Skip to Main Content
Windows Server Cookbook
book

Windows Server Cookbook

by Robbie Allen
March 2005
Intermediate to advanced content levelIntermediate to advanced
698 pages
19h 13m
English
O'Reilly Media, Inc.
Content preview from Windows Server Cookbook

Chapter 8. Event Logs

Introduction

Event logs provide a standard way for the operating system, services, and applications to record important actions (e.g., application failure), report status messages, keep track of security events, and log boot up messages. In this way, event logs are similar to syslog on the Unix and Linux platforms. They can be an extremely useful resource when you need to troubleshoot specific issues and are often the first places I look when trying to diagnose a problem. As a proactive measure, scan the event logs on your servers frequently to identify any problems that are logged, but may not have resulted in a failure caught by your monitoring software.

Using a Graphical User Interface

There are two graphical tools that you should be familiar with for querying and viewing event log messages. Event Viewer (eventvwr.msc) has been around since the days of Windows NT and is provided out of the box under Administrative Tools. It is a simple MMC snap-in that lets you view and filter messages in the available event logs. You can also view the event logs on a remote server with it, but depending on the log size on the remote server and your network connection, this can be a painfully slow process.

As part of the Windows Server 2003 Resource Kit, Microsoft made the Event Comb utility (eventcombmt.exe) publicly available. Event Comb is a powerful utility that lets you search the event logs across multiple servers at once. With it, you can restrict your search by event ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Windows 10 Troubleshooting

Windows 10 Troubleshooting

Mike Halsey
Windows® Sysinternals Administrator’s Reference

Windows® Sysinternals Administrator’s Reference

Mark E. Russinovich and Aaron Margosis
Windows Server® 2012 Unleashed

Windows Server® 2012 Unleashed

Rand Morimoto, Michael Noel, Guy Yardeni, Omar Droubi, Andrew Abbate, Chris Amaris

Publisher Resources

ISBN: 0596006330Errata Page