Comments for What is the Event Viewer, and should I care?

Comment from Mike Maus on 2009-04-02

2009-04-02T16:33:17Z

Thanx Leo! It's amazing that people who can write complex computer programs in code often seem to have great difficulty documenting their programs in a spoken language. It never occurred to me to right click a line in the event viewer, and apparently it never occurred to Microsoft to suggest it, either.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Judy on 2009-01-01

2009-01-01T20:19:36Z

To me, the most mystifying thing about the Event Viewer is what programs were involved. I had one triggering off every 5 minutes, but it wasn't at all obvious what it was and a Google search came up with anything from malware to system and needed. Someone else suggested it was Symantec's updater, and once I eliminated everything that smelled of Symantec on my system that log entry went away. Makes me feel good not to be cluttering up stuff with unnecessary internet requests.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Rakesh on 2008-07-29

2008-07-29T11:23:13Z

Can we write the data in to the event viewer in windows operating system..if yes.. How???

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from sekar on 2008-07-07

2008-07-08T06:54:24Z

EventViewer
i have system events has more error files.how to trouble shooting this error.
error message:cant register the ip address
can u help me

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Aditya on 2008-06-10

2008-06-10T11:43:45Z

Hi, I have written a windows service with a code for logging any info/errors into the eventlog. The event source is not getting created/displayed. The message that I am getting in the application source is that the event source was created but the node is not displayed in the viewer.
Any advice

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Debbie Barras on 2008-04-23

2008-04-23T14:46:05Z

I don't actually see an answer to Leo's question about the anonymous logon. I also have that line item in the audit section of the event viewer. If anyon know where it is coming from or if it is nothing to worry about I would apprciate it if they could send a reply....thanks

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Henry Veldman on 2007-11-28

2007-11-28T15:08:54Z

I have an "illegal" entry in the event log and it seems to have rendered it inoperative. I was experimenting with a VB program and in trying to write to the event log, I inadvertently created a new category. The new category is actually something that looks like a global.asa entry: "Data Source=mis-sql;InitialCatlog=TimeEntry...." (more stuff)
I do not know how to remove it.
Even worse, in IIS, my Default Web Site service is stopped and will not start.

Any advice, including reinstall IIS, is appreciated.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from carl on 2007-11-23

2007-11-24T06:23:37Z

The event log shows action 6006 (log off?) when I was out. I suspect someone is using my computer while I am at work. Shouldn't there be a corresponding action 6005 (log on?) action? does this mean they have deleted the log on action but forgotten about the 6006? Thanks for your comments...

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Kofi Ampaabeng on 2007-07-19

2007-07-19T10:21:45Z

Is there a way for me to know which files have been accessed and copied from my pc using the Event Viewer?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from James on 2007-04-24

2007-04-25T02:35:08Z

Hi Leo,
I have this error msg, 'Proccess Notification: Failed to send the mail message error code: -49'. May I know what is that means? Thanks.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Rob on 2007-04-19

2007-04-20T03:15:42Z

Hi Leo
Just started working with Server 2003 and found that the Security event log registers Success Audits about Logon/Logoff events on the server , but I know for a fact that these accounts are not being used by anyone (I only set them up recently to test, but have not given them to anyone). Have you come acros this yourself before?
Thank you

Rob

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Peter E Avon on 2007-03-03

2007-03-03T13:57:33Z

I often check the event viewer and I get a lot of warnings but I could never find any explanation for them and they just keep on building up....Can I delete them all???

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from James McKechnie on 2007-01-22

2007-01-22T11:52:39Z

how do i erase events in 'events viewer'?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo Notenboom on 2006-12-18

2006-12-18T16:39:54Z

Yes it does.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Ciara on 2006-12-18

2006-12-18T10:01:05Z

Does the computer need to be switched on for the event viewer to log issues etc? There are a lot of entries for times when I'm at work so I suspect someone is using my Pc when I'm out of the house.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from sharon leech on 2006-12-11

2006-12-11T14:25:40Z

Leo, I'm getting a WinVNC4 error - Sconnection:Authfailure exception: Authentication failure - in my eventviewer logs and want to know how to stop this error from being logged. Have you any ideas please.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo A. Notenboom on 2006-10-01

2006-10-01T17:03:46Z

Depends entirely on the specific error message(s).

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Clive Luxton on 2006-10-01

2006-10-01T16:46:08Z

Leo
Can you tell me how to rid my pc from the error boxes that pop up every time i boot up

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tim Kulogo on 2006-07-17

2006-07-17T16:32:15Z

I ghosted a 20gig drive to a 40gig and I couldn't copy or move files with the 40gig running until I disabled the event log service, then it seems to run fine. I'm running Windows 2000 SP4, and I used Ghost 2003. Do you have an explanation?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-06-27

2006-06-27T21:48:46Z

A quick google search seems to indicate that's a device driver of some sort. You'll probably have to figure out what device it is you have that it might apply to.

You can certainly go into service manager, (Right click on My Computer, click on Manage, click on services) and look for a service by that name and change it to "disabled".

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Carlos on 2006-06-27

2006-06-27T19:29:57Z

I get an error on the event viewer that says "The ACCESNT service failed to start due to the following error: The system cannot find the file specified." Any idea how to fix this error (or at least stop it from showing up on the Event Viewer)??

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-06-21

2006-06-22T03:53:50Z

Right click on the log (Application, System or Security - which ever is filling up), and select Properties. You can then set how it should deal with overflow. I know of no way to actually stop the events from being logged.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from denise on 2006-06-20

2006-06-20T16:21:56Z

My event viewer is filling up with print job information IE: everything someone prints an event is displayed in the event viewer anyway of stopping this as it fills up to max size everyday

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from James on 2006-06-06

2006-06-06T14:48:40Z

Hi,

I have noticed that my applicatio event log on Windows xp sp2 only goes back to 2-16-06. the current date is 6-6-06. Is theres something wrong with my MMC console where the application event logs are not being logged anymore?

Thanks,
james

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from vincent on 2006-05-11

2006-05-12T06:06:54Z

Hello Sir,
I am very much interested in knowing more about event viewer and troubleshooting. Could you please guide me and refer some links about this.

Thanks & regards,

J Anthony Vincent.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from shivaprakash on 2006-05-10

2006-05-10T10:56:39Z

dear sir i am using win2003 server , i am no able to open windows eventviwer.what is the problem while i was logged on administrator eerror showing on the windows desktop.plz solve this problem..
with regards.
k.shivaprakash

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-04-05

2006-04-05T22:35:49Z

In eventviewer, right click on the log that's filling up, hit "Properties" and then change the "Log Size" parameter to overwrite as needed.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Richard on 2006-04-05

2006-04-05T22:31:56Z

I have 2 users with laptops that when their event logs fill up will not allow them to log back on until an administrator (me) logs in and clears them. Can you help me figure out how to fix this?
Thanks Leo!

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Michael on 2006-03-31

2006-03-31T22:03:32Z

Can you replace the system log or import a saved copy of it??

Thanks

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jagerbobb on 2006-01-12

2006-01-12T14:39:06Z

I found an "old" print-out with following in it.
TIME-------EVENT-------INTRUDER-------COUNT. UNDER these headers are: TIME (9/28/2003__3:11:19 A (U or T)(C-or- D)P.
Probe_Other;SSRP SLAMMER and many others! To me, this sounde intrusive and possibly highly illegal!

INTRUDER_(One Each) c-24-1158-197-52.mn.cli; OEMCOMPUTER; syr-24-59-49-90-twcny.c??; Others are:SSRP_SLAMMER. Finally,is the "Count", i.e. 1- as high as 46!!

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from d@vid on 2006-01-05

2006-01-05T11:05:36Z

and a tip for anyone wanting to find more info on an error - you can look up descriptions and user feedback for specific EventID/Source combinations at www.eventid.net

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from d@vid on 2006-01-05

2006-01-05T10:56:26Z

we're using the event log to capture errors in our development project (go us!) - however on two different machines running the same application event viewer displays different descriptions: one always prefixes the description with "The Description for Event ID (0) ... cannot be found", and the other doesn't - any ideas why? (searching on the web returns results with this string but not a reason why it occurs)

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-11-28

2005-11-29T05:24:08Z

Not that I'm aware of, no. Right now I don't have any good suggestions either.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Joseph on 2005-11-28

2005-11-29T05:21:36Z

Im a System Administrator on our company. We are using Windows 2000 as an OS to our network, Time and date on our desktop is very important. Does time and date changing is possible to create a log on event viewer? Is there any way to detect if the user change time and date on their desktop? Thanks a lot... i would really appreciate for your help.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Slava on 2005-10-23

2005-10-23T18:15:52Z

My Event Viewer (XP SP2) doesn't show any new events. Here is the last message in Application even log: "Windows saved user MY-LAPTOP\IKK registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account."

I would appreciate any advise how to unfreeze the Event Viewer.

Thanks,
Slava

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Peter on 2005-09-30

2005-09-30T21:28:31Z

REF: Diskeeper if you get the 1920 error goto sevices and start event log service this should solve it

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-07-06

2005-07-07T03:49:18Z

Sound like the window's open, but not visible. Perhaps it's off screen? After you double click on the event viewer line, press ALT+Space, then M, then use the arrow keys to see if the window comes into view. If it does, just click on it and then it *should* appear on screen in the future.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jim Andrew on 2005-07-06

2005-07-06T14:34:24Z

Leo,
When I double click on the one of the event lines on one of my Windows 2000 servers, nothing happens. Then when I try to close Event viewer, I get a dialog box telling me to close the window that never opened. I have to use Task Manager to shut it down. What makes this happen?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-06-26

2005-06-27T04:25:06Z

You can delete if you like. Or not. Unless there's a message about the log being full, you don't really need to.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from CJ Shafer on 2005-06-26

2005-06-27T00:22:15Z

Should I leave all these listing (I had 1800)in applications and systems or should I deleat them?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Judson on 2005-06-24

2005-06-24T21:55:43Z

I was working on a computer with the same problem that Tony is having. I discovered that in the registry under HKLM\SYSTEM\CurrentControlSet\Services\Eventlog
the settings for the three logs were missing. I exported the key from a working XP installation, edited the .reg file that was created so the the computer name in the first section matched the name of the broken computer, and merged the file into the corrupted registry. After a reboot, everything was fine.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Angela on 2005-04-28

2005-04-28T20:07:25Z

[Copyrighted information removed. Visit this link instead: http://support.microsoft.com/?kbid=111720 -Leo]

So go to %SYSTEMROOT%\SYSTEM32\CONFIG directory and check proporties. My guess they are read only and you have to change it to read -write permissions.
Angela

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tony on 2005-04-12

2005-04-13T05:23:47Z

Ah, sorry about that url. Its this one.
http://www.softwareshelf.com/files/supportFAQView.asp?ID=1482

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tony on 2005-04-12

2005-04-13T05:21:57Z

I found this on the diskeeper 1920 error.
http://a9.com/XP%20eventlog%20service%20missing
It doesn't help me though.
My eventlog is still missing. Although I can see the diskeeper services trying to start if you follow the article through.

It may not be an SP2 problem. I only noticed it after I installed SP2.
Like you bst, I can see the logs. Open them in notepad etc. But I cannot view them in the EVENT VIEWER. I get an INTERFACE IS UNKNOWN error.
I cannot see an SNMP Trap Service.
This install is only a month old. That's what's got me bushed.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from bst on 2005-04-11

2005-04-11T21:25:22Z

doubt it is strictly an sp2 problem. i am experiencing the same problem on a windows 2000 box and a windows 2000 server box.

you can even navigate to c:\winnt\system32\config and see that the .evt logs are there and certainly not empty. (you can copy the file and open with wordpad to verify it's not empty.) even when i try to open this copied file through event viewer, it does not list anything, although at the top it says there are 6,223 events.

checked all my dependencies and did notice that the SNMP Trap Service was not started. still same problem after i started it.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Phk on 2005-04-11

2005-04-11T08:53:14Z

I have the same problem using Diskeeper...

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tony on 2005-04-07

2005-04-07T13:38:12Z

Me too.
I've come across half a dozen people reporting this same problem. but no answers.
I had tried sfc already. It certainly replaced all the system files. But didn't fix the problem.
I think the errorlog might be running in the background somewhere because I used PROCESS EXPLORER and it has this line:
HKLM\SYSTEM\ControlSet001\Services\Eventlog
But I don't have the eventlog listed as a service, I can't actually view the event logs in the viewer.
I first noticed this when I tried to install Diskeeper.
Clearly, something has done this. SP2, or ??

Diskeeper installation reports that "the Diskeeper Service failed to start. Verify that you ahve sufficient privileges to start system services."
But I am the administrator. Something has fooled with my services. But I'm at a loss to know what. And I so hate to reinstall....
Thanks
tony

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-04-05

2005-04-06T04:13:23Z

Wow. I'm surprised XP runs without it. I would try the system file checker first http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tony on 2005-04-05

2005-04-06T04:06:17Z

Hi Leo,
What I meant was there is no 'Event Log' service. IE, when I do what you say to do here, there is no service there to start up!
So its totally missing from my list of services.

And in the 'event viewer' there are three events I can see,
Application
Security
System
But when I click on them I get the error I mention.
Probably because there is no EVENT LOG service, so it can't be switched on.

Now I can't think how it got lost. So I was wondering whether you knew how to reinstall that service. Or is there a commandline that I can use to switch it back on.
I have googled this for hours without finding anything. Except other people with the same problem.
Cheers,
Tony

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-04-04

2005-04-05T02:40:03Z

I'd check to make sure the event managing service is running. Right click on My COmputer, select Manage, expand Services and Applications, Select Services, double click on "Event Log". Make sure that the startup type is set to "Automatic". You can hit "Start" also to start it up if it's not running.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tony on 2005-04-04

2005-04-04T17:32:28Z

Hi Leo,
I don't have an EVENTLOG Service at all. WinXPpro with SP2.
I discovered this when attempting to install Diskeeper. It would not install.
Every time I click on say "Application" or "Security" or "System" in the event viewer, I get an error. "Unable to complete the operation on "Application/Security/System". the interface is unknown."
The .EVT files are there. I even copied some from another pc. But still the same error.
Any ideas?
Thanks,
Tony

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from BRIAN MILLER on 2005-03-05

2005-03-05T11:49:14Z

EVENT VIEWER

Hi my name is Brian Miller from North Shields in the UK. I have only just recently discovered the event viewer and as you can imagine I have not got a clue what it all means. The only thing that stands out to me as being not right is in the security part. I would have thought that the only name listed on the USERS section, would be my own BRIAN MILLER. Instead of that the names listed as users are as follows:
SYSTEM, NETWORK SERVICE, LOCAL SERVICE, BRIAN MILLER, and ANONYMOUS LOGON, does this look as it should?

The one listed out of all that’s got me worried is ANONYMOUS LOGON. On close inspection via properties reads as follows:
------------------------------------------------

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 3/3/2005
Time: 1:31:04 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: BM-INTERNET-PC
Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x1737C)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

------------------------------------------------
Can anyone please advise me?

Many thanks in advance, regard…Brian Miller.
================================================
Web Site: http://brianmiller.batcave.net/
E-Mail: mr_brianmiller@hotmail.com
================================================

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tom on 2004-11-29

2004-11-29T15:52:05Z

Make sure that file replication service is enabled, if you go to the eventlog service, check the dependencies for it. Make sure that the dependencies are ok first, then try opening event viewer again. This should fix your problem.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from shaya on 2004-11-17

2004-11-17T10:28:15Z

Hi Leo
I have seen the problem described above a couple of times where all records are selected but only the amount of records are shown. I currenly have the problem on a server running windows 2000 server where in the event viewer only the system log is visible. If you then switch to any of the other logs you get blank space with only the amount of events displayed at the top.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Christo on 2004-11-11

2004-11-11T08:01:32Z

Event log services do not start, Event viewer does not open. What is the fix for it?
The errors that appear when you want a look at the properties are "Configuration Manager: A required entry in the registry is missing or an attempt to write to the registry failed"

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from ebrown on 2004-08-05

2004-08-05T13:00:40Z

I am having the same trouble as others listed above. When I try to view the application log, i can see at the top that there are 1295 events, but nothing is displayed. I checked and all records is selected, I also checked which columns are selected and all of them are. Could they possibly be hidden or something. Any suggestions would be appreciated. The only log that I can see is the system log.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-07-02

2004-07-02T21:36:16Z

It's *almost* impossible to tell. The numbers used are specific to the application that posted the event ... so 20 for one application might be something different than 20 for another. That's why event logging and event viewer are such a mixed blessing. Typically I grab as much information as I can from whatever pops up in event viewer, especially in the event's description, and if that's unintelligible, (like an unexplained 20), then that wasn't any help to me and I move on.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Carol on 2004-07-02

2004-07-02T18:40:32Z

So how do we know what an Event number means, for instance event 20?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-06-02

2004-06-02T23:51:08Z

DO you mean nothing in the left hand or right hand pane? And have you checked that "View" "All Records" is set? Are you logged in as an administrator (not neccesarily required, but it eliminates some possibile explanations)?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Scott on 2004-06-02

2004-06-02T21:04:49Z

Their are no log files visibile within my event viewer?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-05-22

2004-05-22T21:04:00Z

You might check to see that View, All Records is set. They should be listed.

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from ziv on 2004-05-22

2004-05-22T20:58:31Z

and what can i do when the viewer don't work?
i click system/application etc and see nothing but "306 events" (or so) on top?

]]>

A comment on: What is the Event Viewer, and should I care?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.