Copyright: Monday, July 09, 2001 08:14:07


This Help file contains context-sensitive Help for Event Viewer dialog box controls.

You can see an individual topic by opening a dialog box, clicking the question mark in the upper-right corner, and then clicking the option you want to know about.

You can get Help about administrative procedures for your consoles by opening them in Microsoft Management Console and using the Help menu.


Displays the user name if an event is attributed to a specific user. This field is not case-sensitive. All characters are displayed in uppercase.


Displays the exact name of the computer where the logged event occurred. This field is not case-sensitive. All characters are displayed in uppercase.


Displays the date the event was generated.


Displays the time the event was logged.


Displays the type of event.

The event type is the classification of the event by the Windows 2000 operating system, such as Error, Warning, Information, Success Audit, or Failure Audit.


Displays an event number to identify the specific event.

The event number helps technical representatives track events in the system.


Identifies the software that logged the event. This software can be an application or a component of the system, such as a driver.


Displays a classification of the event, as defined by the source that logged the event.


Displays a text description of the event. Text descriptors are created by the source of the event.

To search for events using a portion of the event’s description, on the View menu, click Find. The description is also saved in all archived logs.

If the description for the event cannot be found, then the file containing event descriptions is inaccessible — usually located on another computer.


Displays binary data generated by the event in hexadecimal (Bytes) or DWORDS (Words) format.

Not all events generate binary data. An experienced programmer or a support technician familiar with the source application can interpret this information.


Displays binary data generated by the event. An experienced programmer or a support technician familiar with the source application can interpreted this information.

Click Bytes to display the information in hexadecimal format. Click Words to display DWORDS for the same data.


Specifies the beginning of the interval of events that you want to filter.

In the box under From, select First Event to see events starting with the first event recorded in the log. Select Events On to see events that occurred starting with a specific time and date.

The default value is First Event.


Provides a space for you to enter the initial date to view events. Click the arrow to display a calendar.


Provides a space for you to enter the initial time to view events. Click the arrows to change the time.


Specifies the end of the range of events that you want to filter.

In the box under To, select Last Event to see events ending with the last event recorded in the log. Select Events On to see events that occurred ending with a specific time and date.

The default value is Last Event.


Provides a space for you to enter the final date to view events. Click the arrow to display a calendar.


Provides a space for you to enter the final time to view events. Click the arrows to change the time.


Displays the types of events to view. By default, all types of events are recorded in the log.


Specifies whether to display events logged by successful operations of major server services, such as when a database program loads successfully.


Specifies whether to display events that are not necessarily significant but that may cause future problems, such as when disk space is low.


Specifies whether to display events logged by significant problems, such as a loss of data or loss of functions.


Specifies whether to display security access attempts that were successful, such as a user successfully logging onto the system.


Specifies whether to display security access attempts that failed, such as a user failing to gain access to a network drive.


Allows you to identify the software that logged the event. This software can be either an application or a component of the system, such as a driver. By default, all sources are logged.

To see the software that logged an event, right-click the event, and then click Properties.


Lists the event category, as defined by the source. By default, all categories are logged.

To see the category of an event, right-click the event, and then click Properties.


Provides a space for you to type text that exactly matches text in the User name field. This field is not case-sensitive.

To see the user for an event, right-click the event, and then click Properties.


Specifies the exact name for the computer where the logged event occurred. This field is not case-sensitive.

To see the computer on which an event occurred, right-click the event, and then click Properties.


Specifies the event number of a specific event. The event number helps technical support representatives track events in the system.

To see the Event ID of an event, right-click the event, and then click Properties.


Clears any changes on this tab and returns all options to their default values.


Defines which events are displayed for the current log.

When filtering is on, a bullet appears on the View menu next to Filter. The description bar displays the number of events shown by the filtered view as well as the total number of events in the log.

Your choices for filtering are used for the selected log view and are kept when you save the console. If you have more than one log view for the same log, you can apply different filter criteria for each log view.


Displays the date this file was read from or written to.


Erases all events from the log permanently.

If you need to keep a record of existing events, save the log before completing this action.


Shows when the log file was created.


Specifies the name for the log view. You can change the name to distinguish different views of the same log on one computer or to distinguish logs on different computers.


Displays the name and location of the log file.


Specifies whether the log file is located on another computer, and whether your computer is connected to it by a low-speed device, such as a modem.


Specifies whether all new events will be written to the log, even when the log is full. When the log is full, each new event replaces the oldest event.


Specifies the number of days a log file will be retained before writing over it. You can set the number of days before a log can be overwritten, using numbers from 1 to 365. New events will not be added if the maximum log size  is reached and there are no events older than this period.

The default setting for this option is 7 days. This is the best choice if you want to archive log files weekly.


Specifies whether existing events will be retained when the log is full. If the maximum log size is reached, new events are discarded.

This option requires that you manually clear the log. Select this option only if you must retain all events.


Provides a space for you to enter the maximum log file size. Or click the arrows to change the log file size. The default maximum size is 512K.

The overwrite options on this tab specify what happens when this limit is reached.


Shows when the log file was modified.

Any log entries for which event viewer displays a later date are still cached and have not been saved.


Displays the current size of the log file.


Specifies the action taken when the maximum log size is reached.


Restores the default General tab settings for the log.


Specifies whether to create an additional view of the selected log or a view of a previously saved log event file.

Set the filters in each view of a log to display different events. For each view, use a Display name that indicates the events displayed by that view.


Opens a new view of the selected log type. In the new view, you can apply a different set of filters to display different events.

In Log type, specify which log you want to view. In Display name, type a name that distinguishes the new view from other views of the same log.


Creates a view of a previously saved event log (.evt) file.

After you select this option, specify the type of log in Log type, and type a name for the view in Display name.


Provides a space for you to type the complete path to an event log (.evt) file. You may also click Browse to locate the file.


Displays the Open dialog box, which helps you locate an event log file on a local disk or a network drive.


Provides a space for you to enter the log type for the new log view.

The default for Active Log selection is the type selected in Event Viewer. The default for Saved Log selection is Unspecified, which you must change to one of the available log types to add the view.


Provides a space for you to type a name to identify this view in the Event Viewer window.

After you create a view, you can change its name in Event Viewer at any time by clicking the existing name and typing a new one.


Different views of the same log are normally used to display different filtered sets of events. For example, one view could display all the events in a log, a second view could display just error events, and a third view could display information events for one source, such as "NT Fax." For any view, you can apply any combination of filters available in filter properties.

Although the filter properties apply only to a single view, any changes to the general properties apply to the log itself and appear in all views.


Specifies whether to log successful operations of major server services, such as when a database program loads successfully.


Specifies whether to display events that are not necessarily significant but that may cause future problems, such as when disk space is low.


Specifies whether to display events logged by significant problems, such as a loss of data or loss of functions.


Specifies whether to display security access attempts that were successful, such as a user successfully logging onto the system.


Specifies whether to display security access attempts that failed, such as a user failing to gain access to a network drive.


Identifies the software that logged the event. The software can be either an application or a component of the system, such as a driver.

To see the software that logged an event, right-click the event and click the Event Detail tab.


Specifies an event category, as defined by the program logging the event.

To see the category of an event, right-click the event and click the Event Detail tab.


Provides an event number to identify the specific event. The event number helps technical support representatives track events in the system.

To see the Event ID of an event, right-click the event and click the Event Detail tab.


Specifies the exact name of the computer where the logged event occurred. This field is not case-sensitive.

To see the computer on which an event occurred, right-click the event and click the Event Detail tab.


Displays text that exactly matches text in the User field. This field is not case-sensitive.

To see the user for an event, right-click the event and click the Event Detail tab.


Provides a space for you to type text that matches any portion of an event record description. You can search for any portion of an event record description, the complete text is not required.

To see the description of an event, right-click the event and click the Event Detail tab.


Lists the types of events you can find.


Specifies which direction to search in the log.

The search starts from the selected event in the results pane of the console. If no event is selected, then the search behaves as if the first event in the list is selected.

To display the properties for an event found by a search, you can double-click the event in the results pane without closing the Find dialog box. If the Properties dialog box is open while you search, it is automatically updated and displays the properties for each event found by the search.


Searches the results pane from the currently selected event upward. If no event is selected, then the search behaves as if the first event in the list is selected.


Searches the results pane from the currently selected event downward. If no event is selected, then the search behaves as if the first event in the list is selected.


Finds and selects the next occurrence defined by the Find settings. If Find Next is unavailable, then the log view selected in the scope pane is different from the view on which the Find dialog box was opened.

To display the properties for an event found by a search, you can double-click the event without closing the Find dialog box. If the Properties dialog box is open while you search, it is automatically updated and displays the properties for each event found by the search.


Closes this dialog box without saving any changes.


Clears the current find settings and returns them to their default values.


Specifies which computer this snap-in will manage.


Specifies which computer this Event Viewer will manage.

Click Local computer to display event logs for the computer on which the console runs. Click Another computer to manage a computer remotely.


Specifies that Event Viewer will display the event logs for the computer on which it is run.


Specifies that Event Viewer will display the event logs for a different computer than the computer where it is run. After you select this option, type the network name, IP address, or DNS address for the computer.

Use this setting to manage a computer remotely.


Provides a space for you to type the network name, IP address, or DNS address for the computer for which Event Viewer will display events.


Click to search for a computer on the network.


Specifies whether to allow the computer to be specified when the console is started from the command line.

For example, if you want to use the Event Viewer console on your computer to view the event logs on a computer named "sales," you would enter command line similar to the following to start the console:

mmc /computer=sales c:\winnt\system32\eventvwr.msc


Displays details about the next event in the log.


Displays details about the previous event in the log.


Copies the details of the event to the Clipboard.