Event Viewer

MCTS 70-680: Windows 7 Event Viewer

• Report rights infringement
• published: 08 Feb 2012
• views: 17089

When troubleshooting problems in Windows 7, the event viewer will give you key information that will help you fix the system. This video looks at the different logs found in the event viewer and the options that can be configured in the event viewer. Different event types Information: These events are usually FYI's in your system and don't indicate a problem. For example, when a service starts up it may generate an information event stating the service started up cleanly. Warning: These events are generally not too serious but may indicate some kind of problem. A warning may be generated, for example, if a file on the hard disk could not be indexed by the search function. If this happens only once, it is nothing to worry about; if it keeps happening, it is worth looking into a fix for whatever the problem is. Warning events generally don't affect the running of your system in any significant way. Error: These events are created when something significant happens. Usually these are created when an application or service crashes. Critical: Critical errors are generally created when a significant crash or hardware problem occurs. Windows logs Application: This log contains events that have been generated from applications on the system. These include Windows applications and 3rd party applications installed on the system. System: This log contains events that were generated by the operating system itself. These include crashes to services and problems with devices like hard disks. Security: The security log holds events related to access on the system. Depending on the settings configured on the system, this log may contain events from when a user logs in to when objects like user accounts are created or files on the hard disk are created. If you decide to audit file access on your hard disk, keep in mind that this will generate a lot of events in the security log and also reduce the performance of the system. Setup: This log contain events from applications when they were installed and events from the original install of Windows 7 and Windows updates. System: This log contains events relating to the Windows system. Generally this will contain events from services on the system but could also contain events from devices like the hard disk. In most cases when troubleshooting a system you will start with this log. Forward events: These are events that have been sent from another computer or forwarded to this computer. Event log properties There are a number of different properties that can be configured for each log file. Log path: This configures where the log file will be saved. You can also put in a network location here; however, events may be lost if the network location cannot be reached. Maximum log: This setting determines the maximum size of the log file. When this size is reached the log file can be configured to do one of the following 3 options: 1) Event will be overwritten as required starting with the oldest event in the log; 2) The log file will be archived and a new log file created; 3) Events will no longer be recorded until the event log is manually cleared.