12th August 2002

It occurred to me today that, with the increasing number of Windows XP computers being sold lately, most users probably don't know about a very useful troubleshooting utility that resides on their very own computer - the Microsoft Windows Event Viewer. The Event Viewer saves three different logs: an application log to track events logged by a program, a security log to log events such as valid and invalid logon attempts (or even file creation or deletion), and a system log that contains events logged by Windows XP system components (such as a driver not loading). Each log comes in handy at different times. Using group policies and local systems policies, they can be highly configured to display more (or fewer) events. I know what you are thinking... this is all well and good, but how do I get to this Event Viewer? The most universal way to get to the Event Viewer on a Windows XP machine is Start | Control Panel | Performance and Maintenance | Administrative Tools | Computer Management, and then expand the tree for Event Viewer. However, if you are using a Windows 2000 or XP machine running in Classic Mode, you would take the same steps minus the Performance and Maintenance step. Once in the Event Viewer, you will see many types of events logged, from Information to Warnings to Errors. You may even see Success/Failure audits depending on how your system is configured. If you open an event in the Event Viewer, you will see the Date and Time of the event, and much more. To me, the most important piece of information in an event is the Event ID. With this information, I can go onto Microsoft's Web site, look up the Event ID in the Knowledge Base, and get a much better description than Windows's somewhat vague error messages. There are many more things you can do with the Event Viewer, such as searches, filtering, and archiving... but for that information I will refer you to Microsoft Knowledge Base Article - Q308427. Happy reading!