Viewing Event Logs

The Application, System, Security, and Setup logs are now located under the Windows Logs node in the Event Viewer tree view. An event summary view including the name, type, number of events, and size of each log is displayed when this node is selected. To view events in a log, select the log you want to view in the left pane.

Hardware Events, Windows Internet Explorer, and other Windows components and application events are accessible under the Applications And Services Logs node. Applications And Services Logs are a new category of event logs that store events from a single application or component rather than events that might have system-wide impact. Normally, available application or service logs will be listed in a hierarchy under the manufacturer and product name. (Some event providers that do not follow the naming convention that allows such categorization may show up directly under the Applications And Services node.) A summary view, including the name, type, number of events, and size of each log, is displayed when the Applications And Services node or any subnode that contains logs is selected in the Event Viewer tree view. If other applications are installed, such as Microsoft Office 2007 applications, additional Applications And Services Logs may be displayed.

As explained previously, Application and Services Logs include four log subtypes: Admin, Operational, Analytic (trace), and Debug logs. Events in Admin logs are of particular interest to IT professionals who use Event Viewer to troubleshoot problems, because events in the Admin log provide guidance on how to respond to the event. Events in the Operational log are also useful for IT professionals but sometimes require more interpretation.

Analytic and Debug logs are not as user friendly and are mostly designed to be used by advanced administrators and developers. Analytic logs store events that trace an issue, and often a high volume of events are logged. Debug logs are used by developers when debugging applications. Both Analytic and Debug logs are hidden by default. If you will be working with these types of logs and want to see them in the Event Viewer, select the Show Analytic And Debug Logs menu option from the View item on the Actions pane. Then, to turn logging into a particular Analytic or Debug log on or off, select the log of interest and click Enable Log or Disable Log on the Actions pane. Alternatively, you can also enable or disable Analytic and Debug logs by typing wevtutil sl log_name /e:true at an elevated command prompt. For more information concerning Wevtutil.exe, see the section titled "Using the Windows Events Command-Line Utility for Event Monitoring" later in this tutorial.

Important When you enable Analytic (trace) and Debug logs, they usually generate a large number of entries. For this reason, you should enable them only for a specified period to gather troubleshooting data and then turn them off to reduce the associated overhead.

You can view the events in a log by highlighting the log you want to view in the left pane. Most Microsoft components that have their own channel are displayed under the Microsoft node.

Note By right-clicking an event and selecting Attach Task To This Event, you can open the Task Scheduler Wizard with the Event Log, Event Source, and Event ID fields automatically pre-populated. Doing this lets you attach any task to an event by using Task Scheduler. For more information, see the section titled "Using Task Scheduler" later in this tutorial.