Event Viewer

The Event Viewer is a Microsoft Management Console (MMC) snap-in that enables you to browse and manage event logs. It is an indispensable tool for monitoring the health of systems and troubleshooting issues when they arise. For the latest information about Event Viewer, see Event Viewer online.

Event Viewer enables you to perform the following tasks:

  • View events from multiple event logs

  • Save useful event filters as custom views that can be reused

  • Schedule a task to run in response to an event

  • Create and manage event subscriptions

Viewing Events from Multiple Logs

When you use Event Viewer to troubleshoot a problem, you need to locate events related to the problem, regardless of which event log they appear in. Event Viewer enables you to filter for specific events across multiple logs. That makes it easy to display all events potentially related to an issue that you are investigating. To specify a filter that spans multiple logs, you need to create a custom view.

For detailed help with creating custom views, see the following topic:

  • Create a Custom View

Reusable Custom Views

When you work with Event Logs, your primary challenge is to narrow the set of events to just those that you are interested in. Sometimes this is easy. Other times this involves a great deal of effort; effort that is lost if you do not have some way to save the view of the logs that you worked so hard to create. Event Viewer supports the idea of custom views. Once you have queried and sorted your way to just the events you wanted to analyze, you can save that work as a named view and it will be available for you to reuse in the future. You can even export the view and use it on other computers or share it with other people.

For detailed help with view-related tasks, see the following topics:

  • Custom Views

  • Create a Custom View

  • Export a Custom View

  • Import a Custom View

Integration with Task Scheduler

Using Event Viewer, you can easily automate responses to events. Event Viewer is integrated with Task Scheduler, enabling you to right-click most events to start scheduling a task to run when that event is logged in the future.

For detailed help with associating tasks with events see:

  • Run a Task in Response to a Given Event

Event Subscriptions

You can collect events from remote computers and store them locally by specifying event subscriptions.

For detailed help with event subscriptions, see the following topic:

  • Event Subscriptions

Additional Resources

  • Event Logs

  • Event Properties

  • Online Event Information

  • Event Viewer How To...

  • Troubleshooting Event Viewer


Event Logs

Windows Vista includes two categories of event logs: Windows Logs and Applications and Services logs. You can use either the Event Viewer or the wevtutil command-line tool to manage event logs. When you use wevtutil to manage event logs, messages that you receive from wevtutil might refer to event logs as channels. In most cases, event logs and channels are equivalent. For more information about event logs and channels, see the Event Logs and Channels in Windows Event Log topic in the Windows Event Log Software Development Kit (SDK) online.

Windows Logs

The Windows Logs category includes the logs that were available on previous versions of Windows: the Application, Security, and System logs. It also includes two new logs: the Setup log and the ForwardedEvents log. Windows logs are intended to store events from legacy applications and events that apply to the entire system.

Application log

The Application log contains events logged by applications or programs. For example, a database program might record a file error in the application log. Program developers decide which events to log.

Security log

The Security log contains events such as valid and invalid logon attempts, as well as events related to resource use, such as creating, opening, or deleting files or other objects. Administrators can specify what events are recorded in the security log. For example, if you have enabled logon auditing, attempts to log on to the system are recorded in the security log.

Setup log

The Setup log contains events related to application setup.

System log

The System log contains events logged by Windows system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. The event types logged by system components are predetermined by Windows.

ForwardedEvents log

The ForwardedEvents log is used to store events collected from remote computers. To collect events from remote computers, you must create an event subscription. To learn about event subscriptions, see Event Subscriptions.

Applications and Services Logs

Applications and Services logs are a new category of event logs. These logs store events from a single application or component rather than events that might have systemwide impact.

This category of logs includes four subtypes: Admin, Operational, Analytic, and Debug logs. Events in Admin logs are of particular interest to IT Professionals using the Event Viewer to troubleshoot problems. Events in the Admin log should provide you with guidance about how to respond to them. Events in the Operational log are also useful for IT Professionals, but they are likely to require more interpretation.

Admin and Debug logs are not as user friendly. Analytic logs store events that trace an issue and, often, a high volume of events are logged. Debug logs are used by developers when debugging applications. Both Analytic and Debug logs are hidden and disabled by default. To make these logs visible, follow the steps in Show or Hide Analytic and Debug Logs. To enable these logs, follow the steps in Enable Analytic and Debug Logs.

Admin

These events are primarily targeted at end users, administrators, and support personnel. The events that are found in the Admin channels indicate a problem and a well-defined solution that an administrator can act on. An example of an admin event is an event that occurs when an application fails to connect to a printer. These events are either well documented or have a message associated with them that gives the reader direct instructions of what must be done to rectify the problem.

Operational

Operational events are used for analyzing and diagnosing a problem or occurrence. They can be used to trigger tools or tasks based on the problem or occurrence. An example of an operational event is an event that occurs when a printer is added or removed from a system.

Analytic

Analytic events are published in high volume. They describe program operation and indicate problems that cannot be handled by user intervention.

Debug

Debug events are used by developers troubleshooting issues with their programs.

XML-Based Infrastructure

The infrastructure that underlies event logging has been completely revamped in Windows Vista. Information about each event conforms to an XML schema, and you can access the XML representing a given event. You can also construct XML-based queries against event logs. You do not have to know anything about XML to leverage the new features available. The Event Viewer allows you to access the functionality in an easy-to-use graphical format.

Additional Resources

  • Display XML Format of a Custom View

  • Enable Analytic and Debug Logs

  • Show or Hide Analytic and Debug Logs


Event Properties

The following table lists the common event properties. For more information about event properties and the underlying XML schema, see the Event Representation for Event Consumers topic in the Windows Event Log Software Development Kit (SDK) online.

Property Name Description

Source

The software that logged the event, which can be either a program name, such as "SQL Server", or a component of the system or of a large program, such as a driver name. For example, "Elnkii" indicates an EtherLink II driver.

Event ID

A number identifying the particular event type. The first line of the description usually contains the name of the event type. For example, 6005 is the ID of the event that occurs when the Event Log service is started. The first line of the description of such an event is "The Event log service was started." The Event ID and the Source can be used by product support representatives to troubleshoot system problems.

Level

A classification of the event severity. The following event severity levels can occur in the system and application logs:

  • Information. Indicates that a change in an application or component has occurred, such as an operation has successfully completed, a resource has been created, or a service started.

  • Warning. Indicates that an issue has occurred that can impact service or result in a more serious problem if action is not taken.

  • Error. Indicates that a problem has occurred, which might impact functionality that is external to the application or component that triggered the event.

  • Critical. Indicates that a failure has occurred from which the application or component that triggered the event cannot automatically recover.

The following event severity levels can occur in the security log:

  • Success Audit. Indicates that the exercise of a user right has succeeded.

  • Failure Audit. Indicates that the exercise of a user right has failed.

In the Event Viewer normal list view, these are represented by a symbol.

User

The name of the user on whose behalf the event occurred. This name is the client ID if the event was actually caused by a server process or the primary ID if impersonation is not taking place. Where applicable, a security log entry contains both the primary and impersonation IDs. Impersonation occurs when the server allows one process to take on the security attributes of another.

Operational Code

Contains a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event. For example, initialization or closing.

Log

The name of the log where the event was recorded.

Task Category

Used to represent a subcomponent or activity of the event publisher.

Keywords

A set of categories or tags that can be used to filter or search for events. Examples include "Network", "Security", or "Resource not found."

Computer

The name of the computer on which the event occurred. The computer name is typically the name of the local computer, but it might be the name of a computer that forwarded the event or it might be the name of the local computer before its name was changed.

Date and Time

The date and time that the event was logged.

The following table lists the properties that can be displayed by adding columns to the Event Viewer display. For more information about adding columns to the display, see Show or Hide Event Properties.

Property Name | Description
Process ID | The identification number for the process that generated the event.
Thread ID | The identification number for the thread that generated the event.
Processor ID | The identification number for the processor that processed the event.
Session ID | The identification number for the terminal server session in which the event occurred.
Kernel Time | The elapsed execution time for kernel-mode instructions, in CPU time units.
User Time | The elapsed execution time for user-mode instructions, in CPU time units.
Processor Time | The elapsed execution time for user-mode instructions, in CPU ticks.
Correlation Id | Identifies the activity in the process for which the event is involved. This identifier is used to specify simple relationships between events.
Relative Correlation Id | Identifies a related activity in a process for which the event is involved.


Custom Views

In previous versions of Event Viewer, you could filter the events in an event log. To create a filter, you specified a set of rules that were used to determine which events in the log would be visible and which would be hidden. You could, for instance, specify that only events with a level value of Error or Warning should be visible.

The ability to filter events is crucial. You need to focus your attention on only those events that apply to the issue you are investigating. The latest version of Event Viewer extends the filtering concept beyond a single event log. It enables you to create a set of rules which select events from the sources you specify and show only the events from those sources whose property values satisfy the rules.

Creating a filter that displays only the events you are interested in for a particular issue can be time-consuming. Custom Views provide a way for you to save that work. Once you have created a filter that displays just the records you are interested in, you can provide the filter with a name and save it to use later. That saved filter is a Custom View.

Additional Resources

  • Create and Manage Custom Views


Event Subscriptions

Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers.

Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.

Using the event collecting feature requires that you configure both the forwarding and the collecting computers. The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting process. To learn about the steps required to configure event collecting and forwarding computers, see Configure Computers to Forward and Collect Events.

Additional Considerations

  • You can subscribe to receive events from an existing subscription on a remote computer.

Additional Resources

  • Configure Computers to Forward and Collect Events

  • Create a New Subscription


Online Event Information

Logged events include a Uniform Resource Locator (URL) link to a Microsoft Web site or a Web site that you can define. When you view an event, you can click Event Log Online Help, which sends a request in the form of a query to obtain additional information about the event. The data that is sent is limited to only what is needed to retrieve more information about the event. For more information, please read our privacy statement online.

If you want to define the URL that is associated with the Event Log Online Help link to reference a Web site other than the Microsoft Web site, you can either define the URL in the registry or you can define the URL in an instrumentation manifest for a publisher. If you define the URL in the registry, the link that you use will be the same for all events that are published on the computer where the registry is located. A URL that is defined in the registry will override all URLs defined in instrumentation manifests for publishers.

When you click Event Log Online Help, the following parameters are included with the URL and are passed to the Web site:

Parameter | Description
Product Name | The name of the product that is associated with the publisher of the event.
Product Version | The version of the product that is defined in the Product Name parameter.
Event ID | The identification number that was assigned to the event.
Event Source | The name of the log where the event was published.
Locale ID | The identification number for the locale of the computer where the event originated.

Define the URL in the Registry

You can modify both the URL associated with the Event Log Online Help link and the program that is used to display the results returned from the Web site that is defined in the URL. The configuration settings are stored in the registry under the HKLM\Software\Microsoft\Windows NT\CurrentVersion\EventViewer\registry key.

The following list describes the registry entries that appear under that key and how they enable you to configure the behavior of the event log online help.

Registry Entry | Description
MicrosoftRedirectionProgram | Specifies the program that is used to display the information that is returned from the Web site that is associated with the Event Log Online Help link.
MicrosoftRedirectionProgramCommandLineParameters | Specifies the parameters that are passed to the program that is specified in the MicrosoftRedirectionProgram entry.
MicrosoftRedirectionURL | Specifies the URL that is associated to the Event Log Online Help link. The default value of the entry is: http://go.microsoft.com/fwlink/events.asp.

Define the URL in an Instrumentation Manifest

You can define the URL for the Event Log Online Help link in an instrumentation manifest. To define a URL in an instrumentation manifest you must add the helpLink attribute to the provider element. The following example shows a helpLink attribute defined for a provider.

<provider name="Microsoft-Windows-EventLogSamplePublisher"
guid="{1db28f2e-8f80-4027-8c5a-a11f7f10f62d}"
symbol="MICROSOFT_SAMPLE_PUBLISHER"
resourceFileName="C:\temp\Publisher.exe"
messageFileName="C:\temp\Publisher.exe"
helpLink="http://www.contoso.com">

For more information about instrumentation manifests, see Instrumentation Manifests for Event Publishers.


Event Viewer How To...

The topics in the following list contain information and step-by-step procedures that explain how to use the Event Viewer user interface and the wevtutil command line tool to manage events and event logs.

  • Start Event Viewer

  • Create and Manage Custom Views

  • Organize Event Presentation

  • Manage Event Logs

  • Manage Subscriptions

  • Work with Event Logs on a Remote Computer

  • Run a Task in Response to a Given Event


Start Event Viewer

The Event Viewer is a Microsoft Management Console (MMC) snap-in. You can start Event Viewer by adding the snap-in to MMC or by double-clicking the snap-in file, Eventvwr.msc, which is located in the %SYSTEMROOT%\system32 folder. In addition, Event Viewer can be started from the Windows interface or the command line by using the following procedures.

To start Event Viewer by using the Windows interface

  1. Click the Start button.

  2. Click Control Panel.

  3. Click System and Maintenance.

  4. Click Administrative Tools.

  5. Double-click Event Viewer.
To start Event Viewer by using a command line

  1. Open a command prompt. To open a command prompt, click Start, click All Programs, click Accessories and then click Command Prompt.

  2. Type eventvwr.

The eventvwr.exe command-line tool supports options that determine the computer the snap-in will connect to and the event logs it will display. When connecting to a computer running a previous version of Windows, the tool can be used to start the snap-in and connect to the remote computer, but the additional command-line options are ignored.

To display additional help for the eventvwr command-line tool, type the following command at a command prompt: eventvwr /?

Additional Resources

  • Work with Event Logs on a Remote Computer


Create and Manage Custom Views

Custom views are like filters that have been named and saved. After creating and saving a custom view, you will be able to reuse it without re-creating its underlying filter. To reuse a custom view, navigate to the Custom Views category in the console tree and select the name of the custom view. By selecting the custom view, you apply the underlying filter and the results are displayed. You can import and export custom views, enabling you to share them between users and computers.

The following topics describe how to create and manage custom views:

  • Create a Custom View

  • Export a Custom View

  • Import a Custom View

  • Display XML Format of a Custom View

  • Save Filter as a Custom View


Create a Custom View

You can create a filter that includes events from multiple event logs that satisfy specified criteria. You can then name and save that filter as a custom view. To apply the filter associated with a saved custom view, you navigate to the custom view in the console tree and click its name.

To create a custom view

  1. Start Event Viewer.

  2. On the Action menu, click Create Custom View.

  3. To filter events based upon when they occurred, select the corresponding time period from the Logged drop-down list.

    Note

    If none of the options are acceptable, choose Custom range. In the Custom range dialog box, specify the earliest date and time from which you want events and the latest date and time from which you want events. Click OK.

  4. In Event level, select the check boxes next to the event levels that you want included in the custom view.

  5. You can either specify the event logs or the event sources of the events that will appear in the custom view.

    • To specify the event logs: Select the Event Log option and, in the Event log drop-down list, select the check boxes next to the event logs from which you want to include events.

    • To specify the event sources: Select the Event Source option and, in the Event source drop-down list, select the check boxes next to the event sources in the drop-down list that you want to include in the custom view.

  6. In Event IDs, type the event IDs that you want your custom view to display. Separate multiple event IDs by commas. If you want to include a range of IDs, say 4624 through 4634 inclusive, type 4624-4634. If you want your filter to display events with all IDs except certain ones, type the IDs of those exceptions, preceded by a minus sign. For example, to include all IDs between 4624 and 4634 except for 4630, type 4624-4634,-4630.

  7. In Task Category, select the check boxes next to the task categories in the drop-down list that you want included in the custom view.

  8. In Keywords, select the check boxes next to the keywords in the drop-down list that you want included in the custom view.

  9. In User, enter the name of the user accounts you want to display. Enter multiple users by separating them with a comma (,).

  10. In Computer(s), enter the name of the computers that you want your custom view to display. Enter multiple computers by separating them with a comma (,).

  11. Click OK.

  12. On the Save Filter to Custom View dialog box, in Name, type a name for the custom view.

  13. In Description, type an optional description of the custom view.

  14. Select the folder in which you want to store the custom view.

    Note

    Custom views can be stored in the Custom Views folder or any subfolder of the Custom Views folder. You can create new subfolders in the Custom Views folder by selecting it and clicking New Folder.

  15. You can make the Custom View accessible to anyone using the computer or only to someone logged on to your current account.

    • To save the custom view and make it accessible to anyone using the computer: Ensure the All Users check box is selected and click OK.

    • To save the custom view and make it accessible only to someone logged on to your current account: Ensure that the All Users check box is not selected and click OK.

Additional Considerations

  • Leaving a field in the Create Custom View dialog box blank specifies that you want your filter to display entries with any value of the corresponding property.

Additional Resources

Custom Views


Export a Custom View

Custom views can be exported as XML files with an XML file name extension. The resulting XML files can be imported using Event Viewer. This allows custom views to be shared between users and computers.

To export a custom view

  1. Start Event Viewer.

  2. In the console tree, select the custom view you want to export.

  3. In the Actions pane, click Export Custom View.

  4. In the Save As dialog box, select a folder, enter a File name for the exported file, and then click Save.

Additional references

Create and Manage Custom Views


Import a Custom View

Custom views can be exported as XML files with an XML file name extension. The resulting XML files can be imported using Event Viewer. This allows custom views to be shared between users and computers.

To import a custom view

  1. Start Event Viewer.

  2. On the Action menu, click Import Custom View.

  3. Navigate to the location of the exported view, click the corresponding .xml file and click Open.

  4. On the Import Custom View File dialog box, in Name, enter a name for the imported custom view.

  5. In Description, enter a description of the custom view.

  6. Select the folder in which you want to store the custom view.

    Note

    Custom views can be stored in the Custom Views folder or any subfolder of the Custom Views folder. You can create new subfolders in the Custom Views folder by selecting it and clicking New Folder.

  7. If you want the custom view to be accessible to anyone using the computer, ensure the All Users check box is selected and click OK. If you want the custom view to be accessible only to someone logged on to your current account, ensure that the All Users check box is not selected and click OK.

Additional references

Create and Manage Custom Views


Display XML Format of a Custom View

Custom Views are named filters that you can reuse between sessions of Event Viewer. Like other event log filters, a custom view has an XML-based representation. After creating a custom view using the Event Viewer user interface, you can then display and examine the XML that represents the underlying query. This is a convenient way to learn about the XML syntax.

To display the XML format underlying a custom view

  1. Start Event Viewer.

  2. In the console tree, navigate to and select the custom view.

  3. On the Action menu, click Properties.

  4. On the properties dialog, click Edit Filter.

  5. In the Custom View Properties dialog box, click the XML tab. The XML query for the custom view appears in the text box.

Additional Resources

Custom Views


Save Filter as a Custom View

You can save a filter as a Custom View so that you can use it again without having to recreate it.

To save a filter to reuse later

  1. Start Event Viewer.

  2. Follow the steps in Filter Displayed Events.

  3. On the Action menu, click Save Filter As Custom View.

  4. In Name, type the name that you want to use to access the custom view in the future.

  5. In Description, type a description of the custom view.

  6. In the console tree, select the location where you want the saved filter to be stored.

  7. To allow all users of the computer to access the view, ensure that the All Users check box is selected. To only allow the currently logged on user to access the view, ensure that the All Users check box is not selected.

  8. Click OK.

Additional Resources

  • Create a Custom View

  • Filter Displayed Events


Organize Event Presentation

Once you have selected the set of events that you are interested in, Event Viewer lets you customize the way those events are presented. You can sort and group events and their properties in various ways, as described in the following topics:

  • Filter Displayed Events

  • Group Events by a Given Property

  • Sort Events by a Given Property

  • Show or Hide Event Properties

  • Show or Hide Analytic and Debug Logs

  • Change Order of Event Properties


Filter Displayed Events

When viewing an event log, you can filter the events being displayed. Event filtering is designed to be temporary and an applied filter can easily be removed. However, if you create a useful filter that you want to reuse, you can save it as a custom view.

To filter displayed events

  1. Start Event Viewer.

  2. In the console tree, select the event log you want to filter.

  3. On the Action menu, click Filter Current Log.

  4. To filter events based on when they occurred, select the corresponding time period from the Logged drop-down list.

    Note

    If none of the options are acceptable, choose Custom range. In the Custom range dialog box, specify the earliest date and time from which you want events and the latest date and time from which you want events. Click OK.

  5. In Event level, select the check boxes next to the event levels that you want the filter to display.

  6. In the Event source drop-down list, select the check boxes next to the event sources that you want your filter to display.

  7. In Event IDs, type the event IDs that you want your filter to display. Separate multiple event IDs by commas. If you want to include a range of IDs, say 4624 through 4634 inclusive, type 4624-4634. If you want your filter to display events with all IDs except certain ones, type the IDs of those exceptions, preceded by a minus sign. For example, to include all IDs between 4624 and 4634 except for 4630, type 4624-4634,-4630.

  8. In Task Category, select the check boxes next to the task categories in the drop-down list that you want your filter to display.

  9. In the Keywords drop-down list, select the check boxes next to the keywords that you want your filter to display.

  10. In User, enter the name of the user accounts you want your filter to display. To enter multiple user accounts, separate them with a comma (,).

  11. In Computer(s), enter the name of computers that you want the filter to display. This field refers to the source computer of the event. Enter multiple computers by separating them with a comma (,).

  12. Click OK to apply the filter.

Additional Considerations

  • To remove a currently applied filter, on the Action menu, click Clear Filter.

  • Leaving a field in the Filter Current Log dialog box blank specifies that you want the filter to display entries with any value of the corresponding property.

  • You cannot filter on an Event source, Task category, or Keyword that has not yet appeared in the log you are filtering.

  • Filters apply to a single event log. If you want to filter across event logs, you must create a custom view.

Additional Resources

Save Filter as a Custom View


Group Events by a Given Property

You can conveniently view all events that share the same value for a given event property. For example, you can view all the events that originated from the same source or all the Warning level events.

You can sort events by property, but the resulting groupings might be large and difficult to navigate. If you run into that limit with sorting, you can instead use the grouping feature of Event Viewer. When you group events, a descriptive heading appears in the list control above each group. Although all members of all groups are visible by default, you can collapse and expand each distinct group by double-clicking the corresponding group heading.

To group events according to a given property

  1. Start Event Viewer.

  2. In the console tree, navigate to and select an event log, custom view, or saved log.

  3. In the header in the event list, right-click the column header that represents the property you want to group by and click Group events by this column.

Additional Considerations

  • To remove a grouping, right-click anywhere on the header of any column and click Remove grouping of events.

  • Event Viewer supports only one level of grouping. However, after grouping a set of events, you can then sort the resulting groups by column.

  • Grouping functionality works regardless of the source of the event records. As long as you are able to load a set of events, you can group them.

Additional Resources

  • Sort Events by a Given Property


Sort Events by a Given Property

You can sort any set of events that you are currently viewing by a single event property.

To sort events by a given property

  1. Start Event Viewer

  2. In the console tree, click the event log, custom view, or saved log that you want to sort.

  3. Click the column heading you want to sort by.

Additional Considerations

  • To reverse the sort order, click the column heading a second time.

  • When a log is archived, the sort order is not saved.

Additional Resources

  • Group Events by a Given Property

  • Archive an Event Log


Show or Hide Event Properties

You can customize how Event Viewer displays events by selecting only properties you are interested in viewing.

To show or hide event properties

  1. Start Event Viewer

  2. In the console tree, select an event log, custom view, or saved log.

  3. On the View menu, click Add/Remove columns.

  4. In the Add/Remove Columns dialog box, select the event properties you want to show from the Available columns list box and click Add. Select the event properties you want to hide from the Displayed columns list box and click Remove.

  5. Click OK.

Additional Considerations

  • Property visibility is retained between sessions.

  • You cannot hide the Level event property.

Additional Resources

  • Event Properties

  • Change Order of Event Properties


Show or Hide Analytic and Debug Logs

Analytic and Debug logs are disabled and hidden by default. To work with them, you need to first make them visible in the UI.

To show or hide analytic and debug logs

  1. Start Event Viewer.

  2. Click the View menu. If Show Analytic and Debug Logs is selected, Analytic and Debug logs are already visible. No further action is required. If Show Analytic and Debug Logs is not selected, select Show Analytic and Debug Logs to make these logs visible. Note that a check mark should appear to the left of the menu option.

Additional Resources

  • Enable Analytic and Debug Logs

  • Event Logs


Change Order of Event Properties

You can customize how Event Viewer displays events by configuring the order in which properties appear in the details pane.

To change the order of event properties

  1. Start Event Viewer.

  2. In the console tree, navigate to and select an event log, custom view, or saved log.

  3. On the View menu, click Add/Remove Columns.

  4. On the Add/Remove Columns dialog box, in Displayed columns, click the event property you want to reorder.

  5. Use the Move Up and Move Down buttons to position the property.

  6. Click OK.

Additional Considerations

  • Properties at the top of the Displayed columns list will appear on the left side of the details pane.

  • Property order is retained between sessions.

Additional Resources

  • Event Properties

  • Show or Hide Event Properties


Manage Event Logs

You can use Event Viewer to manage various aspects of your event logs. To do so, you typically: navigate to and select the event log to manage, right-click and select Properties to access its properties dialog, and then update the appropriate values.

You can perform the following log management tasks by using Event Viewer:

  • Clear an Event Log

  • Set Maximum Log Size

  • Set Log Retention Policy

  • Enable Analytic and Debug Logs

  • Archive an Event Log

  • Open or Close a Saved Log

You can also use the wevtutil.exe command line tool to manage your event logs. Where applicable, the preceding topics include information about how to accomplish the task from the command line. To learn more about the wevtutil.exe command-line tool, type wevtutil /? at a command prompt.


Clear an Event Log

You can clear events in an event log by using Event Viewer or by using the wevtutil command on a command line.

To clear an event log by using Event Viewer

  1. Start Event Viewer.

  2. In the console tree, navigate to the event log you want to clear.

  3. On the Action menu, click Clear Log.

  4. You can either clear the event log or save a copy of the event log and then clear it.

    • To clear the event log without saving: Click Clear.

    • To clear the event log after saving: Click Save and Clear, type a name for the saved file in File name on the Save As dialog box and click Save.
To clear an event log by using a command line

  1. To open a command prompt, click Start, type cmd in the Start Search box, and then press Enter.

  2. Type the following command:

    wevtutil cl <LogName> [/bu: <backup_file_name>]

To learn more about the clear log option of the wevtutil command-line tool, type the following command at a command prompt:

wevtutil cl -?

Additional considerations

  • You must have Clear permission on the log to perform this operation. By default, Administrators have permission to clear event logs. To set the Clear permission on a log for other groups, type the following command at a command prompt:

    wevtutil sl <LogName> /ca:<SecurityDescriptor>
    The Security Descriptor for each log is specified by using Security Descriptor Definition Language (SDDL) syntax. For more information about SDDL syntax, see Security Descriptor Definition Language at the MSDN Web site.

    To construct an SDDL string, note that there are three distinct rights that pertain to event logs: Read, Write, and Clear. These rights correspond to the following bits in the access rights field of the ACE string:

    • 1= Read

    • 2 = Write

    • 4 = Clear

    To see the SDDL string for a log, type the following command at a command prompt:

    wevtutil gl <LogName>
    The following example shows how to add Clear permission to the Application log for the Backup Operators group (A;;0x4;;;BO):

    wevtutil sl Application /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x4;;;BO)

Additional references

  • Archive an Event Log

  • Command-line syntax notation


Set Maximum Log Size

Event logs are stored in files. These files have a default maximum size, which you can change. You can perform this procedure by using the Windows interface or a command line.

To set maximum log size by using the Windows interface

  1. Start Event Viewer.

  2. In the console tree, navigate to and select the event log you want to manage.

  3. On the Action menu, click Properties.

  4. In Maximum log size (KB), use the spinner control to set the value you want and click OK.
Note

Log size must be a multiple of 64KB and cannot be smaller than 1024KB. If you type a log size rather than use the spinner control, it will be rounded to the nearest multiple of 64KB.
To set maximum log size by using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and click OK.

  2. Type the following command:

    wevtutil sl <LogName> /ms:<MaxSizeInBytes>

To view the complete syntax for this command, type the following at a command prompt:

wevtutil sl -?

Additional considerations

  • You must be a member of the Administrators group to set a maximum log size.

  • If you set a maximum log size that is smaller than the current size of the log, the maximum size will not be enforced until after the log is cleared.

Additional references

  • Command-line syntax notation


Set Log Retention Policy

Events are stored in a log file that can grow only to a configurable maximum size. After the file has reached its maximum size, what happens to incoming events is determined by the log retention policy. The available log retention policies are as follows:

Retention Policy | Description
Overwrite events as needed. | New events continue to be stored when the log file is full. Each new incoming event replaces the oldest event in the log.
Archive the log when full, do not overwrite events. | The log is automatically archived when necessary. No events are overwritten.
Do not overwrite events. (Clear logs manually.) | Clear the log manually rather than automatically.

You can set the log retention policy by using the Windows interface or the Wevtutil command-line tool.

To set the log retention policy by using the Windows interface

  1. Start Event Viewer.

  2. In the console tree, navigate to and select the event log you want to manage.

  3. On the Action menu, click Properties.

  4. In the Enable Logging section of the General tab, select the option that corresponds to the retention policy you want to set.

  5. Click OK.
To set the retention policy by using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and click OK.

  2. Type the following command:

    wevtutil sl <LogName> /r:{true | false} /ab:{true | false}

The 'r' parameter specifies whether to retain the log and the 'ab' parameter specifies whether to automatically back up the log. The following list shows the parameter values of the Wevtutil command-line tool that correspond to each of the above retention policies.

  • Overwrite events as needed: r = false, ab = false

  • Archive the log when full, do not overwrite events: r = true, ab = true

  • Do not overwrite events. (Clear logs manually.): r = true, ab = false

To view the complete syntax for this command, type the following command:

wevtutil sl -?

Additional considerations

  • You must be a member of the Administrators group to set the log retention policy.

Additional references

  • Command-line syntax notation


Enable Analytic and Debug Logs

Analytic and Debug logs are disabled by default. When enabled, they can quickly fill with a large number of entries. For this reason, you will probably want to turn them on for a specified period to gather some troubleshooting data and then turn them off again. You can perform this procedure by using either the Windows interface or a command line.

To enable Analytic and Debug logs by using the Windows interface

  1. Start Event Viewer.

  2. Ensure that Analytic and Debug logs are visible by following the steps in Show or Hide Analytic and Debug Logs.

  3. In the console tree, navigate to and select the Analytic or Debug log you want to enable.

  4. On the Action menu, click Properties.

  5. On the properties dialog box, select Enable logging and click OK.
To enable Analytic and Debug logs by using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and click OK.

  2. Type the following text:

    wevtutil sl <logname> /e:true

Additional references

  • Show or Hide Analytic and Debug Logs

  • Command-line syntax notation


Archive an Event Log

You can manually save the events in an event log using the following procedure. In addition, certain log retention policies may save events automatically. When you save events, you can include display information that will enable the saved events to be viewed on another computer and you can include information that will enable the saved events to be viewed in a different language.

To export and archive an event log

  1. Start Event Viewer.

  2. In the console tree, navigate to the log you want to archive.

  3. On the Action menu, click Save Events As.

  4. In File name, enter a name for the archived log file.

  5. In Save as type, select a file format, and then click Save.

  6. (Optional) In the Display Information dialog box, if the event log information is not intended to be viewed on another computer, accept the default of No display information.

  7. (Optional) In the Display Information dialog box, if the event log information is intended to be viewed on another computer, click Display information for these languages.

  8. (Optional) If the event log information is intended to be viewed in a different language, select the Show all available languages check box.

  9. (Optional) Select the language check boxes for which you want to include language information.

  10. Click OK.
To export and archive an event log using a command line

  1. To open a command prompt, click Start, type cmd, in the Start Search box, and then press Enter.

  2. To export the log to a file, type the following command:

    wevtutil epl <LogName> <FileName.evtx>

  3. To archive the log with display information, type the following command:

    wevtutil al <FileName.evtx> [/l:<LocaleString>]

To view the complete syntax for the wevutil command with the epl option, type the following at a command prompt:

wevtutil epl /?

To view the complete syntax for the wevutil command with the epl option, type the following at a command prompt:

wevtutil al /?

Additional Considerations

  • If you archive a log in .evtx file format, you can reopen it in Event Viewer.

  • Archiving does not delete the contents of the log.

  • The sort order is not retained when logs are saved.

  • If you archive a log that is filtered, only the records that satisfy the filter will be saved.

  • To troubleshoot events that were logged on a remote computer, you must export and archive the log with the display information. The display information for the saved events is stored in the LocaleMetaData folder and should be moved with the log information when the information is viewed on another computer.

Additional Resources

  • Set Log Retention Policy


Open or Close a Saved Log

You can open and view a log that has been archived using Event Viewer. You can open multiple saved logs and access them at anytime in the console tree. A log that has been opened in Event Viewer can be closed without deleting the information in the log.

To open a saved event log

  1. Start Event Viewer.

  2. In the Actions menu, click Open Saved Log.

  3. In the Look in box, select the folder where the log file is located.

  4. Select the log file, and then click Open.

  5. (Optional) In the Name box, enter a new name that will be used for the log in the console tree or you can use the existing name of the log file.

    Note

    If you enter a name that is different than the log file name, the name is only used to represent the log in the console tree and does not change the name of the log file.

  6. (Optional) In the Description box, enter a description for the log. The description will appear in the center pane when you click the parent folder of the log in the console tree.

  7. (Optional) Click New Folder, enter the name for the folder where the opened log will be located, and then click OK. If you do not select a parent folder, the new folder will be located in Saved Logs.

  8. (Optional) If you are an administrator on the computer, you can click to clear the All Users checkbox if you do not want the opened log to be available to other users when Event Viewer is started. If you do not clear the checkbox, the opened log will be available to all users and they will not be able to remove it from the console tree unless they have administrator rights.

  9. Select the location where you want the log to be located in the console tree. You must place the log in the Saved Logs folder or a new folder under the Saved Logs folder.

  10. Click OK.

You can close a log by deleting the log from the console tree.

Important

When you delete the log, you are only removing it from the console tree; you are not deleting the log file from the system.

To remove an open log from the console tree

  1. Start Event Viewer if it is not already running.

  2. Select the log that you want to remove from the console tree.

  3. In the Actions menu, click Delete. You can also right-click the log in the console tree and then click Delete, or you can click the log in the console tree and press the Delete key.

  4. Click Yes.

Additional resources

Manage Event Logs


Manage Subscriptions

You can collect events from remote computers and store them in logs on the local computer. You specify the specific events to collect by creating a subscription. The following topics describe how to work with event subscriptions.

  • Configure Computers to Forward and Collect Events

  • Create a New Subscription

  • Configure Advanced Subscription Settings


Configure Computers to Forward and Collect Events

Before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source). Updated information about event subscriptions may be available online at Event Subscriptions.

To configure computers in a domain to forward and collect events

  1. Log on to all collector and source computers. It is a best practice to use a domain account with administrative privileges.

  2. On each source computer, type the following at an elevated command prompt:

    winrm quickconfig
    Note

    If you intend to specify an event delivery optimization of Minimize Bandwidth or Minimize Latency, then you must also run the above command on the collector computer.

  3. On the collector computer, type the following at an elevated command prompt:

    wecutil qc

  4. Add the computer account of the collector computer to the local Administrators group on each of the source computers.

    Note

    By default, the Local Users and Groups MMC snap-in does not enable you to add computer accounts. In the Select Users, Computers, or Groups dialog box, click the Object Types button and select the Computers check box. You will then be able to add computer accounts.

  5. The computers are now configured to forward and collect events. Follow the steps in Create a New Subscription to specify the events you want to have forwarded to the collector.

Additional Considerations

  • In a workgroup environment, you can follow the same basic procedure described above to configure computers to forward and collect events. However, there are some additional steps and considerations for workgroups:

    • You can only use Normal mode (Pull) subscriptions.

    • You must add a Windows Firewall exception for Remote Event Log Management on each source computer.

    • You must add an account with administrator privileges to the Event Log Readers group on each source computer. You must specify this account in the Configure Advanced Subscription Settings dialog when creating a subscription on the collector computer.

    • Type winrm set winrm/config/client @{TrustedHosts="<sources>"} at a command prompt on the collector computer to allow all of the source computers to use NTLM authentication when communicating with WinRM on the collector computer. Run this command only once. Where <sources> appears in the command, substitute a list of the names of all of the participating source computers in the workgroup. Separate the names by commas. Alternatively, you can use wildcards to match the names of all the source computers. For example, if you want to configure a set of source computers, each with a name that begins with "msft", you could type this command winrm set winrm/config/client @{TrustedHosts="msft*"} on the collector computer. To learn more about this command, type winrm help config.

  • If you configure a subscription to use the HTTPS protocol by using the HTTPS option in Advanced Subscription Settings, you must also set corresponding Windows Firewall exceptions for port 443. For a subscription that uses Normal (PULL mode) delivery optimization, you must set the exception only on the source computers. For a subscription that uses either Minimize Bandwidth or Minimize Latency (PUSH mode) delivery optimizations, you must set the exception on both the source and collector computers.

  • If you intend to specify a user account by using the Specific User option in Advanced Subscription Settings when creating the subscription, you must ensure that account is a member of the local Administrators group on each of the source computers in step 4 instead of adding the machine account of the collector computer. Alternatively, you can use the Windows Event Log command-line utility to grant an account access to individual logs. To learn more about this command-line utility, type wevtutil sl -? at a command prompt.


Create a New Subscription

To receive forwarded events on a computer, you must set up one or more event subscriptions. Before setting up a subscription, you must configure both the computer that will receive the forwarded events, and the computer or computers that will forward the events. To learn how to configure the computers, see Configure Computers to Forward and Collect Events.

Once you have configured the computers, you create a subscription to specify which events to collect.

To create a new subscription

  1. On the collector computer, run Event Viewer as an administrator.

  2. Click Subscriptions in the console tree.

    Note

    If the Windows Event Collector service is not started, you will be prompted to confirm that you want to start it. This service must be started to create subscriptions and collect events. You must be a member of the Administrators group to start this service.

  3. On the Actions menu, click Create Subscription.

  4. In the Subscription Name box, type a name for the subscription.

  5. In the Description box, enter an optional description.

  6. In the Destination Log box, select the log file where collected events are to be stored. By default, collected events are stored in the ForwardedEvents log.

  7. Click Add and select the computers from which events are to be collected.

    Note

    After adding a computer, you can test connectivity between it and the local computer by selecting the computer and clicking Test.

  8. Click Select Events to display the Query Filter dialog box. Use the controls in the Query Filter dialog box to specify the criteria that events must meet to be collected.

  9. Click OK on the Subscription Properties dialog box. The subscription will be added to the Subscriptions pane and, if the operation was successful, the Status of the subscription will be Active.

Events raised on the forwarder computers that meet the criteria of the subscription will be copied to the collector computer log specified in step 6.

Additional Considerations

  • You cannot use Event Viewer to create a subscription while it is connected to a remote computer.

  • You can use the filter from a previously defined Custom View by choosing Copy from existing Custom View. Additionally, you can paste an XPATH query into the text box on the XML tab of the Query Filter dialog box.

  • If a newly created subscription does not activate, you can open the Subscription Properties dialog box and select individual source computers to view the status for each of them.

Additional Resources

  • Configure Computers to Forward and Collect Events

  • Configure Advanced Subscription Settings


Configure Advanced Subscription Settings

You can configure how collected events are delivered and specify the account used to manage the process of collecting events. Event Viewer provides three event delivery optimization options: Normal, Minimize Bandwidth and Minimize Latency. The following table lists each option along with a description of when it is an appropriate choice.

Event Delivery Optimization Options | Description
Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes.
Minimize Bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours.
Minimize Latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds.

The Custom event delivery option is never used when managing subscriptions created by using the Event Viewer snap-in. The Event Viewer can only create subscriptions with event delivery settings that correspond to the Normal, Minimize Bandwidth or Minimize Latency options. However, you can use Event Viewer to manage a subscription that was created or updated by using a different method, like the wecutil command-line tool. In that case, the Custom option is selected to indicate that the set of delivery settings of the subscription do not correspond to any of those supported by Event Viewer.

To configure advanced subscription settings

  1. Perform steps 1—6 of the Create a New Subscription procedure.

  2. Click Advanced.

  3. On the Advanced Subscription Settings dialog box, you can either specify an event delivery optimization or specify the account used to manage the process of collecting events.

    • To specify an event delivery optimization: Select the Event Delivery Optimization option you want and click OK.

    • To specify the account used to manage the process of collecting events, select the Specific User option, then click User and Password and enter the user name and password of the account and click OK. Click OK on the Advanced Subscription Settings dialog box.

Additional Considerations

The Minimize Bandwidth and Minimize Latency options both batch a default number of items at a time. You can determine the value of this default by typing the following command at a command prompt:

winrm get winrm/config.

You can change the default number of items in a batch by typing the following command at a command prompt:

winrm set winrm/config @{MaxBatchItems=<NumberOfItems>}

The following example shows how to change the default number of batched items to five:

winrm set winrm/config @{MaxBatchItems="5"}

Additional Resources

  • Event Subscriptions

  • Configure Computers to Forward and Collect Events

  • Create a New Subscription


Work with Event Logs on a Remote Computer

You can use the Event Viewer or the wevtutil command at a command prompt to manage event logs on a remote computer.

To use Event Viewer to manage event logs on a remote computer

  1. Start Event Viewer.

  2. Click the root node, for example Event Viewer (Local), in the console tree.

  3. On the Action menu, click Connect to Another Computer.

  4. In the Another computer box, type the name or IP address of the remote computer.

  5. (Optional) Select Connect as another user, click Set User, enter the User name and Password, end then click OK.

  6. Click OK.
To use wevtutil to manage event logs on a remote computer

  1. To open a Command Prompt window, click Start, in the Start Search box, type cmd, and then press Enter.

  2. Type the following command in the Command Prompt window:

    wevtutil <command> /r:<remote_computer_name>

  3. (Optional) To manage event logs on a remote computer as a different user, type the following command in the Command Prompt window:

    wevtutil <command> /r:<remote_computer_name> /u:<user_name> /p:<password>

Additional considerations

  • You must enable the Remote Event Log Management exception in the Windows Firewall Settings on the remote computer to which you want to connect.

  • You can type eventvwr <remote_computer_name> in a Command Prompt window to start Event Viewer and connect to a remote computer. You can also include options that enable Event Viewer to start with a specified Custom View or with a particular log selected. To learn more about the eventvwr command, type eventvwr /? in a Command Prompt window. Although you can use the eventvwr command to start Event Viewer and connect to computers running previous versions of Windows, any options specified will be ignored.

  • When connected to a remote computer, Custom Views displayed by the Event Viewer are the Custom Views stored on the local computer. If you click one of those local Custom Views, the underlying query will be run against the event logs on the remote computer.

  • When connected to a remote computer, the external logs displayed by the Event Viewer are the ones that have been referenced on the local computer.

  • You may encounter errors if, while connected to a remote computer, you attempt to display Custom Views that reference local external logs. This happens because Event Viewer tries to open those external logs on the remote computer rather then the local computer. This problem does not arise if you use UNC path names to reference the external logs.

  • To view saved events from a remote computer, you need to save the events on the remote computer with display information. For more information about archiving events with display information, see Archive an Event Log.

Additional references

  • Start Event Viewer

  • Command-line syntax notation


Run a Task in Response to a Given Event

You can configure a task to run when an event meeting specified criteria is logged.

To Run a Task in Response to a Given Event

  1. Start Event Viewer.

  2. In the console tree, navigate to the log that contains the event you want to associate with a task.

  3. Right-click the event and select Attach Task to This Event.

  4. Perform each step presented by the Create Basic Task Wizard.

Additional Considerations

  • You cannot assign a task to an event in a saved log.

  • You cannot assign a task to an event in an analytic or debug log.

Additional resources

Event Viewer How To...


Troubleshooting Event Viewer

This section lists a few common issues you may encounter when using Event Viewer. Updated troubleshooting information may be available online at Troubleshooting Event Viewer.

What problem are you having?

  • No events appear in an event log

  • You cannot find any Analytic or Debug logs

  • Event Viewer cannot attach to a remote computer

  • You cannot see the description associated with an event

  • You associated a task with an event, but the task did not run in response to the event

  • An imported Custom View does not return events

Note

If you encounter problems using any feature of Event Viewer, first ensure that the Windows Event Log service is running. If you are working with event subscriptions, ensure that the Windows Event Collector service is running.
No events appear in an event log.

If there are no events in an event log, logging may be disabled on that log or the events may have been cleared by another user. To check whether a log is enabled, right-click the log, click Properties, and check the Enable Logging option. To check whether the log was cleared, search the System log for an event with an ID value of 104. This event is generated when a log is cleared.

You cannot find any Analytic or Debug logs.

Analytic and Debug logs are hidden by default. To learn how to make them visible, see Show or Hide Analytic and Debug Logs.

Event Viewer cannot attach to a remote computer.

If Event Viewer cannot attach to a remote computer, ensure that the remote computer is available on the network. Next, ensure that the Remote Event Log Management firewall exception has been set on the remote computer. Finally, ensure that your user account has permission to access the remote computer.

You cannot see the description associated with an event.

If you cannot see the description associated with an event, the source application might not be installed on the computer on which you are trying to view the event. You can save the event in a file and view it on a computer that has the application installed, or you can install the application on the local computer.

You associated a task with an event, but the task did not run in response to the event.

You must use Task Scheduler to debug problems with tasks that are associated with events. Open Task Scheduler and search for the task. You must verify both that the task exists and that it is configured to trigger on the correct event.

An imported Custom View does not return events.

The imported Custom View might include references to logs that are not available on the current computer. To check the logs that are referenced in the custom view, right-click the custom view and click Properties, then click Edit Filter, and check the Event Log drop-down list.


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated