Windows Server 2003 Event Viewer Application Log System Log Security Log

Wed, 19 Nov 2008 15:02:53 EST

Event Viewer: The Event Viewer console uses event logs to gather hardware and software information, system problems and security events (auditing). The Event Log service provides the capabilities for applications and services to log their respective events.

Under any configuration of Server 2003, Event Viewer will always record events in three different logs:
•Application Log
•System Log
•Security Log.

Let's discuss these logs in further detail.
•Application Log
contains events logged by programs or applications, such as a file error logged by a database program. These events are determined by the developer of the application as to what events to produce and to what degree of verbosity to implore. Double-clicking on any of the events shown in the console window will display a dialog box with further detail on the particular event.

NOTE: Both the Application log and the System log can show three different types of events: Error, Warning and Information. Each of these event types shows a degree of severity for the event, with Error being the most critical. The Security log produces two events. The first is the Success Audit, which indicates a successful security access. The second is the Failure Audit, which indicates a failed security access.
For each log you can quickly view the events in the console window. There are eight columns showing information about the event. These columns are Type, Date, Time, Source, Category, Event, User and Computer.

• System Log
contains events, predetermined by the server, logged by system components, such as failure of a driver to load.
•Security Log
records security events as successful or failed, depending on what was requested to be audited, for example, a failed logon attempt. These events are controlled by the auditing functions of the various resources and subsystems. By default, these events are not recorded. Security logs are only viewable by administrators.

•System Log
contains events predetermined by the server, logged by system components, such as failure of a driver to load.
If Server 2003 is configured as a domain controller, there will be two additional logs available:
•Directory Services Log
contains events logged by the Active Directory services, such as connection problems between the global catalog and the server.
•File Replication Service Log
contains events logged by the File Replication service, such as file replication failures.
If Server 2003 is configured as a DNS Server, an additional log is available:
•DNS Server Log

contains events logged by the DNS Service, such as the start of the DNS service.
Event Viewer provides great functionality for monitoring and analysis. Not only can you view events for the local server, but also you can view events for other remote servers, simply by right-clicking on Event Viewer at the top of the left pane.

Another feature is the ability to filter the events that are displayed to identify any problem areas quickly. The filters are applied on a per log basis.

System Monitor: System Monitor and Performance Logs and Alerts are both found in the Performance Console in Server 2003. Performance can be found under Administrative Tools in Control Panel.

System Monitor allows you to view real time performance of your server. You can capture this data in a log as well, so that you can view it at a later time. When you first open System Monitor, you will notice that nothing is being tracked. This is because you must first set counters to monitor the particular process in which you are interested. These counters will be displayed on the screen.

There are three views available to you in System Monitor:
•Chart
(the default view) allows you to view a small number of counters over a set period of time.
•Histogram
(bar chart) allows you to view a large number of counters as a snapshot.
•Report
allows you to view the counters in text format in real time.
Using the Performance Logs and Alerts will allow you to create counter and trace logs, as well as define alerts. You can use this tool to collect logged data, which can be used for detailed analysis and record keeping.
The three logs available to you through Performance Logs and Alerts are:
•Counter logs
record data about hardware usage and activity on a system. You can configure logging to occur on a regular basis, or on-demand. As an administrator, you should plan how often to collect data, based on the type of results you need to obtain.
•Trace logs
measure data on a continuous basis.
•Alerts
are messages that are sent to the system administrator when a specific counter exceeds, or falls below, a predetermined setting.

TRCB.com RSS Feed

Windows Server 2003 Event Viewer Application Log System Log Security Log