples of simple custom filters for the new Window Event Log:

1. Select all events in the Security Event Log where the account name involved (TargetUserName) is "JUser"

`<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[EventData[Data[@Name="TargetUserName"]="JUser"]]</Select></Query></QueryList>`
2. Select all events in the Security Event Log where any Data node of the EventData section is the string "JUser"

`<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[EventData[Data="JUser"]]</Select></Query></QueryList>`
3. Select all events in the Security Event Log where any Data node of the EventData section is "JUser" or "JDoe"

`<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[EventData[Data="JUser" or Data="JDoe"]]</Select></Query></QueryList>`
4. Select all events in the Security Event Log where any Data node of the EventData section is "JUser" and the Event ID is "4471"

`<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[EventID="4471"]] and *[EventData[Data="JUser"]]</Select></Query></QueryList>`
5. Real-world example for a package called Goldmine which has two @Names

`<QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Provider[@Name='GoldMine' or @Name='GMService']]]</Select></Query></QueryList>`

Caveats:

* There are limitations to Microsoft's implementation of XPath[7]
* Queries using XPath string functions will result in error[8]

### Event subscribers

Major event subscribers include the Event Collector service and Task Scheduler 2.0. The Event Collector service can automatically forward event logs to other remote systems, running Windows Vista, Windows Server 2008 or Windows Server 2003 R2 on a configurable schedule. Event logs can also be remotely viewed from other computers or multiple event logs can be centrally logged and monitored without an agent and managed from a single computer. Events can also be directly associated with tasks, which run in the redesigned Task Scheduler and trigger automated actions when particular events take place.

## See also

* List of Microsoft Windows components
* Microsoft Management Console
* Technical support scam

## References

1. ↑ 1.0 1.1 "New tools for Event Management in Windows Vista". TechNet. Microsoft. November 2006. http://www.microsoft.com/technet/technetmag/issues/2006/11/EventManagement/.
2. ↑ Anderson, Nate (October 4, 2012). ""I am calling you from Windows": A tech support scammer dials Ars Technica" (in en-us). Ars Technica. https://arstechnica.com/tech-policy/2012/10/i-am-calling-you-from-windows-a-tech-support-scammer-dials-ars-technica/.
3. ↑ "AuthzInstallSecurityEventSource Function". MSDN. Microsoft. http://msdn2.microsoft.com/en-us/library/Aa376314.aspx.
4. ↑ LLC), Tara Meyer (Aquent. "Eventquery.vbs". https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/bb490900(v=technet.10).
5. ↑ LLC), Tara Meyer (Aquent. "Eventcreate". https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/bb490899(v=technet.10).
6. ↑ LLC), Tara Meyer (Aquent. "Eventtriggers". https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/bb490901(v=technet.10).
7. ↑ "Microsoft's Implementation and Limitations of XPath 1.0 in Windows Event Log". MSDN. Microsoft. http://msdn.microsoft.com/en-us/library/dd996910(VS.85).aspx#limitations.
8. ↑ "Powershell script to filter events using an Xpath query". http://www.open-a-socket.com/index.php/2009/04/.

## External links

* Official sources:
* Event Viewer - Inside Show on Microsoft Learn
* Events and Errors (Windows Server 2008) on Microsoft Learn

* v
* t
* e

Microsoft Windows components

Management
tools|

* App Installer
* Command Prompt
* Control Panel
* Applets
* Device Manager
* Disk Cleanup
* Disk Defragmenter
* Driver Verifier
* DxDiag
* Event Viewer
* IExpress
* Management Console
* Netsh
* Performance Monitor
* Recovery Console
* Resource Monitor
* Settings
* Sysprep
* System Configuration
* System File Checker
* System Information
* System Policy Editor
* System Restore
* Task Manager
* Windows Error Reporting
* Windows Ink
* Windows Installer
* PowerShell
* Windows Update
* Windows Insider
* WinRE
* WMI

Apps|

* Alarms & Clock
* Calculator
* Calendar
* Camera
* Character Map
* Cortana
* Edge
* Fax and Scan
* Feedback Hub
* File Manager
* Get Help
* Groove Music
* Magnifier
* Mail
* Messaging
* Maps
* Media Player
* Movies & TV
* Mobility Center
* Money
* News
* Narrator
* Notepad
* OneDrive
* OneNote
* Paint
* Paint 3D
* People
* Phone Companion
* Photos
* Quick Assist
* Snipping Tool
* Speech Recognition
* Skype
* Sports
* Sticky Notes
* View 3D
* Store
* Tips
* Voice Recorder
* Wallet
* Weather
* Windows To Go
* Windows Story Remix
* WordPad
* Xbox Console Companion
* Your Phone

Shell|

* Action Center
* Aero
* AutoPlay
* AutoRun
* ClearType
* Explorer
* Search
* Indexing Service
* IFilter
* Saved search
* Namespace
* Special folder
* Start menu
* Taskbar
* Task View
* Windows Spotlight
* Windows XP visual styles

Services|

* Service Control Manager
* BITS
* CLFS
* Multimedia Class Scheduler
* Shadow Copy
* Task Scheduler
* Error Reporting
* Wireless Zero Configuration

File systems|

* CDFS
* DFS
* exFAT
* IFS
* FAT
* NTFS
* Hard link
* Junction point
* Mount Point
* Reparse point
* Symbolic link
* TxF
* EFS
* ReFS
* UDF

Server|

* Domains
* Active Directory
* DNS
* Group Policy
* Roaming user profiles
* Folder redirection
* Distributed Transaction Coordinator
* MSMQ
* Windows Media Services
* Rights Management Services
* IIS
* Remote Desktop Services
* WSUS
* SharePoint
* Network Access Protection
* PWS
* DFS Replication
* Remote Differential Compression
* Print Services for UNIX
* Remote Installation Services
* Windows Deployment Services
* System Resource Manager
* Hyper-V
* Server Core

Architecture|

* Architecture of Windows NT
* Startup process
* NT
* Vista
* CSRSS
* Desktop Window Manager
* Portable Executable
* EXE
* DLL
* Enhanced Write Filter
* Graphics Device Interface
* hal.dll
* I/O request packet
* Imaging Format
* Kernel Transaction Manager
* Library files
* Logical Disk Manager
* LSASS
* MinWin
* NTLDR
* Ntoskrnl.exe
* Object Manager
* Open XML Paper Specification
* Registry
* Resource Protection
* Security Account Manager
* Server Message Block
* Shadow Copy
* SMSS
* System Idle Process
* USER
* WHEA
* Win32 console
* Winlogon
* WinUSB

Security|

* Security and Maintenance
* AppLocker
* BitLocker
* Credential Guard
* Data Execution Prevention
* Family Safety
* Kernel Patch Protection
* Mandatory Integrity Control
* Protected Media Path
* User Account Control
* User Interface Privilege Isolation
* Windows Defender
* Windows Firewall

Compatibility|

* COMMAND.COM
* Virtual DOS machine
* Windows on Windows
* WoW64
* Windows Subsystem for Linux

API|

* Active Scripting
* WSH
* VBScript
* JScript
* COM
* ActiveX
* ActiveX Document
* COM Structured storage
* DCOM
* OLE
* OLE Automation
* Transaction Server
* DirectX
* .NET Framework
* Universal Windows Platform
* Windows Mixed Reality
* Windows Runtime
* WinUSB

Games|

* Solitaire Collection

Discontinued|

| Games|

* 3D Pinball
* Chess Titans
* FreeCell
* Hearts
* InkBall
* Hold 'Em
* Purble Place
* Reversi
* Spider Solitaire
* Solitaire
* Tinker

|

Apps|

* ActiveMovie
* Anytime Upgrade
* Address Book
* Backup and Restore
* Cardfile
* CardSpace
* CD Player
* Contacts
* Desktop Gadgets
* Diagnostics
* DriveSpace
* DVD Maker
* Easy Transfer
* Fax
* Food & Drink
* Help and Support Center
* Health & Fitness
* HyperTerminal
* Internet Explorer
* Journal
* Media Center
* Meeting Space
* Messaging
* Messenger
* Mobile Device Center
* Movie Maker
* MSN Dial-up
* NetMeeting
* NTBackup
* Outlook Express
* Travel
* Photo Gallery
* Photo Viewer
* Program Manager
* Steps Recorder
* Syskey
* WinHelp
* Write

Others|

* ScanDisk
* File Protection
* Media Control Interface
* Next-Generation Secure Computing Base
* POSIX subsystem
* Interix
* Video for Windows
* Windows SideShow
* Windows Services for UNIX
* Windows System Assessment Tool
* WinFS

Spun off to
Microsoft Store|

* DVD Player
* Hover!
* Mahjong
* Minesweeper

* v
* t
* e

Windows command-line programs and shell builtins

* COMMAND.COM
* Command Prompt
* Windows PowerShell
* Recovery Console

File system navigation|

* cd (chdir)
* dir
* popd
* pushd
* tree

File management|

* attrib
* cacls
* cipher
* compact
* copy
* del (erase)
* deltree
* expand
* icacls
* makecab
* mkdir (md)
* mklink
* move
* recover
* ren (rename)
* replace
* rmdir (rd)
* robocopy
* tar
* xcopy

Disk management|

* chkdsk
* convert
* defrag
* diskcomp
* diskcopy
* diskpart
* drvspace
* fdisk
* format
* label
* manage-bde
* subst
* scandisk
* sys
* vol
* vssadmin

Processes|

* at
* exit
* kill
* powercfg
* runas
* sc
* schtasks
* shutdown
* start
* taskkill
* tasklist

Registry|

* assoc
* ftype
* reg
* regini
* regsvr32

User environment|

* date
* mode
* path
* set
* setx
* time
* title
* ver
* whoami

File contents|

* comp
* edit
* edlin
* fc
* find
* findstr
* print
* type

Scripting|

* choice
* clip
* cscript
* doskey
* echo
* for
* forfiles
* goto
* if
* more
* pause
* prompt
* rem
* timeout

Networking|

* arp
* BITSAdmin
* cURL
* getmac
* hostname
* ipconfig
* net
* netsh
* netstat
* nslookup
* PathPing
* ping
* route
* scp
* sftp
* ssh
* ssh-add
* ssh-agent
* ssh-keygen
* ssh-keyscan
* tracert
* winrm
* winrs

Maintenance and care|

* driverquery
* eventcreate
* eventtriggers
* msiexec
* ntbackup
* sfc
* systeminfo
* w32tm
* WBAdmin
* winsat
* wmic

Boot management|

* bcdedit
* bootcfg
* fixboot
* fixmbr

Software development|

* debug
* exe2bin
* QBasic

Miscellaneous|

* cls
* dism
* dpath
* gpupdate
* help
* MSCDEX
* pentnt
* wsl

* List of DOS commands
* Environment variables

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Event Viewer. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software:Event_Viewer&oldid=710535"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template