Event Viewer is Windows Server's primary logging and diagnostic tool — understanding how to navigate and interpret its logs is essential for troubleshooting issues and monitoring server health.
Opening Event Viewer
eventvwr.mscKey Log Categories
| Log | Contains |
|---|---|
| Application | Events from applications/services running on the server |
| Security | Login attempts, permission changes, audit events |
| System | OS-level events, driver issues, service start/stop events |
| Setup | Events related to Windows installation/updates |
Understanding Event Levels
| Level | Meaning |
|---|---|
| Error | A significant problem occurred |
| Warning | A potential issue, not necessarily critical |
| Information | Normal operational events |
| Critical | A severe failure, often requiring immediate attention |
Filtering Logs for Relevant Events
Right-click a log → Filter Current Log — filter by event level, time range, specific Event ID, or source, narrowing down to genuinely relevant entries rather than scrolling through everything.
Querying Logs via PowerShell
Get-EventLog -LogName System -EntryType Error -Newest 20Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2; StartTime=(Get-Date).AddDays(-1)}Get-WinEvent is the more modern, flexible cmdlet, generally preferred over the older Get-EventLog for new scripting.
Looking Up an Unfamiliar Event ID
Search for the specific Event ID and source together — Microsoft's documentation and community resources often explain exactly what a given Event ID means and common causes/fixes.
Setting Up Custom Views for Frequent Monitoring
Right-click Custom Views → Create Custom View to build a saved filter for events you regularly want to monitor (e.g. all Errors across multiple logs), avoiding needing to re-filter manually each time.
Forwarding Events to a Central Log Server
For managing multiple servers, Windows Event Forwarding lets you centralize logs from many servers into one collector — useful for centralized monitoring similar in spirit to How to Set Up Centralized Logging with the ELK Stack, but using native Windows event forwarding mechanisms.
Setting Up Alerts Based on Specific Events
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\alert.ps1"
$trigger = New-ScheduledTaskTrigger -AtLogOnTask Scheduler (see How to Schedule Tasks with Windows Task Scheduler) can trigger actions based on specific event log entries, letting you build custom alerting for events you specifically want proactive notification about.
Common Investigation Workflow
- Filter by Error/Critical level and the relevant time window around when an issue occurred
- Review System and Application logs for relevant entries
- Cross-reference specific Event IDs for known causes/fixes
- Check Security log if the issue might relate to access/permissions
Common Errors
Log is empty or missing expected entries — verify log retention settings haven't caused older events to be purged, and check that the relevant service/application is actually configured to log to the expected log category.
Continue Reading
- How to Monitor Windows Server Performance
- How to Schedule Tasks with Windows Task Scheduler
- PowerShell Basics for Windows Server Administration
Browse more articles in Windows Server Administration.
