Understanding Event Logs

by Barry Dysert
(last updated May 30, 2016)

2

Event logs are like system files to which certain information is written by programs that have no other means of output. For example, a Windows service runs without a user interface, so when the service wants to output a message it does so by writing to an event log. You run the Event Viewer in order to see what all has been written to the event logs over time.

The four most common event logs are Application, Security, Setup, and System, although there are many others. And you can create custom views of the logs so that you can easily pinpoint exactly the information you're looking for. For example, there is an event log called Microsoft | Windows | Diagnostics-Performance | Operational. This log contains information about boot-up performance. If you want a quick way to view what events are causing your system to boot more slowly than you'd like, you can create a custom view (or a filter) to look at that log and only display the "101" events (each type of event has an event ID, and event ID 101 is for slow application startups).

In addition to viewing events in real time, you can create files on disk that contain the event information. Then, you can view those saved logs at a later time.

Event logs are good resources for system administrators, and they're also good for programmers. You may write a Windows service that has no user interface, but you want to capture some important information that it provides. One way to do this is to have the service write to an event log.

Another thing you can do with event logs is to attach a task to a log or even a particular event so that when that log is written to (or that event fires), your task can be activated.

 This tip (11564) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...

MORE FROM BARRY

Changing How User Account Control Works

The User Account Control (UAC) model allows an administrator to control when (or if) they are to be notified when a ...

Discover More

Controlling the Display of System Icons in the Notification Area

A sometimes overlooked area of Windows customization is the notification area. This tip explains how you can control the ...

Discover More

Renaming Multiple Files at the Same Time

It's possible to rename multiple files at the same time, but the new names of the files may leave a bit to be desired. ...

Discover More
More WindowsTips

Adjusting the Size of an Event Log

Event logs are used to store information about what goes on, behind the scenes, on your system. Whether you want to ...

Discover More

Using the Event Viewer to Examine Remote Event Logs

Assuming you have proper access to remote computers, you can examine their event logs from your system without much ...

Discover More

What is the Purpose of the Forwarded Events Event Log?

The Forwarded Events event log collects events that have been forwarded from other computers. In this way you can login ...

Discover More
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

View most recent newsletter.

Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is one more than 2?

2016-06-01 10:44:24

David H.

Lou: I agree with you. It does leave you "hanging". I think it was an oversight and he forgot to mention that he continued his article here - http://windows.tips.net/T011565_Viewing_Event_Logs.html?awt_l=DrM9c&awt_m=3Xf1SOM.wfKV74X


2016-05-30 09:05:27

Lou Jones

Good information--as far as it went. I was hoping to see something more practical, such as how to interpret the information in the logs, or at least some links to that information.


Newest Tips
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

(Your e-mail address is not shared with anyone, ever.)

View the most recent newsletter.