Event Viewer is a utility designed to track events recorded in the application, security, and system logs. It enables you to gather information about software, hardware, and system problems and track Windows 2000 security events. When you start Windows 2000, the Event Log service starts automatically. Event Viewer takes the form of a Microsoft Management Console (MMC) snap-in. It is named Eventvwr.msc and can be found in the %SystemRoot%\System32 folder. When you launch Event Viewer from the Administrative Tools folder on the Programs menu, you see the Event Viewer console (Figure 33-1).
Figure 33-1. The Event Viewer console.
Windows 2000 records events in three kinds of logs:
By default, each log file has a maximum size of 512 KB and logs are overwritten as necessary, provided that the events are older than seven days. You can change the size of each log file by selecting the log you want to modify and choosing Properties from the Action menu of Event Viewer. In the Maximum Log Size box in the General tab, specify the new log size in kilobytes. The maximum log size can be as large as the capacity of the hard disk and memory. You can also decrease the size of the log file, but you have to clear the log of events first.
Logging stops if the log file becomes full and cannot overwrite itself because the events in the log are not old enough or because you have the log set to be cleared manually. You can specify the event logging parameters for specific logs with the Event Log Wrapping options in the General tab of the Properties dialog box for each log. Choose Overwrite Events As Needed, Overwrite Events Older Than x Days, or Do Not Overwrite Events. (Event Log is also covered as part of day-to-day administration in Chapter 10.)
The two key components in the interpretation of an event are the event header and the event description. The event description is the most useful piece of information because it indicates the significance of the event.
Event headers are displayed in columns in the Event Viewer console (Figure 33-2).
Figure 33-2. Event headers in the Event Viewer console.
Event headers are broken down into the following components:
Double-clicking a specific event in Event Viewer displays a text description in the Event Detail tab of the Properties dialog box (Figure 33-3) that is often helpful in the analysis of the event. Binary data is also generated for some events and can be helpful in interpreting those events because it is generated by the program that originated the event records. If you retain event descriptions, save them as binary data files. Don't save event descriptions in text format or comma-delimited text format, because these formats discard binary data.
Figure 33-3. The Event Properties dialog box.
You can save an event log to a file by right-clicking the log name in Event Viewer and choosing Save Log File As from the shortcut menu. You can archive event logs in one of the following three formats:
Archived logs save the event description in the following order: date, time, source, type, category, event, user, computer, description. The entire log file is saved, regardless of any filtering options you might have set. The information is saved sequentially, even if you have established a sort order for the events.
You can open an archived log file from the Action menu by pointing to New and then choosing Log View. In the Add Another Log View dialog box, select Saved (Opens A Previously Saved Log), and click Browse to search for the log name in the Open dialog box. You can open only an archived log file with the .EVT filename extension in Event Viewer. (Archived log files with .TXT and .CSV extensions can be opened in any word processing program.) The information displayed in an archived log cannot be updated by refreshing.
You can connect to another computer to view its event log by right-clicking Event Viewer (Local) at the top of the tree and choosing Connect To Another Computer. In the Select Computer dialog box (Figure 33-4), you can browse for or enter the name of the other computer whose event log you want to view.
Figure 33-4. The Select Computer dialog box.
Event Viewer enables you to view machines running Microsoft Windows NT Workstation or Windows 2000 Professional, a server or domain controller running Windows NT Server or Windows 2000 Server, or a server running LAN Manager 2.x. You can configure a low-speed connection for the remote machine you want to view. To do this, select the log you want to view from the console tree, choose Properties from the Action menu, and then select the Low Speed Connection option.
For more sophisticated monitoring and analysis of a large network of computers, consider using Microsoft Systems Management Server (SMS), or Microsoft Operations Manager (MOM), or both. Information on these products is available at http://www.microsoft.com/smserver and http://www.microsoft.com/mom.