2

I am tring to find out when an application was started using the Event Viewer on Windows 8.1. I have tried tracking the PID of the application (Winamp) from the Task Manager to the Event Viewer, but was not able to find it (I looked in the Application logs, from what I read so far, that's where the application logging is made).

I tried this with a Windows 8.1 modern app, and the only way I could find its starting moment in the Event Viewer has been to track the last opened application (but I already knew it SHOULD be there, so this doesn't help). However, the Process ID of this app in the Event Viewer was different than its PID in Task Manager! I'm really confused.

From my knowledge so far, any application run on the computer should be logged there at least as INFORMATION upon its startup. However, I also heard opinions that the Event Viewer actually only logs information when a problem occurred.

Is it possible to track when an application was started using the Event Viewer?

1 Answer 1

2

Not possible out-of-the-box. May be possible with a 3rd-party applications. It's also possible to create a batch file that calls the (built-in) logevent program to create a custom event log entry and launch your application (WinAmp). Then you can replace the shortcuts on the Desktop, Start Menu, etc with the batch file. In my option, it's a little dirty.

Furthermore, if the application started a service, then it's possible to track the stop and start of Window service. Changes with the state of Windows services are logged in the System log.

Source: IT experience, but confirmed by tests -- starting applications then looking at all (50?+) Windows event logs types.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .