Event Viewer overview

Using the event logs in Event Viewer, you can gather information about hardware, software, and system problems and monitor Windows 2000 security events.

Windows 2000 records events in three kinds of logs:

Application log

The application log contains events logged by applications or programs. For example, a database program might record a file error in the application log. The developer decides which events to record.

System log

The system log contains events logged by the Windows 2000 system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. The event types logged by system components are predetermined.

Security log

The security log can record security events such as valid and invalid logon attempts, as well as events related to resource use, such as creating, opening, or deleting files. An administrator can specify what events are recorded in the security log. For example, if you have enabled logon auditing, attempts to log on to the system are recorded in the security log.

Event Viewer displays these types of events:

Error

A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an error will be logged.

Warning

An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a warning will be logged.

Information

An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.

Success Audit

An audited security access attempt that succeeds. For example, a user's successful attempt to log on to the system will be logged as a Success Audit event.

Failure Audit

An audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.

The Event Log service starts automatically when you start Windows 2000. Application and system logs can be viewed by all users, but security logs are accessible only to administrators.

By default, security logging is turned off. You can use Group Policy to enable security logging. The administrator can also set auditing policies in the registry that cause the system to halt when the security log is full. For more information, see Related Topics.

Related Topics


Using event logs to troubleshoot problems

Careful monitoring of event logs can help you predict and identify the sources of system problems. For example, if log warnings show that a disk driver can only read or write to a sector after several retries, the sector is likely to go bad eventually. Logs can also confirm problems with software. If a program crashes, a program event log can provide a record of activity leading up to the event.

The following suggestions may help you use event logs to diagnose problems:

Archive logs in log format

The binary data associated with an event is saved if you archive the log in log format (*.evt), but is discarded if you archive data in text (*.txt) or comma-delimited (*.csv) format. The binary data may help a developer or technical support specialist identify the source of a problem.

Note Event IDs

These numbers match a text description in a message file. The numbers can be used by product support representatives to understand what occurred in the system.

Hardware problems

If you suspect a hardware component is the origin of system problems, filter the system log to show only those events generated by the component.

System problems

If a particular event seems related to system problems, try searching the event log to find other instances of the same event or to judge the frequency of an error.


Refresh an event log

To refresh an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to refresh.
  3. On the Action menu, click Refresh.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to refresh the security log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • The Refresh command is not available for archived logs because those files can no longer be updated.
  • When you open a log, Event Viewer displays the current information for the log. While you view the log, the information is not updated unless you refresh it. If you switch to another log and then return to the first log, the first log is automatically refreshed.


View more details about an event

To view more details about an event

  1. Open Event Viewer.
  2. In the console tree, click the log you want.
  3. In the details pane, click the event you want.
  4. On the Action menu, click Properties.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To view binary data as characters, in the Data box, click Bytes. To view binary data as DWORDS, click Words.
  • To view details about the previous or next event, click the up or down arrow. To copy the details of an event, click Copy.
  • Not all events generate binary data. Binary data can be interpreted by an experienced programmer or a support technician familiar with the source application.
  • To retain the event description in binary data form, archive logs in the log file format (*.evt). Saving logs in text format (*.txt) or comma-delimited text format (*.csv) discards the binary data.


Search for specific types of events

To search for specific types of events

  1. Open Event Viewer.
  2. In the console tree, click the log you want to search.
  3. On the View menu, click Find.
  4. Under Types, click the types of events you want to find.
  5. In Event source, Category, Event ID, User, Computer, or Description, specify additional information about the event or events you want to find.
  6. Click Find Next.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • In Description, you can type any text that matches a portion of an event record description. For more information about the other fields, right-click the name of the field, and then click What's This?.
  • To restore the default search criteria, click Restore Defaults before clicking Find Next.
  • Your search parameters remain in Find throughout the current session. The default settings are restored the next time you start Event Viewer.
  • If you are looking for groups of events instead of a small number of individual events, you can also filter the log. For more information, see Related Topics.


Add another view of an event log

To add another view of an event log

  1. Open Event Viewer.
  2. In the console tree, click the log of which you want to add another view.
  3. On the Action menu, click New Log View.
  4. On the Action menu, click Rename.
  5. Type the name as you want it to appear in the console tree and press ENTER.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • Log views added to the console tree can be managed and customized in the same way as the default logs.


Select another computer

To select another computer

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. Click Event Viewer, and then click Add.
  5. Click Another computer, and then enter the path and name of the computer, for example, \\domainname\computername.
  6. Click Finish, click Close, and then click OK.

Notes

  • If step 1 does not open a Microsoft Management Console (MMC) window, then MMC may not be available on your computer. If an MMC window opens but the Console menu or the Add/Remove Snap-In command is not available, then MMC is running in User mode and snap-ins cannot be added or removed. For more information, contact your network administrator or see Related Topics.
  • The other computer can be a workstation running Windows 2000 Professional or Windows NT Workstation, a server or domain controller running Windows 2000 Server or Windows NT Server, or a LAN Manager 2.x server.
  • If the new computer requires a low-speed connection, right-click the log you want to view, and then click Properties. On the General tab, click Low speed connection.


Clear an event log

To clear an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to clear.
  3. On the Action menu, click Clear all Events.
  4. Click Yes to save the log before clearing it.

    Click No to permanently discard the current event records and start recording new events.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to clear an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • After you clear a log, only new events will appear in the log.
  • If you select Do not overwrite events (clear log manually) in the Properties dialog box of an active log, you must periodically clear the log either when the log reaches a certain size or when a message notifies you that the log is full.
  • You cannot clear archived logs; instead, delete the archived log file.


Archive an event log

To archive an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to archive.
  3. On the Action menu, click Save Log File As.
  4. In File name, enter a name for the archived log file.
  5. In Save as type, click a file format, and then click Save.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • If you archive a log in log-file format, you can reopen it in Event Viewer. Logs saved as event log files (*.evt) retain the binary data for each event recorded.
  • If you archive a log in text or comma-delimited format (*.txt and *.csv, respectively), you can reopen the log in other programs such as word processing or spreadsheet programs. Logs saved in text or comma-delimited format do not retain the binary data.
  • When you archive a log file, the entire log is saved, regardless of filtering options.
  • The sort order is not retained when logs are saved.
  • Archiving has no effect on the current contents of the active log. To clear the log, click Action, and then click Clear all Events.


Open an archived event log

To open an archived event log

  1. Open Event Viewer.
  2. On the Action menu, click Open Log File.
  3. Click the file you want to open. You may need to search for the drive or folder that contains the document.
  4. In Log type, select the type of log to be opened.
  5. In Display name, enter the name as you want it to appear in the console tree, and then click Open.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • You can view an archived file in Event Viewer only if the log is saved in log file format (*.evt).
  • You cannot click Refresh or Clear all Events to update the display or to clear an archived log.
  • To remove an archived log file from your system, delete the file in Windows Explorer.


Free an event log when it is full

To free an event log when it is full

  1. Open Event Viewer.
  2. In the console tree, click the log you want to free.
  3. On the Action menu, click Clear all Events.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to free an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • When a log is full, it stops recording new events. Clearing the log is one way to free the log and start recording new events.
  • You can also free a log and start recording new events by overwriting events. To overwrite events, on the Action menu, click Properties, and then click Overwrite events as needed. This ensures that all new events are written to the log, even when the log is full.
  • You can also start logging new events by increasing the maximum log size. To increase the log size, on the Action menu, click Properties, and then increase the Maximum log size.


Specify a sort order in an event log

To specify a sort order in an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to sort.
  3. Click the column heading you want to sort by.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To reverse the sort order, click the column heading a second time.
  • To sort chronologically, on the View menu, click Newest First or Oldest First. The default is Newest First.
  • When a log is archived, the sort order is not saved.


Filter events in an event log

To filter events in an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to filter.
  3. On the View menu, click Filter.
  4. On the Filter tab, specify the characteristics you want.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To return to the default criteria, click Restore Defaults.
  • To turn off event filtering, on the View menu click All Records.


Set event logging options

To set event logging options

  1. Open Event Viewer.
  2. In the console tree, click the log you want to set options for.
  3. On the Action menu, click Properties.
  4. On the General tab, specify the options you want.

Notes

  • You must be logged on as administrator or as a member of the Administrators group in order to complete this procedure.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To restore the default settings, click Restore Defaults.
  • To clear the log, click Clear Log.
  • Under Log size, select one of these options:
    • If you do not want to archive this log, click Overwrite events as needed.
    • If you want to archive the log at scheduled intervals, click Overwrite events older than and specify the appropriate number of days. Be sure that the Maximum log size is large enough to accommodate the interval.
    • If you must retain all the events in the log, click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. When the maximum log size is reached, new events will be discarded.


Reset an event log to default settings

To reset an event log to default settings

  1. Open Event Viewer.
  2. In the console tree, click the log you want to reset.
  3. On the Action menu, click Properties.
  4. On the General tab, click Default.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to reset an event log to the default settings.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.


Reduce the size of an event log

To reduce the size of an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to change.
  3. On the Action menu, click Properties.
  4. On the General tab, in Maximum log size, specify the new log size in kilobytes.
  5. To put the new setting in effect, click Clear Log.

    6. If you want to retain the information currently in the log, click Yes when a message appears, asking if you want to save the original log before clearing it, and then click OK.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to change the size of an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.


Turn on security logging

To turn on security logging

  1. Click Start, click Run, type mmc /a, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, click Group Policy, and then click Add.
  4. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
  5. In Local Computer Policy, click Audit Policy.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, click the attribute or event you want to audit.
  7. Click Action, and then click Security.
  8. In Local Security Policy Setting, click the options you want, and then click OK.
  9. Repeat steps 6, 7, and 8 for other events you want to audit.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to turn on security logging. Group Policy is available only to administrators.
  • If you have previously saved a console with Group Policy, you can open the saved console and go to step 5.
  • If your computer is connected to a network, security logging may be restricted or disabled by network policy.
  • The security log is limited in size, so carefully select the events to be audited and consider the amount of disk space you are willing to devote to the security log. For information about changing the log size, see Related Topics.
  • This procedure applies to Windows 2000 Professional computers, as well as Windows 2000 Server computers running as stand-alone servers or member servers. To turn on security logging for a domain controller, see Related Topics.
  • If security auditing has been enabled on a remote machine, you can view the event logs remotely with Event Viewer. Open an MMC console in author mode, and add Event Viewer to the console. When prompted to specify which computer the snap-in will manage, click Another computer and enter the name of the remote computer.
  • Security auditing for workstations, member servers, and domain controllers can be enabled remotely only by domain administrators. To do that, create an Organization Unit (OU), add the desired machine account(s) to the OU, and then, using Active Directory Users and Computers, create policy to enable security auditing.


Set up auditing of files and folders

To set up auditing of files and folders

  1. Click Start, click Run, type mmc /a, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, click Group Policy, and then click Add.
  4. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
  5. In Local Computer Policy, click Audit Policy.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, right-click Audit Object Access, and then click Security.
  7. In Local Security Policy Setting, click the options you want, and then click OK.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to set up auditing of files and folders. Group Policy is available only to administrators.
  • If you have previously saved a console with Group Policy, you can open the saved console and go to step 5.
  • After you enable auditing of files and folders, you must specify which files and folders to audit. For more information, see Related Topics.


Specify files and folders to audit

To specify files and folders to audit

  1. In Windows Explorer, right-click the file or folder you want to audit, and then click Properties.
  2. On the Security tab, click Advanced.
  3. On the Auditing tab, click Add.
  4. In the Select User, Computer, or Group dialog box, click the name of the user or group whose actions you want to audit, and then click OK.
  5. In the Auditing Entry dialog box, in Access, click Successful, Failed, or both for the actions you want to be audited, and then click OK.

Notes

  • You must log on as an administrator or as a member of the Administrators group to specify files and folders to audit. Otherwise, in step 2, the Security tab will not appear or will appear in read-only form.
  • The Security tab is available only for files and folders on NTFS volumes.
  • Before you can specify files and folders to audit, you must use Group Policy to enable auditing. For more information, see Related Topics.


Halt the computer when the security log is full

To halt the computer when the security log is full

  1. Open Event Viewer.
  2. In the console tree, right-click Security Log, and then click Properties.
  3. On the General tab, click either Overwrite events older than n days or Do not overwrite events (clear log manually).
  4. Use Registry Editor to create or assign the following registry key value:

    Hive: HKEY_LOCAL_MACHINE\SYSTEM
    Key: \CurrentControlSet\Control\Lsa
    Name: CrashOnAuditFail
    Type: REG_DWORD
    Value: 1

  5. Restart the computer.

Caution

  • Incorrectly editing the registry may severely damage your system. At the very least, you should back up any valuable data on the computer before making changes to the registry.

Important

  • After this procedure is completed, when the security log becomes full, Windows 2000 will stop responding and will display the message "Audit Failed." To recover when Windows 2000 stops, the security log must be cleared. For more information, see Related Topics.

Notes

  • You must be logged on as administrator or as a member of the Administrators group in order to complete this procedure.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • If Windows 2000 halts as a result of a full security log, the system must be restarted and you must repeat this procedure if you want a full log to stop the computer in the future.
  • To start Registry Editor, click Start, click Run, type regedit, and then click OK. For more information about Registry Editor, on the Registry Editor Help menu, click Help Topics.


Recover when Windows 2000 stops

To recover when Windows 2000 stops

  1. Restart the computer and log on using an account in the Administrators group.
  2. Open Event Viewer, archive the currently logged security events (if desired), and then clear all events from the security log.
  3. Open Registry Editor and locate the following key:

    4. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  4. Delete and replace the CrashOnAuditFail value, using data type REG_DWORD and a value of 1.
  5. Exit Registry Editor and restart the computer.

Caution

  • Incorrectly editing the registry may severely damage your system. At the very least, you should back up any valuable data on the computer before making changes to the registry.

Notes

  • If the registry was previously configured with CrashOnAuditFail = 1 and the security log becomes full, Windows 2000 will stop responding and will display the message "Audit Failed." If that happened, use the procedure above.
  • To start Registry Editor, click Start, click Run, type regedit, and then click OK. For more information about Registry Editor, on the Registry Editor Help menu, click Help Topics.
  • To capture registry changes in your backup procedures, be sure to include System State data in the Backup set when you run Backup.