Questions tagged [event-log]

The Event Log is a set of logs in a Windows system that are used by default by the Windows system, system component and many applications to record events.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Windows Event Viewer not Logging more than a day log - Application Logs

Application log is not retaining more than a day worth of logs. I have SQL Server 2019 installed and other DW application. I tried to restart the Windows event log service and also the server as well. ...
WhoIsNotActive's user avatar
1 vote
1 answer
65 views

In Windows Event log what is the provider name for OpenSSH

I want to read OpenSSH Event logs from C++ code. This is what I use to open the log: hEventLog = OpenEventLog(NULL, provider_name); I tried this with "PowerShell" as the provider_name, ...
rimono's user avatar
  • 113
0 votes
0 answers
41 views

Event ID 153 causing PC to freeze up while playing one game: Tarkov

Having issues playing one game with this SSD malfunctioning, I think. Any time I played Tarkov in the past month I've had this event ID freeze my PC for about forty secs to a minute. It doesn't cause ...
Crab King's user avatar
0 votes
0 answers
24 views

Windows Event IDs to Monitor Logins, Unlocks, Startups

I'm trying to query the Windows 11 event log for any use of a computer. I'm starting with someone getting access to the Windows UI, so I've tried this query I found somewhere on ServerFault, but the ...
ProfK's user avatar
  • 2,621
2 votes
1 answer
80 views

Sort Windows Event Log in order that entries were added

Is there any way of sorting the Windows Event log entries in the order they were added? Unfortunately I can't just sort by "Date and Time" because I'm investigating an issue where the time ...
komodosp's user avatar
  • 285
0 votes
0 answers
48 views

What process deleted the glpi-agent service?

My glpi-agent service was deleted upon my Windows 10 reboot. I would like to find out what deleted it : C:\> sc.exe query glpi-agent [SC] OpenService FAILED 1060: The specified service does not ...
SebMa's user avatar
  • 1,803
0 votes
0 answers
86 views

Lenovo laptop (Thinkbook 16p Gen 2) restarts abruptly when using it. How to fix this?

I am experiencing since months a strange behaviour with my Lenovo laptop (Thinkbook 16p Gen 2 with NVIDIA graphic card GeForce RTX 3060): it abruptly restarts while I am using it (no blue screen, ...
Rhei's user avatar
  • 59
0 votes
0 answers
81 views

How to run a batch script completely and automatically on event such as sleep/hibernate and shutdown event using task scheduler?

I have written a batch script to perform some folder synchronizing task. I have scheduled the script to execute using task scheduler on events such as sleep/hibernate(kernel power event id 42) and ...
Harsh's user avatar
  • 1
0 votes
1 answer
257 views

Is it possible to find the person who connected remotely to my PC via VNC?

TL;DR: My computer got remotely accessed and I want to know what the person did on it. The details: I started tinkering with remote connection because I wanted to remotely work on my home PC from ...
Louis Noël's user avatar
1 vote
0 answers
55 views

How can I see/understand what Windows Installer auto-rollback is (or isn't) doing? [closed]

I'm a developer working on a cross-platform application. One of the target platforms is Windows, and I've inherited an installer written using Wix. One of our current priorities is recoverability from ...
JakeRobb's user avatar
  • 162
0 votes
1 answer
88 views

Missing Name attributes on Application Error Event Log Data

On my machine when a program crashes, an Application Error event (id=1000) is logged. It contains EventData\Data elements with Name attributes: <Event xmlns="http://schemas.microsoft.com/win/...
Anders Forsgren's user avatar
0 votes
0 answers
163 views

Windows Performance Analyzer getting N/A for memory leak in EtwD and EtwR

I am having a big problem with Etw having a memory leak. I used Poolmon to find out that it seems Etw is the service that is having the leak. This leak only occurs when I run another program that I ...
David Harmon's user avatar
0 votes
0 answers
17 views

Find out what caused Windows screen on automatically [duplicate]

I set the screen will be off after pressing the power button, but sometimes no matter how many times I try, the screen will turn on automatically seconds after it turning off, even if there's no mouse ...
Hertz Hu's user avatar
0 votes
0 answers
103 views

what is "NOCAT" in Event Trace Sessions in Windows 11 22h2 and how to prevent creation of it in every boot

logman query "NOCAT" -ets: Name: NOCAT Status: Running Root Path: %systemdrive%\PerfLogs\Admin Segment: Off Schedules: On ...
amymor's user avatar
  • 35
0 votes
0 answers
300 views

Application crash dump

I have an app that that periodically crashes on our corporate Windows 10 build server (where the product is built from sources with MSVC and tested). I found the following in Windows Event Log: ...
Alexey Starinsky's user avatar
2 votes
1 answer
478 views

Programmatically detect whether a display is attached to the computer or not

I have an unattended computer that runs software on a screen basically 24/7, and I'd like to be able to detect if the display has lost power or otherwise isn't detected by the computer. The Windows ...
nathan lachenmyer's user avatar
0 votes
1 answer
133 views

How does "EnableLevel" in Autologger\EventLog work?

I want to filter out Warnings, but keep Errors and Critical events in Event Viewer for a particular event. Does "EnableLevel"=dword:00000002 accomplish this? For example [HKEY_LOCAL_MACHINE\...
Jeff's user avatar
  • 564
1 vote
0 answers
326 views

Which Windows event is generated for external USB storage mounted as a disk volume?

What is the Windows event generated when an external USB storage is mounted as a disk volume in the OS? Events like PnP events are triggered even if the external USB storage drive is blocked by AD ...
Naga Sudhir's user avatar
2 votes
0 answers
3k views

Offline downlevel migration succeeded-what is it, can it be suppressed, slows machine a bit for a minute

Offline downlevel migration succeeded-what is it, can it be suppressed as it seems to give me the blue circle for a while when coming out of sleep or restarting, etc.. Am on Windows 11 22H2 22621.1992 ...
PC.'s user avatar
  • 41
0 votes
0 answers
290 views

ESENT information

Our RMM software keeps alerting us to a device going offline. Each time this ESENT error has been lingering around it. Can anyone help me figure out what this means and how to figure this out? ...
Joshua Jimenez's user avatar
0 votes
2 answers
5k views

Does the events log have a record of when a file was created and permanently deleted?

I permanently deleted a file from my computer. Although I have the data in a later version of the file, I now realize I needed the timestamp on that file to calculate how long it took to generate the ...
NewSites's user avatar
  • 770
1 vote
1 answer
2k views

Successful Disabled/Anonymous Guest Login. What is this?

TLDR: Windows Server logs shows successful login with a disabled Guest account. Can someone explain this activity? In our SIEM, I saw the following event below from our Windows 2016 Server (not a DC). ...
Nina G's user avatar
  • 117
0 votes
1 answer
507 views

Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?

Does Event Viewer just allows you to view the logs of the user profile that is logged into the computer?
cursor arrows's user avatar
1 vote
0 answers
3k views

Event viewer - Offline downlevel migration succeeded

So my event log has this event that happened in the future? Looking it up didn't really help me, so I was wondering if anyone here knows if this is something to worry about. Information 31/12/2023 23:...
Tim Jager's user avatar
  • 200
0 votes
0 answers
270 views

Can't get Winlogon automatic restart sign-on (ARSO) to work on a specific machine

I'm trying to get Windows ARSO to work on a machine but am unable to. (Windows 10 Pro 22H2) It runs on other machines just fine, but not this specific machine. I've read through and double checked the ...
aggieNick02's user avatar
0 votes
0 answers
454 views

Weird message in event log: "Microsoft Defender Antivirus ϋśèď сľöüδ ргοτэсŧιőň тο ġěţ ąðδίŧΐŏńάľ ѕеςųгĩŧý ΐиŧéľŀìģεπčз"

A relative of mine complained of a slow computer. At my suggestion, they rescanned the hard drive. It found issues, but the on-screen information was quite useless so I checked the Event Log. Several ...
jdv-Jan de Vaan's user avatar
1 vote
1 answer
1k views

Mapping the wlceventd logs and their wlceventd_proc_event

I'm trying to monitor the logs that my Asus router are generating, so I can react on certain events. Some of the interesting ones are from the Wireless LAN Controller event daemon (wlceventd), e.g. ...
YnkDK's user avatar
  • 113
0 votes
1 answer
35 views

Where can I get information if my computer refuses a connection?

As mentioned in this Stackoverflow post, I'm having trouble connecting to "localhost": I get the error message that the connection gets refused. As far as I know, when something happens to ...
Dominique's user avatar
  • 2,243
1 vote
0 answers
3k views

Windows Event Viewer ID for when certificate is installed

Is there any where in Windows Event Viewer that can show when a new certificate is installed on user or machine certificate stores? All I found is this: https://social.technet.microsoft.com/wiki/...
user avatar
0 votes
1 answer
333 views

Windows 11 - C:\Windows is a file not a directory of size 0 B. DISM tool try repair and other methods

C:\Windows is a file of size 0 B. What is happening in the system: Explorer.exe Location is not available. C:\ not available. Access denied. WinAnotherOS:\Users\user01>C: Access denied ...
nie_znaleziono's user avatar
0 votes
1 answer
387 views

Include the Windows Event Log in UWF exclusions

I need to track unexpected restarts of an industrial system that uses UWF in Windows 10 LTSC, but I noticed that the Logs are cleaned when the system restarts, leaving only the last ones recorded when ...
dwpessoa's user avatar
  • 111
0 votes
1 answer
368 views

How domain joined Linux clients send Security Events to the AD (KDC)

Have been trying to solve an issue for two weeks with no success. So I will break it into smaller questions in hope to understand the process and find a solution. We have a Windows AD domain with some ...
shafuq's user avatar
  • 103
0 votes
0 answers
295 views

TargetUserName in Events display ComputerName$ for Linux Clients

I'm trying to implement a hardware UTM (Firewall) to use SSO. The SSO Server that I configured for this purpose uses the Active Directory (DC) security event logs. These logs tell the SSO system which ...
shafuq's user avatar
  • 103
1 vote
0 answers
617 views

Why are no Microsoft-Windows-Power-Troubleshooter events logged?

for a script a need to read the Microsoft-Windows-Power-Troubleshooter events (wake time, wake duration, wake source) but there is no event registered from Microsoft-Windows-Power-Troubleshooter on ...
the asker's user avatar
0 votes
1 answer
1k views

How do I locate the actual log and disable events by event id?

Screenshot of event viewer usb event log: When I right click on other event logs, such as AMSI/Operational, I see the option 'disable/enable' but when I right click on the event log about a usb, ...
rasputin's user avatar
2 votes
2 answers
8k views

Is it possible to log powershell scripts which executed on my computer?

Title says it all. I already turned on logging via regedit but I want something more stable. I would like to see every commands which executed on powershell to be in my event log just like Sysmon.
Cute Bear's user avatar
  • 141
1 vote
2 answers
90 views

Is it possible to log events of every user in one Event Log?

Right now if AppLocker blocks a program it is only logged in the local EventLog of the user. Is it possible to set up one Event Log where the events of any user are logged that can be accessed by an ...
ylr's user avatar
  • 13
1 vote
1 answer
1k views

Windows 10 security mitigations blocking chrome.exe from generating dynamic code

Looking in Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode, I seem to have two programs that consistently appear in here: steamwebhelper.exe' (...
GaussStrife's user avatar
0 votes
1 answer
1k views

How to Forward Windows Print Log to Syslog

I want to collect logs from various machine (windows and linux) to a centralized log server. The log server has been configured and is listening on port 514 tcp and udp for log in syslog protocol. I ...
Kristian's user avatar
  • 101
1 vote
0 answers
2k views

Winlogon Event ID 811/812 event tags

In the Microsoft-Windows-Winlogon/Operationsl.evtx event log, event IDs 811 and 812 record the start and end of Winlogon events. The Data tag named Event specifies the session event type, e.g. in the ...
dash1234's user avatar
1 vote
1 answer
1k views

How to track device IDs assignments in Windows?

Is there a way to keep track of device IDs as they're assigned by the OS? I'm using Windows 8.1, trying to track mouse IDs in specific. A cursory glance at the System logs turned nothing useful. To ...
Rhaenys's user avatar
  • 822
0 votes
0 answers
90 views

Inconsistent INACCESSIBLE_BOOT_DEVICE error

There is a weird type of error occasionally occurring on my device (today and the last time before, 1 week ago). After pressing the power button of my notebook (specs below) Windows (version below) ...
Caeleste's user avatar
  • 831
1 vote
1 answer
1k views

What do the event tags 0-13 mean in Microsoft-Windows-Winlogon/Operationsl.evtx events 811 and 812 mean?

Our company runs Win10 Enterprise systems and remote login using PIV and Pulse Secure. When looking at a user's logon/logoff times, I found codes 811 and 812 have tags associated with these events. ...
PLF5403's user avatar
  • 11
0 votes
0 answers
91 views

Audio/Screen Output is lagging every 7 minutes

I have had this problem since I installed Windows 10 about 2 years ago (new custom PC), but the problem was occuring very rarely until a couple of days ago. I have tried Windows reset, clean install ...
Paner's user avatar
  • 1
0 votes
0 answers
580 views

Windows Events 229 and 600, what do they mean?

The following event for the RemoteDesktopServices shows up in the EventLog, what does it mean? Event ID: 229, Channel: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational, Level: ...
ffslq's user avatar
  • 101
0 votes
0 answers
476 views

Does the "PlatformRollbackMethod" Windows Defender event indicate an issue?

For about a month I've been seeing this "PlatformRollbackMethod" in event viewer (Microsoft-Windows-Windows Defender/Operational) Is this a common event, or an unusual one that might ...
Eric's user avatar
  • 87
1 vote
1 answer
117 views

What to check when a stranger uses your computer

My significant other is a lecturer in Social Sciences at a university and today one of their students did not manage to bring a laptop to her class in a class that needed one. She ended up offering ...
Kernel's user avatar
  • 113
1 vote
0 answers
3k views

Windows Defender Advanced Threat Protection eating all available ram before crashing

For couple of days now I've been experiancing issues, where Windows Defender ATP process just starts to grab all my RAM, reaching up to 40GB of 48 available and then crashing. I've noticed a lot of &...
przeciag's user avatar
0 votes
1 answer
2k views

Windows 10, how can I find out what ran a powershell script at a certain time

I have a blocked powershell.exe writing to a protected folder. is there any log that can tell me what triggered the powershell.exe? i have the timestamp of when it was blocked.
Pippy's user avatar
  • 1
0 votes
0 answers
375 views

How many linked clones does VMware Workstation Pro 16 support?

I'm on Windows 10 with VMware Workstation Pro 16.1.0 build-17198959. I've created a Win 10 guest VM and created 3 linked clone from it. The three cloned VM are running in parallel and everything works....
Just a learner's user avatar

1
2 3 4 5
8