Microsoft KB Archive/302369

HOW TO: Diagnose System Problems with Event Viewer with Microsoft Windows 2000

Q302369

---

The information in this article applies to:

• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server

---

SUMMARY

This step-by-step article describes how to use Event Viewer as a troubleshooting tool. In Event Viewer, detailed information about system events is displayed including the event type, the date and time when the event occurred, the source of the event, the category for the event, the Event ID, the user that was using the computer when the event occurred, and the computer on which the event occurred.

[GRAPHIC: Step 1] Troubleshooting with Event Viewer

Starting Event Viewer

Use one of the following methods to start Event Viewer.

To start Event Viewer from Windows 2000:

• Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.

To start Event Viewer from the Windows 2000 Computer Management console:

1. Right-click My Computer, and then click Manage.
2. In the Computer Management console, expand the System Tools node.
3. Expand the Event Viewer node.

Selecting Computers

With appropriate administrative authority, you can select any computer in your network to view its event logs.

To select computers in Event Viewer on Windows 2000:

1. Open Event Viewer.
2. In the top of the console tree, right-click Event Viewer (local), and then click Connect to another computer.
3. Browse to or type the computer name in the dialog box to view the Event log on that computer.
4. Click OK.

Adjusting Event Viewer Settings

In Windows 2000, you can adjust Event Viewer settings for a specific log file.

To adjust the settings for a log file on Windows 2000:

1. Open Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Properties.
3. Click the General tab.

Saving Event Logs

You can save event logs for later analysis or for use as historical data. The log files are saved to a file name and location that you choose with a file name extension, which is determined by the format of the saved log file.

To save event logs on Windows 2000:

1. Open Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Save Log File As.
3. Navigate to the subdirectory where the file is to be saved, type a name for the file, select the file type, and then click Save.

Clearing Event Logs

You can manually clear all of the events from an event log when needed. On heavily used servers, it is logical to save data from the Event log for later administrative use before clearing all events.

To clear Event logs on Windows 2000:

1. Open Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Clear all Events.
3. You are prompted whether to save the log to a file before clearing it.
4. Click Yes to save a log and clear all events. Clicking No does not save the log, but clears all events from the selected Event log. Clicking Cancel cancels the request to clear the log.

Viewing Event Details

After you select a log in Event Viewer, you can search, filter, sort, and view details about events.

To view events on Windows 2000:

1. Open Event Viewer.
2. In the console tree, select the appropriate log file. A list of events in the log file displays in the details pane of Event Viewer.
3. Right-click a specific event from the details pane, and then click Properties to display the Event Properties dialog box and details on this event.

Filtering Events

You can specify a filter to limit the type of information that you want displayed in Event Viewer. These filters only affect which Event log items are displayed in the viewer.

To filter events on Windows 2000:

1. Open Event Viewer.
2. In the console tree, right-click the appropriate log file, and then click Properties.
3. Click the Filter tab.
4. Type the appropriate information that you would like to filter.
5. Click OK.

Finding Events

In Event Viewer, the option to find events is present. Searches can be useful when you are viewing large log files.

To find an event on Windows 2000:

1. Open Event Viewer.
2. In the console tree, select the appropriate log file.
3. On the View menu, click Find.
4. Type the appropriate information that you would like to find in the dialog box, and then click Find Next.
5. Click Close when you are finished.

Additional query words:

Keywords : kbGraphxLink kbAudDeveloper kbAudITPro kbHOWTOmaster
Issue type : kbhowto
Technology : kbwin2000Serv kbwin2000ServSearch kbwin2000Search kbwin2000ProSearch kbwin2000Pro

Last Reviewed: June 27, 2001 © 2001 Microsoft Corporation. All rights reserved. Terms of Use.