When any significant event occurs on a computer, the OS writes that event to a log. Event Viewer (eventvwr.exe) is the repository of these event logs. Most administrators open Event Viewer only to try to solve a serious problem, and many administrators tell me they use this tool only on servers. Both practices are administrative mistakes because checking event logs periodically can frequently catch problems before they become serious. Knowing how to use Event Viewer is an important skill, so let me provide an overview of the subject and pass along the ways in which I use Event Viewer.
Event Viewer Basics
You open Event Viewer from the Administrative Tools menu (if you've added that menu to your Programs menu) or from the Control Panel Administrative Tools applet. Event Viewer's console lists the available logs. Windows computers have the following default logs:
- Application log—contains events that programs log. The application determines the types of events it logs and the language in the event report.
- Security log—contains events related to a computer's security, such as logon attempts or file manipulation.
- System log—contains events that Windows system components log.
On Windows Server 2003 and Windows 2000 Server systems, depending on the server's role, you might have any of the following logs:
- Directory Service log—contains Active Directory (AD)related events and is available only on domain controllers (DCs)
- File Replication Service log—contains events logged during the replication process between DCs and is available only on DCs
- DNS Server log—contains events related to DNS resolution and is available only on DNS servers