Windows XP event log

Everyone should inspect the event log from time to time. It can reveal amazing possibilities for improvement, you might be surprised. Even on a pc that sings.

There's always room for improvement.

Use the event viewer to inspect the contents of the event log :

• Click the Start button
• Select "Run"
• Type "eventvwr" (without the quotes) in the "open" field
• Click ok

Windows opens up the event viewer.

In the left part of the screen, you will notice (at least) three types of logs that Windows XP maintains :

• The application log : this is where applications / programs log their events. For example, when your virus scanner encounters a problem, it could bring this to your attention through the application log. The developers of the program are responsible for the type of events that are logged here. THAT is where you can often find VERY useful information about things that go wrong behind the curtains. Things that can dramatically slow down your pc.
• The security log : is used to bring valid and invalid logon attempts to your attention. Also file access, creation and deletion of files can be logged here. You need to have an account with administrative privileges to enable, use and specify which events are logged in the security log.
• The system log : where you will find events logged by Windows system components. Can also reveal some VERY interesting troubleshooting information about your system.

Now click the system log in the left part of the screen. On the right side (in the details pane) you will see a list of generated system events, organized in several columns.

You can click on the column headers to sort the columns. Click again on the same column header to sort in the other direction.

You may feel a bit overwhelmed by the overload of information here and by the possible occurrence of yellow question marks (warnings).

Three types of events in the Windows XP event log

There are basically three types of events : information, warning and error.

There's no need to worry about informative events : they just, well, inform you that something has happened, e.g. a driver has loaded or a service has started.

Warnings : not critical. May be an indication of future problems, for instance when disk space is running low.

Errors : you should try to get rid of those. They indicate a significant problem, such as the failure of a critical task. For example when a system service fails to start. These can cause loss of data or functionality.

If you have isolated an error event in the Windows XP event log that you want to address, double-click the event in the details pane of the event viewer. Windows opens up the event properties dialog with detailed information about the event.

It's beyond the scope and possibilities of this article to offer a solution for every possible event in the Windows XP event log. You can note the event ID in the event properties dialog and perform a search for that event ID in Google or your favorite search engine to get started.

To improve your understanding of the event log, richt-click on "Application", "System" or "Security" in the event viewer and select "Properties". Windows opens this properties dialog :

Here you can track down the system file that holds the event log info. This dialog also allows you to manage the maximum size of the event log and the action that you want Windows to take when the event log is full. The default setting is that events older than 7 days get overwritten.