How To Diagnose System Problems with Event Viewer in Microsoft Windows 2000

This step-by-step guide describes how to use Event Viewer as a troubleshooting tool. Event Viewer displays detailed information about system events. This information includes the event type, the date and time that the event occurred, the source of the event, the category for the event, the Event ID, the user who was logged on when the event occurred, and the computer on which the event occurred.

Troubleshooting with Event Viewer

Starting Event Viewer

The procedure for starting Event Viewer depends on your starting point.

To start Event Viewer in Windows 2000, click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.

Selecting Computers

With appropriate administrative authority, you can select any computer in your network to view that computer's Event logs.

To select computers in Event Viewer:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the top of the console tree, right-click Event Viewer (local), and then click Connect to another computer.
3. Either browse to the computer name or type the computer name in the dialog box to view the Event log on that computer.
4. Click OK.

Adjusting Event Viewer Settings

In Windows 2000, you can adjust Event Viewer settings for a specific log file.

To adjust the settings for a log file:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Properties.
3. Click the General tab.

Saving Event Logs

You can save Event Logs for later analysis or for use as historical data. The log files are saved to a file name and location that you choose, with a file name extension that is determined by the format of the saved log file.

To save Event logs:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Save Log File As.
3. Navigate to the subfolder in which you want to save the file, type a name for the file, click the file type, and then click Save.

Clearing Event Logs

You can manually clear all of the events from an Event log when necessary. On heavily used servers, it is a good idea to save data from the Event log for later administrative use before you clear all of the events.

To clear Event logs:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Clear all Events.
3. You are prompted for whether you want to save the log to a file before clearing it.
4. Click Yes to save a log and clear all events. If you click No, the log is not saved, but all events are cleared from the selected Event log. If you click Cancel, the request to clear the log is canceled.

Viewing Event Details

After you select a log in the Event Viewer, you can search, filter, sort, and view details about events.

To view events:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file. A list of events in the log file is displayed in the details pane of Event Viewer.
3. Click a specific event in the details pane to display the Event Properties dialog box and details about the event.

Filtering Events

You can specify a filter that limits the type of information that you want Event Viewer to display. These filters only affect which event log items are displayed in the viewer.

To filter events:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Properties.
3. Click the Filter tab.
4. Type the appropriate information that you would like to filter.
5. Click OK.

Finding Events

Event Viewer provides the option to search for events. Searches can be useful when you are viewing large logs.

To find an event:

1. Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
2. In the console tree, right-click the appropriate log file.
3. On the View menu, click Find.
4. Type the appropriate information that you would like to find in the dialog box, and then click Find Next.
5. Click Close when you are finished.