The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

learn more… | top users | synonyms

16
votes
2answers
14k views

Are USB unplug events logged in Windows 7? (When was my mouse stolen?)

I know this sounds kind of ridiculous, but someone stole my mouse from my cubicle.. I came to work in the morning and was about to give my mouse a little shove to wake up the monitor, but it wasn't ...
14
votes
4answers
23k views

Starting scheduled task by detecting connection of USB device

I know it has been discussed that it is not possible to start an application from an usb drive upon connection due to limitations of autorun (or autoplay??) in Win 7. But it is possible to create a ...
14
votes
3answers
47k views

Upgrade to Windows 10 Pro, version 1511, 10586 errors with 0x8024200D

I have seen a few people with this problem on forums, but nobody seems to have a solution yet. Windows says I should restart because I have an update pending (this is 10586). During restart there is ...
14
votes
3answers
31k views

Where is the log file generated by a verbose start-up in OS X Lion?

After starting up my machine in verbose mode (cmd + v at start-up) I want to view the generated log messages, to debug an error I'm receiving (the error). The error is only displayed on the screen ...
11
votes
2answers
62k views

How can I use Event Viewer to confirm login times filtered by User?

I'm required to log my start and finish times at work. Occasionally I forget to do this and had a bright idea that checking the Security events log would allow me to retrospectively ascertain my ...
10
votes
3answers
54k views

Cause of "Session Circular Kernel Context Logger failed to start error in Event Log?

I'm running Windows 7 RTM 32-bit. I'm getting the following error in my event log every second or so: Session "Circular Kernel Context Logger" failed to start with the following error: ...
8
votes
2answers
5k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
7
votes
2answers
3k views

A better alternative to Windows XP Event Viewer?

Is there one available?
7
votes
3answers
14k views

Does Windows log programs that have been run/called?

In Windows, is there a log that records what programs were run/called? While browsing the internet, viewing a static page with no ads, mouse clicks, keypresses, or miscellaneous ...
7
votes
1answer
2k views

Did my computer unlock itself?

I woke up around noon to find my computer unlocked, despite having remembered locking it the previous night and not using it since. I checked the security log, and saw a "logon" event from 11:16 AM. ...
6
votes
5answers
59k views

Turning off windows event log?

The FAQ of GTA IV tells me to turn off Windows Event Log in msconfig. This will handle the game more efficiently. And it does! But turning off windows processes always worries me. So therefore: After ...
6
votes
3answers
699 views

Blank screen in Windows 8.1

Recently I bought new computer (AMD FX-6300, 8GB RAM, SSD and GTX650 as graphic card). I installed Windows 8.1. At the beginning everything went well. But after one day I have two strange problems. ...
6
votes
2answers
787 views

How can I determine who is connected to event log remotely?

Is there a way to figure out which user and/or which computer is remotely accessing my computer's Windows event log files? These accesses are locking applications on the local computer and thereby ...
6
votes
1answer
2k views

Audit failure 5061 after logging in to Windows 10

Logging in to Windows 10 Build 10547 I see for a split second a message box pop up. There's no time to read it as the login succeeds. In the event log I see: Audit failure 5061 with a task ...
5
votes
5answers
2k views

Why does my PC reboot every 23 minutes?

Every 23 minutes in my system event log (Win 7) I see an error with event id 6008. It tells me "the previous system shutdown... was unexpected". When I work at the computer it doesn't happen so it ...
5
votes
1answer
2k views

Windows Security Log and Audit Failures

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen ...
4
votes
1answer
6k views

Windows Event Log - Installs

Is there a way to find distinct program installs in the Windows Event log? I have tried looking for a specific ID to look for but cannot find one that references installs. If not, is there an easy way ...
4
votes
1answer
269 views

Are there events which show application launches and activity in Windows?

I would like to understand how my computer is being used. I could use something like ManicTime, but it seems like this information should also be in the event log somewhere. Is it? If not, is there ...
4
votes
1answer
8k views

Run program when USB device is plugged in [duplicate]

I'm not talking about autorun (because I use Windows 7 and understand that this has been disabled now) but a task that I can create that will detect when a certain USB device has been plugged in. ...
4
votes
2answers
2k views

Equivalent of Event Log in Linux

Is there an equivalent to the Windows Event Log in Linux? When services crash or processes running in disconnected session explode, where's the problem logged to? More specifically, if a Java JVM app ...
4
votes
2answers
3k views

How do I decode the “Faulting application start time” in a Windows event log entry?

An app I was running crashed and I wanted to know when it happened, so I opened up the Windows event viewer and looked for an entry. I found the entry, and then noticed one of the details of the ...
4
votes
2answers
16k views

How do I open the dhcp-client log on Windows 7?

Tried searching the web for answers but my google voodoo isn't strong enough.
4
votes
3answers
3k views

At what time did my Windows XP machine come out of hibernation?

I usually look at the event log to find out at what time I switched on my computer. I look for the entry saying "The Event Log service was started". I use this to record in-out times at office. These ...
3
votes
3answers
2k views

Is there a way to measure an employee's computer usage?

I have been asked to see if a user is being productive. Windows 7 doesnt log much in the way of computer usage, but I was thinking it would be possible to see how long the computer is in a locked ...
3
votes
3answers
16k views

Windows 7: Crashing after update - How to check Event Logs?

My desktop appears to be blue screening and restarting after Win7 hard drive installation. How can I navigate to event viewer in Win 7 and see when was the last time it crashed unexpectedly?
3
votes
3answers
3k views

slow startup of event viewer on windows 7 but fast on server 2008

Since switching to Windows 7 for my desktop I've started to get really p***ed off at the length of time it takes to start the event viewer to display the application event log (typically 20-30 secs or ...
3
votes
2answers
5k views

Windows 7 theme automatically switched from Aero to basic and back. Is there a log for what caused this?

This happened to me yesterday, and I just want to rule out that anything malicious was going on. I should probably also mention that it switched back to Aero after a minute or two. edit: I have ...
3
votes
2answers
11k views

Is it possible to access the Windows event log if the system is unbootable?

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?
3
votes
1answer
844 views

Identifying Windows 10 \Device\Harddisk1\DR2

I'm getting errors in Windows 10's event log stating \Device\Harddisk1\DR2 drive controller is having a problem. I know that the hard disk numbers depend on the BIOS and do not match the physical ...
3
votes
2answers
880 views

Windows 2008 security logs file name?

What's the Windows Server 2008 equivalent of the SecEvent.Evt file? So I can open the file itself on an external computer and see who logged in.
3
votes
2answers
7k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
3
votes
2answers
291 views

When a hard drive powers off when it is inactive doe it cause a click on power up?

As the title suggests really. I've got a new laptop and every now and then it clicks quite loudly. I thought it might be the hard drive powering up after being idle but I am not sure. (It clicked ...
3
votes
1answer
162 views

How do I Defrag/Optimize a Windows 8.1 Volume which has no Drive Letter? Does it matter?

I have a Dell Inspiron Ultrabook running Windows 8.1 (64-bit). In File Explorer, I click on Drive C Properties -> Tools -> Optimize. There I see 4 drives listed as follows: OS (C:) -- OK (0% ...
3
votes
1answer
981 views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
3
votes
2answers
5k views

Access to Windows 7 log from a remote machine

I'm trying to access with EventViewer (from a Windows XP Prof) to a remote machine with Windows 7 (Seven). Before I started the Service "RemoteRegistry" I received an "Access Denied". After started ...
3
votes
1answer
425 views

Disable windows powershell event logging

I'm using PsExec to run PowerShell scripts on remote machines and as a side effect of this, the "Windows PowerShell" event-log (found in the Event Viewer under "Applications and Services Logs") is ...
3
votes
0answers
60 views

How does Windows 7 determine that a system was not shut down correctly (Kernel-Power Event ID 41) [duplicate]

I have a strange situation that Windows 7 thinks it was not shut down correctly, and gives me a warning in the system event log like this: http://support.microsoft.com/kb/2028504/de What the ...
3
votes
2answers
955 views

Mozy fails along with this error

Any idea how to fix this? MozyHome backup is failing at the same time with a FilesystemError2. Windows 7 64-bit. Thanks! Log Name: Application Source: VSS Date: 12/18/2009 ...
2
votes
4answers
2k views

How to find out how often my Windows partition has been defragmented?

I know that Windows uses its defrag program to defragment my partition sometimes when my system goes to an idle state. Also, sometimes I used to execute defrag by myself in order to increase ...
2
votes
1answer
14k views

Is there a log file for RDP connections (with system-name)

Is there any possible way to know the system name of the system which has taken the system remotely? From the logs we are able to know the username (but these are generic login IDs) and the IP (but we ...
2
votes
1answer
874 views

Process Monitor capture filter (or scripting)

As you know, Microsoft distributes the Russinovich extremely powerful process monitor. It captures a lot of system events and has a filter to show only some of them. I want to record a rare fault at ...
2
votes
1answer
2k views

Windows Event Log SystemTime format

The follwing timestamp was created during an Windows Security Log TimeCreated [ SystemTime] 2013-10-07T07:31:09.122037600Z In this timestamp I can't understand what 122037600Z part means? Do ...
2
votes
1answer
616 views

Many successful logon and logoff requests in Windows Event Viewer

I'm getting thousands of logon and logoff requests every day from the same computer in the local network. It seems the computer is connecting from a different port every time. What could be the cause ...
2
votes
1answer
3k views

Windows 7 Logon Failure Events Nonexistent?

I have a relatively new Windows 7 Professional 64-bit installation with all patches applied. I'm trying to test logon failure events to see what they look like and how they will look in our log ...
2
votes
1answer
7k views

Deleting Event Logs - Windows Server 2003

Can someone tell me how to delete Event Logs on Windows Server 2003? I have a number of application logs in the Event Viewer - how can these be removed? I've tried disabling the Event Log service on ...
2
votes
1answer
12k views

Open / Read .evt Files From Another Computer

I'd like to open and read Windows Event Log files. The files will be copied from a non-functioning install of Windows XP SP3 and I'd like to read them from a totally different install of Windows XP ...
2
votes
1answer
27 views

How can I receive e-mails based on certain Windows Firewall events?

Is it possible to receive an e-mail when Windows Firewall logs certain events (such as an inbound connection being accepted for example)?
2
votes
1answer
438 views

Equivalent of wevtutil in powershell?

wevtutil is a command in cmd for displaying Windows logs in different formats. What is the equivalent cmdlet in Powershell?
2
votes
1answer
2k views

How to identify drive device from log?

I have a messages about drive errors in log, like this: Bad Block On Device \Device\Harddisk0\DR0 I have 2 harrdrives in the system. How to know, which one causes these errors? I see nowhere the ...
2
votes
1answer
44 views

Some sort of bootlog or system info log in Windows 7

I was wondering if there is some sort of "Bootlog" file or anything similar in which I can (at least) see when the computer was booted. So at what date and time that happened. So basically I need a ...