Troubleshoot Windows with Event Viewer

By Stephen Bucaro

Anything noteworthy that happens in Windows is referred to as an "event" and is recorded in an "event log". Windows actually creates three logs, the Application log stores events related to applications. The Security log stores events related to security related events, for example user logons. The System log stores Windows operating system events. Most people ignore these logs; however, they can be very useful for troubleshooting purposes.

- Some applications create their own separate event log which is displayed in Event Viewer along with Windows standard Application, Security and System event logs. Sometimes an aplication will leave its event log behind after you uninstall it. You can remove the log by removing its subkey from the key:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog

Also remove the associated file from the folder:

\Windows\system32\config

It will have an .evt extension. But never remove AppEvent.evt, SecEvent.evt, or SysEvent.evt, the Application, Security and System event logs.

To view an event log, in Control Panel select the Administrative Tools. In the Administrative Tools window, select the Event Viewer. You can also open Event Viewer by selecting Start | Run and typing eventvwr.msc in the Run dialog box.

There are three types of events, an Information event records that a task was performed successfully or that a service had a change of status. Information events are usually nothing to be concerned about. A Warning event records that a noncritical error occurred. If your system is recording a high number of Warning events from a single source, you might want to investigate the cause.

An Error event records that a critical error has occurred. You might want to investigate an Error event before it becomes a more serious problem. To view the details of an event, double-click on the event in the list. The Event Properties dialog box will open. The Event Properties dialog box Description section will display a description of the event, and maybe a link to a source of more information about that type of event.

• Note the memory dump data at the bottom of the dialog box. This information would only be useful to Microsoft's programmers in India.

RSS Feed

 Follow @Stephen Bucaro

 Windows Troubleshooting
 Basic PC Anatomy
 Computer Architecture
 Internet Security
 A+ Practice Exams
 Maintain, Upgrade PC
 Windows Tips
 Windows Administration
 Linux

 Free PC Technical Support