Windows 10 All-in-One For Dummies
Book image
Explore Book Buy On Amazon
Every Windows 10 user needs to know about Event Viewer. Windows has had an Event Viewer for almost a decade. Few people know about it. At its heart, the Event Viewer looks at a small handful of logs that Windows maintains on your PC. The logs are simple text files, written in XML format.

Although you may think of Windows as having one Event Log file, in fact, there are many — Administrative, Operational, Analytic, and Debug, plus application log files.

The Event Viewer logs

Every program that starts on your PC posts a notification in an Event Log, and every well-behaved program posts a notification before it stops. Every system access, security change, operating system twitch, hardware failure, and driver hiccup all end up in one or another Event Log.

The Event Viewer scans those text log files, aggregates them, and puts a pretty interface on a deathly dull, voluminous set of machine-generated data. Think of Event Viewer as a database reporting program, where the underlying database is just a handful of simple flat text files.

In theory, the Event Logs track "significant events" on your PC. In practice, the term "significant" is in the eyes of the beholder. Or programmer. In the normal course of, uh, events, few people ever need to look at any of the Event Logs. But if your PC starts to turn sour, the Event Viewer may give you important insight to the source of the problem.

How to find the Event Viewer

Follow these steps:
  1. Click in the Search field in the bottom left corner of your screen. Search for Event Viewer. Click on Event Viewer in the search results.

    The Event Viewer appears.

  2. On the left, choose Custom Views and, underneath that, Administrative Events.

    It may take a while, but eventually you see a list of notable events like the one shown.

  3. Don't freak out.

    Even the best-kept system boasts reams of scary-looking error messages — hundreds, if not thousands of them. That's normal. See the table for a breakdown.

    Events are logged by various parts of Windows.

    Events are logged by various parts of Windows.
Events and what they mean
Event What Caused the Event
Error Significant problem, possibly including loss of data
Warning Not necessarily significant, but might indicate that there's a problem brewing
Information Just a program calling home to say it's okay

Other logs to check out

The Administrative Events log isn't the only one you can see; it's a distillation of the other event logs, with an emphasis on the kinds of things a mere human might want to see.

Other logs include the following:

  • Application events: Programs report on their problems.

  • Security events: They're called "audits" and show the results of a security action. Results can be either successful or failed depending on the event, such as when a user tries to log on.

  • Setup events: This primarily refers to domain controllers, which is something you don't need to worry about.

  • System events: Most of the errors and warnings you see in the Administrative Events log come from system events. They're reports from Windows system files about problems they've encountered. Almost all of them are self-healing.

  • Forwarded events: These are sent to this computer from other computers.

About This Article

This article is from the book:

About the book authors:

Woody Leonhard is a bestselling author and has been a Microsoft beta tester since Word for Windows 1.1. He covers Windows and Office topics on his popular Web site,

Ciprian Adrian Rusen is a Microsoft MVP and Windows expert. His blog has more than 1.3 million monthly readers who look to him for insight into technology in general and Windows in particular.

This article can be found in the category: