Event Viewer

Event Viewer allows users to monitor events recorded in the Application, Security, and System logs:

  • For help with specific tasks, see How to
  • For general background information, see Concepts
  • For problem-solving instructions, see Troubleshooting


How to...

  • View event logs
  • Manage event logs
  • Customize event logs
  • Use the security log


View event logs

  • Refresh an event log
  • View more details about an event
  • Add another view of an event log
  • Search for specific events
  • Select another computer


Refresh an event log

To refresh an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to refresh.
  3. On the Action menu, click Refresh.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to refresh the security log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • The Refresh command is not available for archived logs because those files can no longer be updated.
  • When you open a log, Event Viewer displays the current information for the log. While you view the log, the information is not updated unless you refresh it. If you switch to another log and then return to the first log, the first log is automatically refreshed.

Related Topics


View more details about an event

To view more details about an event

  1. Open Event Viewer.
  2. In the console tree, click the log you want.
  3. In the details pane, click the event you want.
  4. On the Action menu, click Properties.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To view binary data as characters, in the Data box, click Bytes. To view binary data as DWORDS, click Words.
  • To view details about the previous or next event, click the up or down arrow. To copy the details of an event, click Copy.
  • Not all events generate binary data. Binary data can be interpreted by an experienced programmer or a support technician familiar with the source application.
  • To retain the event description in binary data form, archive logs in the log file format (*.evt). Saving logs in text format (*.txt) or comma-delimited text format (*.csv) discards the binary data.

Related Topics


Add another view of an event log

To add another view of an event log

  1. Open Event Viewer.
  2. In the console tree, click the log of which you want to add another view.
  3. On the Action menu, click New Log View.
  4. On the Action menu, click Rename.
  5. Type the name as you want it to appear in the console tree and press ENTER.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • Log views added to the console tree can be managed and customized in the same way as the default logs.

Related Topics


Search for specific types of events

To search for specific types of events

  1. Open Event Viewer.
  2. In the console tree, click the log you want to search.
  3. On the View menu, click Find.
  4. Under Types, click the types of events you want to find.
  5. In Event source, Category, Event ID, User, Computer, or Description, specify additional information about the event or events you want to find.
  6. Click Find Next.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • In Description, you can type any text that matches a portion of an event record description. For more information about the other fields, right-click the name of the field, and then click What's This?.
  • To restore the default search criteria, click Restore Defaults before clicking Find Next.
  • Your search parameters remain in Find throughout the current session. The default settings are restored the next time you start Event Viewer.
  • If you are looking for groups of events instead of a small number of individual events, you can also filter the log. For more information, see Related Topics.

Related Topics


Select another computer

To select another computer

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. Click Event Viewer, and then click Add.
  5. Click Another computer, and then enter the path and name of the computer, for example, \\domainname\computername.
  6. Click Finish, click Close, and then click OK.

Notes

  • If step 1 does not open a Microsoft Management Console (MMC) window, then MMC may not be available on your computer. If an MMC window opens but the Console menu or the Add/Remove Snap-In command is not available, then MMC is running in User mode and snap-ins cannot be added or removed. For more information, contact your network administrator or see Related Topics.
  • The other computer can be a workstation running Windows 2000 Professional or Windows NT Workstation, a server or domain controller running Windows 2000 Server or Windows NT Server, or a LAN Manager 2.x server.
  • If the new computer requires a low-speed connection, right-click the log you want to view, and then click Properties. On the General tab, click Low speed connection.

Related Topics


Manage event logs

  • Clear an event log
  • Archive an event log
  • Open an archived event log
  • Free an event log when it is full


Clear an event log

To clear an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to clear.
  3. On the Action menu, click Clear all Events.
  4. Click Yes to save the log before clearing it.

    Click No to permanently discard the current event records and start recording new events.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to clear an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • After you clear a log, only new events will appear in the log.
  • If you select Do not overwrite events (clear log manually) in the Properties dialog box of an active log, you must periodically clear the log either when the log reaches a certain size or when a message notifies you that the log is full.
  • You cannot clear archived logs; instead, delete the archived log file.

Related Topics


Archive an event log

To archive an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to archive.
  3. On the Action menu, click Save Log File As.
  4. In File name, enter a name for the archived log file.
  5. In Save as type, click a file format, and then click Save.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • If you archive a log in log-file format, you can reopen it in Event Viewer. Logs saved as event log files (*.evt) retain the binary data for each event recorded.
  • If you archive a log in text or comma-delimited format (*.txt and *.csv, respectively), you can reopen the log in other programs such as word processing or spreadsheet programs. Logs saved in text or comma-delimited format do not retain the binary data.
  • When you archive a log file, the entire log is saved, regardless of filtering options.
  • The sort order is not retained when logs are saved.
  • Archiving has no effect on the current contents of the active log. To clear the log, click Action, and then click Clear all Events.

Related Topics


Open an archived event log

To open an archived event log

  1. Open Event Viewer.
  2. On the Action menu, click Open Log File.
  3. Click the file you want to open. You may need to search for the drive or folder that contains the document.
  4. In Log type, select the type of log to be opened.
  5. In Display name, enter the name as you want it to appear in the console tree, and then click Open.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • You can view an archived file in Event Viewer only if the log is saved in log file format (*.evt).
  • You cannot click Refresh or Clear all Events to update the display or to clear an archived log.
  • To remove an archived log file from your system, delete the file in Windows Explorer.

Related Topics


Free an event log when it is full

To free an event log when it is full

  1. Open Event Viewer.
  2. In the console tree, click the log you want to free.
  3. On the Action menu, click Clear all Events.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to free an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • When a log is full, it stops recording new events. Clearing the log is one way to free the log and start recording new events.
  • You can also free a log and start recording new events by overwriting events. To overwrite events, on the Action menu, click Properties, and then click Overwrite events as needed. This ensures that all new events are written to the log, even when the log is full.
  • You can also start logging new events by increasing the maximum log size. To increase the log size, on the Action menu, click Properties, and then increase the Maximum log size.

Related Topics


Customize event logs

  • Specify a sort order in an event log
  • Filter events in an event log
  • Set event logging options
  • Reset an event log to default settings
  • Change the event log size


Specify a sort order in an event log

To specify a sort order in an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to sort.
  3. Click the column heading you want to sort by.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To reverse the sort order, click the column heading a second time.
  • To sort chronologically, on the View menu, click Newest First or Oldest First. The default is Newest First.
  • When a log is archived, the sort order is not saved.

Related Topics


Filter events in an event log

To filter events in an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to filter.
  3. On the View menu, click Filter.
  4. On the Filter tab, specify the characteristics you want.

Notes

  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To return to the default criteria, click Restore Defaults.
  • To turn off event filtering, on the View menu click All Records.

Related Topics


Set event logging options

To set event logging options

  1. Open Event Viewer.
  2. In the console tree, click the log you want to set options for.
  3. On the Action menu, click Properties.
  4. On the General tab, specify the options you want.

Notes

  • You must be logged on as administrator or as a member of the Administrators group in order to complete this procedure.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • To restore the default settings, click Restore Defaults.
  • To clear the log, click Clear Log.
  • Under Log size, select one of these options:
    • If you do not want to archive this log, click Overwrite events as needed.
    • If you want to archive the log at scheduled intervals, click Overwrite events older than and specify the appropriate number of days. Be sure that the Maximum log size is large enough to accommodate the interval.
    • If you must retain all the events in the log, click Do not overwrite events (clear log manually). This option requires that the log be cleared manually. When the maximum log size is reached, new events will be discarded.

Related Topics


Reset an event log to default settings

To reset an event log to default settings

  1. Open Event Viewer.
  2. In the console tree, click the log you want to reset.
  3. On the Action menu, click Properties.
  4. On the General tab, click Default.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to reset an event log to the default settings.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.

Related Topics


Reduce the size of an event log

To reduce the size of an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to change.
  3. On the Action menu, click Properties.
  4. On the General tab, in Maximum log size, specify the new log size in kilobytes.
  5. To put the new setting in effect, click Clear Log.

    6. If you want to retain the information currently in the log, click Yes when a message appears, asking if you want to save the original log before clearing it, and then click OK.

Notes

  • You must be logged on as an administrator or a member of the Administrators group to change the size of an event log.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.

Related Topics


Use the security log

This section covers:

  • Turn on security logging
  • Turn on security logging for a domain controller
  • Set up auditing of files and folders
  • Specify files and folders to audit
  • Halt the computer when the security log is full


Turn on security logging

To turn on security logging

  1. Click Start, click Run, type mmc /a, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, click Group Policy, and then click Add.
  4. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
  5. In Local Computer Policy, click Audit Policy.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, click the attribute or event you want to audit.
  7. Click Action, and then click Security.
  8. In Local Security Policy Setting, click the options you want, and then click OK.
  9. Repeat steps 6, 7, and 8 for other events you want to audit.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to turn on security logging. Group Policy is available only to administrators.
  • If you have previously saved a console with Group Policy, you can open the saved console and go to step 5.
  • If your computer is connected to a network, security logging may be restricted or disabled by network policy.
  • The security log is limited in size, so carefully select the events to be audited and consider the amount of disk space you are willing to devote to the security log. For information about changing the log size, see Related Topics.
  • This procedure applies to Windows 2000 Professional computers, as well as Windows 2000 Server computers running as stand-alone servers or member servers. To turn on security logging for a domain controller, see Related Topics.
  • If security auditing has been enabled on a remote machine, you can view the event logs remotely with Event Viewer. Open an MMC console in author mode, and add Event Viewer to the console. When prompted to specify which computer the snap-in will manage, click Another computer and enter the name of the remote computer.
  • Security auditing for workstations, member servers, and domain controllers can be enabled remotely only by domain administrators. To do that, create an Organization Unit (OU), add the desired machine account(s) to the OU, and then, using Active Directory Users and Computers, create policy to enable security auditing.

Related Topics


Turn on security logging for a domain controller

To turn on security logging for a domain controller

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Domain Controllers.

    Where?

    • Active Directory Users and Computers
    • domain name
    • Domain Controllers
  3. Click Action, and then click Properties.
  4. On the Group Policy tab, click the policy you want to change, and then click Edit.
  5. In the Group Policy window, in the console tree, click Audit Policy.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, click the attribute or event you want to audit.
  7. Click Action, and then click Security.
  8. In Security policy settings, click the options you want.
  9. Repeat steps 3 and 4 for other events you want to audit.

Notes

  • To open Active Directory Users and Computers, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  • The security log is limited in size. Select the events to be audited carefully and consider the amount of disk space you are willing to devote to the security log.
  • If security auditing has been enabled on a remote machine, you can view the event logs remotely with Event Viewer. Open an MMC console in author mode, and add Event Viewer to the console. When prompted to specify which computer the snap-in will manage, click Another computer and enter the name of the remote computer.
  • Security auditing for workstations, member servers, and domain controllers can be enabled remotely only by domain administrators. To do that, create an Organization Unit (OU), add the desired machine account(s) to the OU, and then, using Active Directory Users and Computers, create policy to enable security auditing.

Related Topics


Set up auditing of files and folders

To set up auditing of files and folders

  1. Click Start, click Run, type mmc /a, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, click Group Policy, and then click Add.
  4. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
  5. In Local Computer Policy, click Audit Policy.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, right-click Audit Object Access, and then click Security.
  7. In Local Security Policy Setting, click the options you want, and then click OK.

Notes

  • You must be logged on as an administrator or as a member of the Administrators group to set up auditing of files and folders. Group Policy is available only to administrators.
  • If you have previously saved a console with Group Policy, you can open the saved console and go to step 5.
  • After you enable auditing of files and folders, you must specify which files and folders to audit. For more information, see Related Topics.

Related Topics


Specify files and folders to audit

To specify files and folders to audit

  1. In Windows Explorer, right-click the file or folder you want to audit, and then click Properties.
  2. On the Security tab, click Advanced.
  3. On the Auditing tab, click Add.
  4. In the Select User, Computer, or Group dialog box, click the name of the user or group whose actions you want to audit, and then click OK.
  5. In the Auditing Entry dialog box, in Access, click Successful, Failed, or both for the actions you want to be audited, and then click OK.

Notes

  • You must log on as an administrator or as a member of the Administrators group to specify files and folders to audit. Otherwise, in step 2, the Security tab will not appear or will appear in read-only form.
  • The Security tab is available only for files and folders on NTFS volumes.
  • Before you can specify files and folders to audit, you must use Group Policy to enable auditing. For more information, see Related Topics.

Related Topics


Halt the computer when the security log is full

To halt the computer when the security log is full

  1. Open Event Viewer.
  2. In the console tree, right-click Security Log, and then click Properties.
  3. On the General tab, click either Overwrite events older than n days or Do not overwrite events (clear log manually).
  4. Use Registry Editor to create or assign the following registry key value:

    Hive: HKEY_LOCAL_MACHINE\SYSTEM
    Key: \CurrentControlSet\Control\Lsa
    Name: CrashOnAuditFail
    Type: REG_DWORD
    Value: 1

  5. Restart the computer.

Caution

  • Incorrectly editing the registry may severely damage your system. At the very least, you should back up any valuable data on the computer before making changes to the registry.

Important

  • After this procedure is completed, when the security log becomes full, Windows 2000 will stop responding and will display the message "Audit Failed." To recover when Windows 2000 stops, the security log must be cleared. For more information, see Related Topics.

Notes

  • You must be logged on as administrator or as a member of the Administrators group in order to complete this procedure.
  • To open Event Viewer, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Event Viewer.
  • If Windows 2000 halts as a result of a full security log, the system must be restarted and you must repeat this procedure if you want a full log to stop the computer in the future.
  • To start Registry Editor, click Start, click Run, type regedit, and then click OK. For more information about Registry Editor, on the Registry Editor Help menu, click Help Topics.

Related Topics


Concepts

This section provides general background information about Event Viewer:

  • Using Event Viewer
  • Interpreting an event
  • Viewing and archiving log files
  • Monitoring security events


Event Viewer overview

Using the event logs in Event Viewer, you can gather information about hardware, software, and system problems, and you can monitor Windows 2000 security events.

Windows 2000 records events in three kinds of logs:

Application log

The application log contains events logged by applications or programs. For example, a database program might record a file error in the application log. The program developer decides which events to record.

System log

The system log contains events logged by the Windows 2000 system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. The event types logged by system components are predetermined by Windows 2000.

Security log

The security log can record security events such as valid and invalid logon attempts as well as events related to resource use such as creating, opening, or deleting files. An administrator can specify what events are recorded in the security log. For example, if you have enabled logon auditing, attempts to log on to the system are recorded in the security log.

Event Viewer displays these types of events:

Error

A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an error will be logged.

Warning

An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a warning will be logged.

Information

An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.

Success Audit

An audited security access attempt that succeeds. For example, a user's successful attempt to log on the system will be logged as a Success Audit event.

Failure Audit

An audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.

The EventLog service starts automatically when you start Windows 2000. All users can view application and system logs. Only administrators can gain access to security logs.

By default, security logging is turned off. You can use Group Policy to enable security logging. The administrator can also set auditing policies in the registry that cause the system to halt when the security log is full.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Using Event Viewer

Using Event Viewer and event logs, you can gather information about hardware, software, and system problems and monitor Windows 2000 security events.

Windows 2000 records events in three kinds of logs:

Application log

The application log contains events logged by programs. For example, a database program might record a file error in the programs log. Program developers decide which events to monitor.

Security log

The security log contains valid and invalid logon attempts as well as events related to resource use, such as creating, opening, or deleting files or other objects. For example, if you have enabled logon and logoff auditing, attempts to log on to the system are recorded in the security log.

System log

The system log contains events logged by the Windows 2000 system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. The event types logged by system components are predetermined by Windows 2000.

Notes

  • The EventLog service starts automatically when you start Windows 2000.
  • Application and system logs can be viewed by all users. Security logs are accessible only to system administrators.
  • By default, security logging is turned off. To enable security logging, use Group Policy to set the Audit policy. The administrator can also set auditing policies in the registry that cause the system to halt when the security log is full.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Interpreting an event

This section covers:

  • The event header
  • The event description


The event header

The event header contains the following information:

Information | Meaning
Date | The date the event occurred.
Time | The local time the event occurred.
User | The user name of the user on whose behalf the event occurred. This name is the client ID if the event was actually caused by a server process, or the primary ID if impersonation is not taking place. Where applicable, a security log entry contains both the primary and impersonation IDs. (Impersonation occurs when Windows 2000 allows one process to take on the security attributes of another.)
Computer | The name of the computer where the event occurred. The computer name is usually your own, unless you are viewing an event log on another Windows 2000 computer.
Event ID | A number identifying the particular event type. The first line of the description usually contains the name of the event type. For example, 6005 is the ID of the event that occurs when the Event log service is started. The first line of the description of such an event is "The Event log service was started." The Event ID and the Source can be used by product support representatives to troubleshoot system problems.
Source | The software that logged the event, which can be either a program name, such as "SQL Server," or a component of the system or of a large program, such as a driver name. For example, "Elnkii" indicates an EtherLink II driver.
Type | A classification of the event severity: Error, Information, or Warning in the system and application logs; Success Audit or Failure Audit in the security log. In Event Viewer's normal list view, these are represented by a symbol.
Category | A classification of the event by the event source. This information is primarily used in the security log. For example, for security audits, this corresponds to one of the event types for which success or failure auditing can be enabled in Group Policy.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


The event description

The format and contents of the event description vary, depending on the event type. The description is often the most useful piece of information, indicating what happened or the significance of the event.

The event logs record five types of events:

Event type | Description
Error | A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an error will be logged.
Warning | An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a warning will be logged.
Information | An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.
Success Audit | An audited security access attempt that succeeds. For example, a user's successful attempt to log on the system will be logged as a Success Audit event.
Failure Audit | An audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.

Notes

  • If used, the optional data field contains binary data, which can be displayed in bytes or words. This information is generated by the program that was the source of the event record. The data appears in hexadecimal format. Its meaning can be interpreted by a support technician familiar with the source program.
  • When viewing an application or system log on a LAN Manager 2.x server, only the date, time, source, and event ID are shown. When viewing a security log on a LAN Manager 2.x server, only the date, time, category, user, and computer are shown.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event header
  • Setting options for logging events


Viewing and archiving log files

This section covers:

  • Finding specific logged events
  • Setting options for logging events
  • Archiving a log


Finding specific logged events

After you select a log in Event Viewer, you can:

Search for events

Searches can be useful when you are viewing large logs. For example, you can search for all Warning events related to a specific application, or search for all Error events from all sources. To search for events that match a specific type, source, or category, on the View menu, click Find.

The options available in the Find dialog box are described below in the table about Filter options.

Filter events

Event Viewer lists all events recorded in the selected log. To view a subset of events with specific characteristics, on the View menu, click Filter, and then, on the Filter tab, specify the criteria you want.

Filtering has no effect on the actual contents of the log; it changes only the view. All events are logged continuously, whether the filter is active or not. If you archive a log from a filtered view, all records are saved, even if you select a text format or comma-delimited text format file.

The following table describes the options available in the System Log Properties dialog box.

Use | To filter for
View Events From | Events after a specific date and time. By default, this is the date of the earliest event in the log file.
View Events To | Events up to and including a specific date and time. By default, this is the date of the latest event in the log file.
Information1 | Infrequent significant events that describe successful operations of major services. For example, when a database program loads successfully, it might log an Information event.
Warning1 | Events that are not necessarily significant but that indicate possible future problems. For example, a Warning event might be logged when disk space is low.
Error1 | Significant problems, such as a loss of data or loss of functions. For example, an Error event might be logged if a service was not loaded during Windows 2000 startup.
Success Audit1 | Audited security access attempts that were successful. For example, a user's successful attempt to log on to the system might be logged as a Success Audit event.
Failure Audit1 | Audited security access attempts that failed. For example, if a user tried to access a network drive and failed, the attempt might be logged as a Failure Audit event.
Source2 | A source for logging events, such as an application, a system component, or a driver.
Category3 | A classification of events defined by the source. For example, the security event categories are Logon and Logoff, Policy Change, Privilege Use, System Event, Object Access, Detailed Tracking, and Account Management.
User3 | A specific user that matches an actual user name. This field is not case sensitive.
Computer3 | A specific computer that matches an actual computer name. This field is not case sensitive.
Event ID2 | A specific number that corresponds to an actual event.

1 This option is not available for LAN Manager 2.x servers.

2 This option is not available for audit logs on LAN Manager 2.x servers.

3 This option is not available for error logs on LAN Manager 2.x servers.

Sort events

By default, Event Viewer sorts events by date and time of occurrence from the newest to the oldest. To specify a sort order, on the View menu, click Newest First or Oldest First.

The default sort order is Newest First. When a log is archived, the default sort order is saved.

View details about events

For many events, you can view more information by double-clicking the event.

The Event Properties dialog box shows a text description of the selected event and any available binary data. Binary data, which appears in hexadecimal format, is information generated by the program that is the source of the event record. A support technician familiar with the source program can interpret its meaning. Not all events generate binary data.

To control the types of security events that are audited, in Group Policy, go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy. To control the auditing of files and folders, display the Properties of a file or folder.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Setting options for logging events

Application and system logging start automatically when you start the computer. Logging stops when an event log becomes full and cannot overwrite itself, either because it has been set for manual clearing or because the first event in the log is not old enough. You use Group Policy to set up security logging.

To define logging parameters for each kind of log, in the Event View console tree, right-click the type log, and then click Properties. On the General tab, you can set the maximum size of the log and specify whether the events are overwritten or stored for a certain period of time.

The default logging policy is to overwrite logs as needed, provided events are at least 7 days old. You can customize this policy for different logs.

The Event log wrapping options include the following.

Use | To
Overwrite events as needed | Have new events continue to be written when the log is full. Each new event replaces the oldest event in the log. This option is a good choice for low-maintenance systems.
Overwrite events older than [x] days | Retain the log for the number of days you specify before overwriting events. The default is 7 days. This option is the best choice if you want to archive log files weekly. This strategy minimizes the chance of losing important log entries and at the same time keeps log sizes reasonable.
Do not overwrite events | Clear the log manually rather than automatically. Select this option only if you cannot afford to miss an event (for example, for the security log at a site where security is extremely important).

Notes

  • When a log is full and no more events can be logged, you can free the log by clearing it. Reducing the amount of time you keep an event also frees the log if it allows the next record to be overwritten.
  • Each log file has an initial maximum size of 512 KB. You can increase the maximum log size to the capacity of the disk and memory, or you can decrease the maximum log size. Before decreasing a log's size, you must clear the log.


Archiving a log

When you archive an event log, you save it in one of three file formats:

  • Log-file format (*.evt), which enables you to view the archived log again in Event Viewer.
  • Text-file format (*.txt), which enables you to use the information in a program such as a word processing program.
  • Comma-delimited text-file format (*.csv), which enables you to use the information in a program such as a spreadsheet or a flat-file database.

The event description is saved in all archived logs. The sequence of data within each individual event record is recorded in the following order:

Order | Data Type
1. | Date
2. | Time
3. | Source
4. | Type
5. | Category
6. | Event
7. | User
8. | Computer
9. | Description

Notes

  • Binary data is saved if you archive a log in log-file format, but it is discarded if you archive the log in text or in comma-delimited file format.
  • Archiving has no effect on the current contents of the active log. To clear the original log, you must click Clear all Events on the Action menu.
  • To remove an archived log file, delete the file as you would other kinds of files.

For more information, see:

  • View more details about an event
  • Set event logging options
  • The event description
  • Setting options for logging events


Monitoring security events

  • Monitoring Windows 2000 security events
  • Managing the audit policy
  • Auditing file and folder access
  • Halting the computer when the security log is full


Monitoring Windows 2000 security events

Through auditing, which you enable in Group Policy, you can track Windows 2000 security events. You can specify that an audit entry is to be written to the security event log whenever certain actions are performed or files are accessed. The audit entry shows the action performed, the user who performed it, and the date and time of the action. You can audit both successful and failed attempts at actions, so the audit trail can show who performed actions on the network and who tried to perform actions that are not permitted.

Events are not audited by default. If you have Administrator permissions, you can specify what types of system events are audited through Group Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.

For file and object access, you can then specify which files and printers to monitor, which types of file and object access to monitor, and for which users or groups. For example, when Audit Object Access is enabled, you can use the Security tab in a file or folder's Properties dialog box (accessed through Windows Explorer) to specify which files to audit and what type of access events to audit for those files.

Note

  • You can audit file and folder access only on NTFS drives.

For more information, see:

  • To set, view, change, or remove auditing for a file or folder


Managing the audit policy

Windows 2000 can record a range of event types, from a system-wide event such as a user logging on to an attempt by a particular user to read a specific file. Both successful and unsuccessful attempts to perform an action can be recorded.

You use the audit policy to select the types of security events to be audited. When such an event occurs, an entry is added to the computer's security log. You use Event Viewer to view the security log.

Because the security log is limited in size, select the events to be audited carefully, and consider the amount of disk space you are willing to devote to the security log. The maximum size of the security log is defined in Event Viewer.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Auditing file and folder access

You can audit file and folder access on NTFS volumes to identify who took various types of actions with the files and folders.

When you audit a file or folder, an entry is written to the Event Viewer security log whenever the file or folder is accessed in a certain way. You specify which files and folders to audit, whose actions to audit, and what types of actions are audited.

To set auditing on a file or folder, use Group Policy to enable auditing, and then use Windows Explorer to specify which files to audit and which type of file access events to audit.

You can audit successful and failed attempts of the following types of directory and file access:

Types of directory access | Types of file access
Displaying names of files in the directory | Displaying the file's data
Displaying directory attributes | Displaying file attributes
Changing directory attributes | Displaying the file's owner and permissions
Creating subdirectories and files | Changing the file
Going to the directory's subdirectories | Changing file attributes
Displaying the directory's owner and permissions | Running the file
Deleting the directory | Deleting the file
Changing directory permissions | Changing the file's permissions
Changing directory ownership | Changing the file's ownership

Note

  • To audit files and directories, you must be logged on as a member of the Administrators group.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Halting the computer when the security log is full

You can ensure that all auditable activities are logged by halting the computer when the security log is full. To do so, set the security log either to Overwrite Events Older Than n Days or Do Not Overwrite Events (Clear Log Manually).Then use the Registry Editor to create or assign the following registry key value:

Hive: | HKEY_LOCAL_MACHINE\SYSTEM
Key: | \CurrentControlSet\Control\Lsa
Name: | CrashOnAuditFail
Type: | REG_DWORD
Value: | 1

The changes take effect the next time the computer is started.

Notes

  • If Windows 2000 halts as a result of a full security log, the system must be restarted and reconfigured to continue to prevent auditable activities from occurring while the log is full.
  • After the system is restarted, only administrators can log on until the security log is cleared.
  • To capture registry changes in your backup procedures, be sure to include System State data in the Backup set when you run Backup.

For more information, see:

  • View more details about an event
  • Archive an event log
  • Set event logging options
  • The event description
  • Setting options for logging events


Troubleshooting

This section provides information about troubleshooting with Event Viewer:

  • Recover when Windows 2000 stops
  • Using event logs to troubleshoot problems


Recover when Windows 2000 stops

To recover when Windows 2000 stops

  1. Restart the computer and log on using an account in the Administrators group.
  2. Open Event Viewer, archive the currently logged security events (if desired), and then clear all events from the security log.
  3. Open Registry Editor and locate the following key:

    4. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  4. Delete and replace the CrashOnAuditFail value, using data type REG_DWORD and a value of 1.
  5. Exit Registry Editor and restart the computer.

Caution

  • Incorrectly editing the registry may severely damage your system. At the very least, you should back up any valuable data on the computer before making changes to the registry.

Notes

  • If the registry was previously configured with CrashOnAuditFail = 1 and the security log becomes full, Windows 2000 will stop responding and will display the message "Audit Failed." If that happened, use the procedure above.
  • To start Registry Editor, click Start, click Run, type regedit, and then click OK. For more information about Registry Editor, on the Registry Editor Help menu, click Help Topics.
  • To capture registry changes in your backup procedures, be sure to include System State data in the Backup set when you run Backup.

Related Topics


Using event logs to troubleshoot problems

Careful monitoring of event logs can help you predict and identify the sources of system problems. For example, if log warnings show that a disk driver can only read or write to a sector after several retries, the sector is likely to go bad eventually. Logs can also confirm problems with software. If a program crashes, a program event log can provide a record of activity leading up to the event.

The following suggestions may help you use event logs to diagnose problems:

Archive logs in log format

The binary data associated with an event is saved if you archive the log in log format (*.evt), but is discarded if you archive data in text (*.txt) or comma-delimited (*.csv) format. The binary data may help a developer or technical support specialist identify the source of a problem.

Note Event IDs

These numbers match a text description in a message file. The numbers can be used by product support representatives to understand what occurred in the system.

Hardware problems

If you suspect a hardware component is the origin of system problems, filter the system log to show only those events generated by the component.

System problems

If a particular event seems related to system problems, try searching the event log to find other instances of the same event or to judge the frequency of an error.

Related Topics


Viewing event logs

  • Refresh an event log
  • View more details about an event
  • Search for specific events
  • Add another view of an event log
  • Select another computer


Managing event logs

  • Clear an event log
  • Archive an event log
  • Open an archived event log
  • Free an event log when it is full


Customizing event logs

  • Specify a sort order in an event log
  • Filter events in an event log
  • Set event logging options
  • Reset an event log to default settings
  • Change the size of an event log


Using the security log

  • Turn on security logging
  • Turn on security logging for a domain controller
  • Set up auditing of files and folders
  • Specify files and folders to audit
  • Halt the computer when the security log is full