Questions tagged [event-log]

The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

Filter by
Sorted by
Tagged with
4 votes
3 answers
8k views

Start and shutdown log Windows 10

I would like to check when my PC started, I read about event log id 6006 and 6005 to check the log service start up and shutdown event... but this method doesn't work. The last eventlog service ...
Tobia's user avatar
  • 2,261
4 votes
1 answer
2k views

Are there events which show application launches and activity in Windows?

I would like to understand how my computer is being used. I could use something like ManicTime, but it seems like this information should also be in the event log somewhere. Is it? If not, is there ...
Steve Rowe's user avatar
  • 3,879
4 votes
1 answer
24k views

Retrieving last Login and Logout time in windows

How do I get the last login and logout time of a Windows user using a VB script or command? Tried using C:\> net user username | findstr /B /C:"Last logon" but it says username could not be found.
Sparkplug's user avatar
  • 143
4 votes
1 answer
3k views

How to view hardware monitor events in Windows 10?

I am wondering if there is a log somewhere in Windows to tell me when my monitor turns on and off. Occasionally it turns off for a few seconds and then back on, and as the reasons could be plenty, I ...
checho's user avatar
  • 268
4 votes
2 answers
6k views

How can we detect if a windows service is deleted,is there an event log id for it?

Someone deleted a windows service, how can we detect it? Is there an event id related this action?
xyzt's user avatar
  • 41
4 votes
2 answers
9k views

Windows Task Scheduler not running task on event

I'm trying to run a task when I get a network connection and am following these steps. I created a test.bat that does some stuff script that and set the task scheduler trigger for it to Log: ...
zkl_zkl_'s user avatar
  • 161
4 votes
1 answer
3k views

VeraCrypt + CLI + /password + turned off log?

VeraCrypt can be managed by CLI and bash/batch scripts on Linux/Windows respectively. However, IDRIX emphasizes that command containing password [flag /p, /password (Windows) or --password (Linux)] ...
Christianus's user avatar
4 votes
1 answer
6k views

Is there a trace of users killing a process on windows machine

We're debugging a situation in a retail location where the program does a bunch of logging but then everything just stops. it's pretty apparent that the comm to an external web service is taking some ...
tntwyckoff's user avatar
4 votes
2 answers
5k views

VMware Player flooding my event log with information events about "I120: Service being interrogated...."

Every few seconds a few entries of Information Event 1000 shows up in my event log saying vmauthd was the source. Here is the xml log of the event. all the others are identical other than a ...
Scott Chamberlain's user avatar
4 votes
0 answers
4k views

WMI-Activity Event ID5858, ResultCode = 0x80041032 & DCOM Event 10010 timeout errors

I've been trying to eliminate two types of errors for about a month now. First are WMI Event 5858 result code: 0x80041032 and the Second are DCOM Event 10010 server timeout errors. Read 100s of ...
Mes's user avatar
  • 41
3 votes
3 answers
3k views

Is there a way to measure an employee's computer usage?

I have been asked to see if a user is being productive. Windows 7 doesnt log much in the way of computer usage, but I was thinking it would be possible to see how long the computer is in a locked (...
Keltari's user avatar
  • 73.2k
3 votes
2 answers
7k views

Windows 7 theme automatically switched from Aero to basic and back. Is there a log for what caused this?

This happened to me yesterday, and I just want to rule out that anything malicious was going on. I should probably also mention that it switched back to Aero after a minute or two. edit: I have ...
cptloop's user avatar
  • 345
3 votes
3 answers
18k views

Windows 7: Crashing after update - How to check Event Logs?

My desktop appears to be blue screening and restarting after Win7 hard drive installation. How can I navigate to event viewer in Win 7 and see when was the last time it crashed unexpectedly?
dotnet-practitioner's user avatar
3 votes
2 answers
24k views

Windows Event Logs: Task Category

I have been scouring the internet for a formal definition of this piece of the Windows Event Logs. How is the category determined? Is there a set of standard values for this field? Can an application ...
ExceptionLimeCat's user avatar
3 votes
1 answer
7k views

Many successful logon and logoff requests in Windows Event Viewer

I'm getting thousands of logon and logoff requests every day from the same computer in the local network. It seems the computer is connecting from a different port every time. What could be the cause ...
Howie's user avatar
  • 231
3 votes
1 answer
3k views

Process Monitor capture filter (or scripting)

As you know, Microsoft distributes the Russinovich extremely powerful process monitor. It captures a lot of system events and has a filter to show only some of them. I want to record a rare fault at ...
Val's user avatar
  • 1
3 votes
1 answer
4k views

Windows Event Log SystemTime format

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
onefourone14's user avatar
3 votes
2 answers
5k views

Viewing Windows 10 event log in "follow" (real-time) mode in terminal?

In Linux, if I want to observe the system log in terminal in real-time, I can use the tail command to output the /var/log/syslog file with the -f or --follow switch, which "output(s) appended data as ...
sdbbs's user avatar
  • 1,342
3 votes
1 answer
13k views

Event ID 7036 not showing in Windows Event Log on Win10

After a service is stopped in Windows Server 2016 in the System Windows Event Log appears an event ID 7036 with a message like The (ServiceName) service entered the (StatusName) state. But in ...
Ganya's user avatar
  • 35
3 votes
2 answers
8k views

Log screensaver activity

I'd like to know if there's any way to see logs of the screensaver activity. Something like that: 02/02/2013 10:16:47 Screensaver started 02/02/2013 10:17:23 Screensaver stopped I'm running Win7 ...
pocpoc47's user avatar
3 votes
2 answers
1k views

Windows 2008 security logs file name?

What's the Windows Server 2008 equivalent of the SecEvent.Evt file? So I can open the file itself on an external computer and see who logged in.
user131008's user avatar
3 votes
2 answers
25k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
Samuel Nicholson's user avatar
3 votes
2 answers
12k views

Component Services Error Log - SQL Server Distributed Replay Client

I am getting the following error on a Windows Server 2008 x64 R2 Virtual Machine install: Log Name: System Source: Distributed COM Event ID: 10016 Level: Error Date: 2/20/2013 8:22:14 AM The ...
Richie086's user avatar
  • 5,191
3 votes
1 answer
14k views

Open / Read .evt Files From Another Computer

I'd like to open and read Windows Event Log files. The files will be copied from a non-functioning install of Windows XP SP3 and I'd like to read them from a totally different install of Windows XP ...
HK1's user avatar
  • 357
3 votes
1 answer
19k views

How to search string in Event Viewer XML Query?

Hello, in this section i want to know how to filter an event which contain Data with some words, for example: Right Syntax: *[EventData[Data[@Name='SourceAddress'] ='192.168.1.2']] result: search ...
SchoolforDesign's user avatar
3 votes
2 answers
323 views

When a hard drive powers off when it is inactive doe it cause a click on power up?

As the title suggests really. I've got a new laptop and every now and then it clicks quite loudly. I thought it might be the hard drive powering up after being idle but I am not sure. (It clicked ...
Tom's user avatar
  • 85
3 votes
1 answer
1k views

How do I Defrag/Optimize a Windows 8.1 Volume which has no Drive Letter? Does it matter?

I have a Dell Inspiron Ultrabook running Windows 8.1 (64-bit). In File Explorer, I click on Drive C Properties -> Tools -> Optimize. There I see 4 drives listed as follows: OS (C:) -- OK (0% ...
Tom-T's user avatar
  • 43
3 votes
3 answers
7k views

Windows 7 losing network connection randomly when other PC's are connected

I'm having quite an annoying problem which I haven't been able to find a solution for yet. I hope you can help me. When my PC was using my home network and was connected to the internet through a ...
Ghost's user avatar
  • 131
3 votes
1 answer
25k views

Network connectivity logs on OSX

I'm trying to determine whether or not Macs store a log of network connectivity. Specifically, I'm trying to find out if one of my machines (Mac Tower, OSX 10.7.4, 2-2.26 GHz, 16 GB DDR3) lost ...
Stephen's user avatar
  • 31
3 votes
1 answer
2k views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
MetaHyperBolic's user avatar
3 votes
2 answers
5k views

Access to Windows 7 log from a remote machine

I'm trying to access with EventViewer (from a Windows XP Prof) to a remote machine with Windows 7 (Seven). Before I started the Service "RemoteRegistry" I received an "Access Denied". After started ...
robob's user avatar
  • 255
3 votes
0 answers
2k views

Solving Windows 10 "Activation permission for the COM Server application"

On a clean genuine Windows 10 installation, the Event Viewer throws one of these errors every 2-5 minutes: The application-specific permission settings do not grant Local Activation permission ...
Bryce's user avatar
  • 2,345
3 votes
0 answers
77 views

How does Windows 7 determine that a system was not shut down correctly (Kernel-Power Event ID 41) [duplicate]

I have a strange situation that Windows 7 thinks it was not shut down correctly, and gives me a warning in the system event log like this: http://support.microsoft.com/kb/2028504/de What the KB-...
Erik's user avatar
  • 1,399
3 votes
0 answers
615 views

Windows 7 Static IP Logs/History

Is there any way to pull up in the Event Log when a Static IP address was changed and if possible what changes were made? I've run into a problem where someone keeps changing their static IP address ...
NerdNextDoor's user avatar
3 votes
2 answers
1k views

Mozy fails along with this error

Any idea how to fix this? MozyHome backup is failing at the same time with a FilesystemError2. Windows 7 64-bit. Thanks! Log Name: Application Source: VSS Date: 12/18/2009 12:...
Jon-Eric's user avatar
  • 2,222
2 votes
4 answers
5k views

How to find out how often my Windows partition has been defragmented?

I know that Windows uses its defrag program to defragment my partition sometimes when my system goes to an idle state. Also, sometimes I used to execute defrag by myself in order to increase ...
Diogo's user avatar
  • 30.5k
2 votes
1 answer
6k views

Equivalent of wevtutil in powershell?

wevtutil is a command in cmd for displaying Windows logs in different formats. What is the equivalent cmdlet in Powershell?
leeand00's user avatar
  • 22.4k
2 votes
1 answer
25k views

Find events for connections to a shared drive in the Windows Event Log

I am working at an university institute. We use Microsoft Windows 7 Enterprise with one central server for our infrastructure. The roaming user profiles and a shared drive reside on the server. ...
AnatraIlDuck's user avatar
2 votes
1 answer
935 views

Check who opened my cd tray

There is this old "prank" where people can open your cd tray by running: compmgmt.msc /computer:\\computername Then go to repositories > disk management > CD Rom > Eject Someone in my workplace has ...
Phiter's user avatar
  • 143
2 votes
1 answer
3k views

Difference between Windows events 4801 and 4624

(for background, see: In Windows 7, How to query times, when the computer was locked?) It seems that there are two entirely separate events that may be generated in the windows event log when a ...
Jules's user avatar
  • 441
2 votes
1 answer
2k views

Is it possible to make the motherboard log instant random shutdowns?

My computer randomly shuts down instantly. It even happens sometimes in the bios. And sometimes it runs for days under load without any problem. I checked and it is not a temperature issue. What I'm ...
Furkan Gözükara's user avatar
2 votes
1 answer
4k views

Windows 7 Logon Failure Events Nonexistent?

I have a relatively new Windows 7 Professional 64-bit installation with all patches applied. I'm trying to test logon failure events to see what they look like and how they will look in our log ...
Magicked's user avatar
  • 185
2 votes
1 answer
10k views

Deleting Event Logs - Windows Server 2003

Can someone tell me how to delete Event Logs on Windows Server 2003? I have a number of application logs in the Event Viewer - how can these be removed? I've tried disabling the Event Log service on ...
Jimmy Collins's user avatar
2 votes
2 answers
8k views

Is it possible to log powershell scripts which executed on my computer?

Title says it all. I already turned on logging via regedit but I want something more stable. I would like to see every commands which executed on powershell to be in my event log just like Sysmon.
Cute Bear's user avatar
  • 141
2 votes
1 answer
3k views

Querying event viewer in cmd

Various sources such as this one suggest using a eventquery.vbs on the system to query the event log from cmd. Apparently my stock install of Windows 10 is missing that file: Microsoft Windows [...
user1476716's user avatar
2 votes
2 answers
2k views

Write to Windows Event Viewer from log file

I have a log file "logs.log" that include the status of one of the applications, and I want to write these logs in Windows Events Viewer. the output in that file as below: 24/01/2019 16:33:26 app(...
mssaa's user avatar
  • 21
2 votes
1 answer
543 views

How to read the latest Chkdsk event viewer log in PowerShell (on Windows 10)?

As I find it rather cumbersome to run Event Viewer and filter out the latest Chkdsk log, may I poke a question: How to read the latest Chkdsk event viewer log in PowerShell (on Windows 10)? My ...
Vlastimil Burián's user avatar
2 votes
1 answer
134 views

How can I receive e-mails based on certain Windows Firewall events?

Is it possible to receive an e-mail when Windows Firewall logs certain events (such as an inbound connection being accepted for example)?
Karan's user avatar
  • 56.5k
2 votes
2 answers
16k views

Forward Windows system Event logs to a Linux Syslog Server with no agent

We have a SCOM 2012 server. We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features. We also have a centralized ...
tobe1424's user avatar
2 votes
1 answer
75 views

Some sort of bootlog or system info log in Windows 7

I was wondering if there is some sort of "Bootlog" file or anything similar in which I can (at least) see when the computer was booted. So at what date and time that happened. So basically I need a ...
Vivendi's user avatar
  • 123

1
2
3 4 5
8