[ [http://www.microsoft.com/technet/technetmag/issues/2006/11/EventManagement/ New tools for Event Management in Windows Vista] ] ] Overview
Event logs have been a feature of Windows NT since its original release in 1993. Applications and operating system components can make use of this centralized log service to report events that have taken place, such as a failure to start a component or complete an action. The system defines three log sources, "System", "Application", and "Security". The System and Application log sources are intended for use by the Windows operating system and Windows applications respectively; the Security log source, however, is only directly writable by the Local Security Authority Subsystem Service (lsass.exe). Event ID's are used to define the uniquely identifiable events that a Windows computer can encounter. An example of an event ID creation could be when a users authentication fails, such as Event ID 672.
Windows NT 4.0 added support for defining "event sources" (i.e. the application which created the event) and performing backups of logs.
Windows 2000 added the capability for applications to create their own log sources in addition to the three system-defined "System", "Application", and "Security" log files. NT4's Event Viewer was also replaced with a Microsoft Management Console snap-in.
Windows Server 2003 added the AuthzInstallSecurityEventSource() API calls so that applications could register with the security event logs, and write security audit entries. [cite web | url = http://msdn2.microsoft.com/en-us/library/Aa376314.aspx | title = AuthzInstallSecurityEventSource Function | accessdate = 2007-10-05]
Versions of Windows based on the Windows NT 6.0 kernel (Windows Vista and Windows Server 2008) are no longer limited in their total size to 300 megabytes. Prior to NT 6.0, the on-disk files were opened as memory-mapped files in kernel memory space, which used the same memory pools as other kernel components.
Windows Event Log
Windows Event Log is the rewritten event tracing and logging architecture introduced with Windows Vista. [ ] Windows Event Log has been rewritten around a well-defined structured XML log format and a designated log type to allow applications to more precisely log events and make it easier for support technicians and developers to interpret the events. The XML representation of the event can be viewed on the "Details" tab in an event's properties. It is also possible to view all potential events, their structures, registered "event publishers" and their configuation using the "wevtutil" utility, even before the events are fired. There are a large number of different types of event logs including Administrative, Operational, Analytic, and Debug log types. Selecting the "Application Logs" node in the "Scope" pane reveals numerous new subcategorized event logs, including many labeled as diagnostic logs. Analytic and Debug events which are high frequency are directly saved into a trace file while Admin and Operational events are infrequent enough to allow additional processing without affecting system performance, so they are delivered to the Event Log service. Events are published asynchronously to reduce the performance impact on the "event publishing" application. Event attributes are also much more detailed and show EventID, Level, Task, Opcode, and Keywords properties.]Event logs can be filtered by one or more criteria or a standard XPath expression, and custom views can be created for one or more events. Using XPath as the query language allows viewing logs related only to a certain subsystem or an issue with only a certain component, archiving select events and sending traces on the fly to support technicians.
Two main "event subscribers" include the Event Collector service and Task Scheduler 2.0. The Event Collector service can automatically forward event logs to other remote systems, running Windows Vista, Windows Server 2008 or Windows Server 2003 R2 on a configurable schedule. Event logs can also be remotely viewed from other computers or multiple event logs can be centrally logged and monitored agentlessly and managed from a single computer. Events can also be directly associated with tasks, which run in the redesigned Task Scheduler and trigger automated actions when particular events take place.
See also
* List of Microsoft Windows components
* Microsoft Management Console
References
External links
* [http://kb.prismmicrosys.com Event Knowledge Base] — Database of cause-resolution information on over 19000 events
* [http://www.syslog.org/wiki/Eventlog/EventLogWiki Event Log Wiki] — Contains useful developer and administrator resources for event log management.
* [http://msdn2.microsoft.com/en-us/library/aa363652.aspx Event Logging] — Developer documentation for event logging (NT 3.1 through XP)
* [http://msdn2.microsoft.com/en-us/library/aa385780.aspx Windows Event Log] — Developer documentation for the new event log system in Windows Vista
* [http://www.myeventlog.com Windows Event Log Resource] — A collection of Windows event messages, various solutions and tips & tricks that help when using the Event Viewer
* [http://www.eventid.net/search.asp A database of Windows event log entries] — Contains several thousands Windows event log entries along with troubleshooting suggestions for each of them
* [http://support.microsoft.com/?kbid=299475 Windows 2000 Security Event Descriptions (Part 1 of 2)]
* [http://support.microsoft.com/?kbid=301677 Windows 2000 Security Event Descriptions (Part 2 of 2)]
* [http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch06n.mspx Windows Server 2003 Security - Threats and Countermeasures - Chapter 6: Event Log] from Microsoft TechNet
