Locate windows event files

At the same time, it will also bring you some unexpected damages such as data loss. Thus, it is strongly recommended that you back up your crucial files before or after upgrading to Win11 with a robust and reliable program like MiniTool ShadowMaker , which will assist you to protect your increasing data automatically on schedules!

Free Download. Read More. In the event log entry shown in the following image, it quickly becomes obvious that the key values required for the FilterHashTable parameter and the values that show up in the graphical user interface do not match up.

This view appears to have a bit more relevance. For example, I can tell that the Level: Information of the event log entry seen in the figure above is the same as the level 4 that is displayed in the XML view shown in the following image. If I want to search for data that shows up in the Details portion of the Event properties, I must include the entire string, typed exactly as it appears. This is because the Data portion of the FilterHashTable does not accept a wildcard character.

Outlook will restore the connection when possible. Connection to Microsoft Exchange has been lost. I can search for only event ID 26, as shown here, but the problem is that event ID 26 includes not only the connection lost but also the connection restored message detail. If I want to determine the total number of disconnections during the course of my event log, I can pipe the results to the Measure-Object cmdlet and divide the number by two to account for connection lost and restored—not precise, but better than typing out the entire text of the detail message.

From looking at the above data, I can also surmise that one day, I lost connection and it was never restored. If I really cared, I could parse the data further to discover when that date occurred. I then use the Get-WinEvent Windows PowerShell cmdlet to examine each saved log to look for errors in the log that occur between January 14, , and January 15, This is an example of the type of script one might use to quickly peruse archived daily event logs.

As the script currently stands, the script does not accept input parameters for the start time and end time or for the path to the stored logs, but that is an easy change to make. This information is very helpful in troubleshooting services and other issues, or to investigate a security problem. Windows references logs as events, while Plesk and most other systems call them logs.

For standardization, they call them logs in this article. Follow below to see how you can use the event viewer to review your logs and investigate issues. The first step in accessing the Event Viewer is to connect to your server.

Gaining access to the server is accomplished through the Console button in Manage, or through a manual RDP connection. Once you have connected to your Windows server , you will need to log in to your administrator account.

Once logged in, click the Start menu, then Event Viewer. The event viewer is a system application included on all versions of Windows servers. This program allows you to view logs recorded to it by applications and the system.

The event viewer has four main views you will see when you first launch the application:. For this article, we will focus mainly on the Windows Logs. The project you are hosting may have you reference the application logs for programs you use, which may be outside the scope of this article.

All logs are assigned an event level. This event level denotes the severity or seriousness of any issues noted in the logs. The default view of the list below is by acuity. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows. Click the subkey that represents the event log that you want to move, for example, click Application.

Type the complete path to the new location including the log file name in the Value data box, and then click OK. For example, if you want to move the application log Appevent. Click Start , point to Settings , and then click Control Panel. Double-click Administrative Tools , and then double-click Event Viewer. For more information about how to view and manage logs in Event Viewer, see the following article:.

To do so, click the Action menu in Event Viewer, and then click Help. Skip to main content. This browser is no longer supported.