Event Log Viewer: How to View, Filter & Analyze Windows Event Logs

Windows records everything — service crashes, logons, app hangs — in Event Logs. This complete guide shows how to view, filter, and analyze them with Event Viewer, PowerShell (Get-WinEvent), and wevtutil, from first click to saved Custom Views and scripted exports — no prior admin experience needed.

What Are Windows Event Logs — 5 Logs and 4 Levels Beginners Must Know

Event Logs are Windows' append-only, indexed binary journal — not a text file you cat. Every boot, service start, app crash, logon, or failed logon writes an event. Unlike Apache's access.log which is plain text, Windows stores events as .evtx (XML + binary) indexed by LogName, ID, and TimeCreated, which is why you need Viewer, PowerShell, or wevtutil to read them — Notepad shows gibberish.

The five logs you meet on every machine:

1. System — Windows itself: drivers, services, kernel. Look here when a service fails (7000 series), a driver bugchecks, or a shutdown was unexpected (6008).
2. Application — apps: Outlook, Chrome, your own myapp.exe. Crashes are 1000 (faulting app) and 1001 (Bucket ID), hangs 1002.
3. Security — audit (only if auditing enabled): logons 4624/4625, logoffs 4634, special logon 4672, account lockouts 4740. Needs admin to read; forward with Windows Event Forwarding (WEF) to ForwardedEvents log on collector.
4. Setup — updates and CBS servicing.
5. Forwarded Events — central collector when you forward from many hosts.

Every event shares anatomy: Level (Error red, Warning yellow, Information blue, Verbose gray), Source (who wrote it, e.g., Microsoft-Windows-Security-Auditing, Service Control Manager), Event ID (what happened, e.g., 4624 = successful logon), TimeCreated, Task Category, Computer/User, and EventData (structured XML with Data Name="TargetUserName" etc.). See Windows Event Log overview and Event Logging (Win32) for the formal model; file location is Event logs stored in winevtLogs.

Levels — What to Chase First

As a beginner, prioritize Errors, then Warnings, then Information for context. A System Error 7034 Service terminated unexpectedly at 09:14:23 next to an Application Error 1000 myapp.exe faulting module ntdll.dll at 09:14:22 is almost always the same root cause — one second apart is your correlation window. Verbose (Level 5) is off by default; you enable it per channel for deep debugging.

How to View Logs in Event Viewer in 10 Seconds (GUI)

You have three ways to open it; memorize one:

• Win+R → eventvwr.msc → Enter — fastest, works on every Windows.
• Search Start: Event Viewer.
• Computer Management → System Tools → Event Viewer.

Layout is three panes:

1. Left — tree: Event Viewer (Local) → Windows Logs → System/Application/Security/Setup → Applications and Services Logs → Microsoft → Windows → ... (e.g., Microsoft-Windows-PowerShell/Operational).
2. Center — rows: Level, Date and Time, Source, Event ID, Task Category. Click a column to sort; double-click a row to open details.
3. Right (Actions) — Filter Current Log, Find, Create Custom View, Clear Log, Save Filtered Log File As..., Attach Task To This Event..., Properties (size/retention).

Open a row: General tab shows friendly text ("The MyService service terminated unexpectedly"), Details tab → XML View shows structured fields (System + EventData with Data Name="param1"). General is for humans; XML is for scripts because it preserves TargetUserName, IpAddress, LogonType. Guide: Event Viewer help and eventvwr command.

First 3 Tasks — Do Them Now

1. Windows Logs → System → Filter → Event sources Service Control Manager → Level Error → OK — see which services failed to start.
2. Application → Filter → Event IDs 1000,1001 → OK → open the top 1000 → copy General text (faulting module, exception code 0xc0000005).
3. Security → Filter → IDs 4624,4625 → if empty, audit isn't enabled — see Audit Logon events to enable via Group Policy (secpol.msc → Local Policies → Audit Policy → Audit logon events → Success, Failure).

How to Filter Like a Pro — GUI, XPath, and Custom Views

The biggest beginner slowdown is scrolling thousands of events. Filter at the source instead.

GUI filter: Right pane → Filter Current Log → fields: Logged (Any time, Last hour/24h/7d, Custom range), Event level, Event sources, Event IDs (comma-separated 4624,4625,4672), Task category, Keywords, User, Computer. Click OK → grid narrows instantly. Open the XML tab in that same dialog to see the XPath it generated — e.g.:

*[System[TimeCreated[timediff(@SystemTime) <= 86400000] and (EventID=4624 or EventID=4625)]]

That string is the query. Copy it for PowerShell's -FilterXPath. Custom Views save this filter: Filter Current Log → Save Filter to Custom View → name it Logon Auditing (Last 7d) → appears under Custom Views forever, on any machine where you export/import it (Export Custom View... → .xml). They are just saved XPath against .evtx — no copy, no lag. Docs: Consuming Events / XPath and Filtering.

Power Tip — Filter Early, Not After Import

A Security log with 300k events takes ~40s to Get-WinEvent LogName Security | Where-Object Id -eq 4624 vs <1s with Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624}. The hashtable/XPath filters inside the log service; Where-Object pulls everything then filters in PowerShell. Always filter by LogName, ID, and StartTime at query time, then refine.

PowerShell and wevtutil — Script Everything (Modern Get-WinEvent)

Event Viewer is great for a look; PowerShell is for repeatable analysis and remote queries.

Modern cmdlet: Get-WinEvent — fast, supports -FilterHashtable (hashtable), -FilterXPath (XPath), and -Path (offline .evtx):

# 1. Last 24h logons succeed/fail, fastest
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624,4625; StartTime=(Get-Date).AddDays(-1)}

# 2. Same via XPath (paste from GUI XML tab)
Get-WinEvent -FilterXPath '*[System[(EventID=4624 or EventID=4625) and TimeCreated[timediff(@SystemTime) <= 86400000]]]'

# 3. Offline .evtx collected from another host
Get-WinEvent -Path C:\Forensics\security.evtx | Where-Object Id -eq 1000 | Format-List *

# 4. Read structured fields (XML Data) — extract user + IP
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} -MaxEvents 1 | ForEach-Object {
  $xml=[xml]$_.ToXml(); $data=$xml.Event.EventData.Data
  [PSCustomObject]@{
    Time=$_.TimeCreated; User=($data | Where Name -eq 'TargetUserName').'#text'
    IP=($data | Where Name -eq 'IpAddress').'#text'; LogonType=($data | Where Name -eq 'LogonType').'#text'
  }
}

# 5. Export for Excel (preserve XML separately if needed)
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7034,7045} | Export-Csv C:\Logs\services.csv -NoTypeInformation

Legacy: Get-EventLog — only System/Application/Security, slow, no modern channels — avoid for Security and for Applications and Services Logs. Docs: Get-WinEvent and Get-EventLog.

Without PowerShell: wevtutil — built into every Windows, works in CMD and for .evtx offline:

wevtutil qe Security /q:"*[System[(EventID=4624 or EventID=4625)]]" /f:text /c:20
wevtutil epl Security C:\Forensics\security.evtx  :: export (preserves structured XML, best for forensics)
wevtutil al C:\Forensics\security.evtx /l:en-US /f:text > security.txt
wevtutil cl Security /bu:C:\Backup\sec-backup.evtx  :: clear with backup
wevtutil gl Security  :: log info (size, retention, enabled)

/f:text renders friendly, /f:xml preserves Data fields. Reference: wevtutil. For remote, Get-WinEvent -ComputerName srv01 (WinRM) or wevtutil qe Security /r:srv01.

Timestamp Trap — Don't Merge Logs Before Normalizing

Windows shows Local time, but the XML stores UTC (SystemTime="2024-03-10T02:30:00.0000000Z") and converts per Viewer timezone. Apache's [10/Oct/2000:13:55:36 -0700] is a third format with offset. Merging 14:32:10 RDP 4624 (LogonType 10) with 14:32:12 Nginx 403 without converting both to UTC produces one-day-off DST bugs. Normalize every log to UTC ISO8601 first using a log timestamp converter before cross-correlation — it prevents the classic spring-forward duplicate hour error.

Analyze — From Noise to Root Cause in 4 Steps

Filtering gets you rows; analysis gets you a story.

1. Narrow — time-box around the incident (if user reports "09:14 app died", filter 09:13–09:15), plus IDs that match symptom (1000/1001 for crash, 7023/7034 for service, 4625 for auth failure).
2. Correlate — join logs by timestamp ±2 seconds. Example: 09:14:22 Application 1000 myapp.exe faulting ntdll.dll 0xc0000005 at exact same second as System 7034 MyApp service terminated → same failure, not two incidents. Add Security 4625 two minutes earlier → auth issue before crash?
3. Extract — switch Details → XML, copy fields: Faulting application path, Exception code, TargetUserName, IpAddress, LogonType (2 console, 10 RDP, 3 network, 7 unlock). Group in PowerShell: Get-WinEvent ... | Group-Object Id | Sort Count -Descending surfaces top culprit ID.
4. Act — right pane → Attach Task To This Event... → start a program, send email (via script), or log to collector; or fix root (update driver for 0xc0000005, reset policy for 7030 service not allowed to interact).

Case — App Crashes at Boot (What a Beginner Would Do)

Symptom: After reboot, myapp never appears. Viewer: Custom View Last boot errors (System Errors + Application 1000 in last 1h) shows 09:14:22 Application ID 1000 Faulting application name: myapp.exe, faulting module ntdll.dll, exception 0xc0000005, faulting application path C:\Apps\myapp.exe plus System 7045 A service was installed then 7034 terminated one second later. PowerShell: Get-WinEvent -FilterHashtable @{LogName='Application';ID=1000;StartTime=(Get-Date).AddHours(-1)} | % {([xml]$_.ToXml()).Event.EventData.Data} extracts ExceptionCode, FaultingModulePath. Fix: Dependency missing — Process Monitor shows api-ms-win-*.dll not found → install VC++ redist. Attach task on ID 1000 myapp.exe → run script that collects procdump and posts to Teams. See Microsoft Event ID 1000 troubleshooting.

Beyond Windows — Apache and Nginx Logs

Windows isn't alone. When a user sees 500 Internal Server Error, it often leaves both an Nginx error [error] [client 192.0.2.10] File does not exist and a Windows Application 1001 (Bucket) for the same backend. Don't regex these by hand as a beginner — parse them with tools: for access logs use an Apache access log parser to split Combined Log Format into columns (IP, timestamp, method, path, status, bytes, referrer, UA), and for server errors use an Apache & Nginx error log analyzer to group by severity IP and path. Normalize timestamps first with the log timestamp converter, then correlate Security 4624 Type 10 (RDP) at 14:32:10Z with Nginx 403 at 14:32:12Z — same brute-force session, two logs, one story.

Export, Clear, Forward, and Tasks — Keep Evidence and Automate

Three operations you'll need before clearing anything:

• Export — right pane → Save Filtered Log File As... → .evtx (preserves XML + signatures, re-openable) or wevtutil epl Security C:\Forensics\sec.evtx. For Excel, Export-Csv but keep the .evtx as source of truth — CSV loses structured Data encoding. Also: Save All Events As... → Display Information: Displayed vs Locale vs No Display choices in Viewer.
• Clear — right pane → Clear Log → Save and Clear (or wevtutil cl Security /bu:C:\Backup\sec.evtx). Never clear Security on a domain controller without a prior epl — auditors and Audit policy require retention. Size/retention is per log Properties: Maximum log size + "Overwrite events as needed" vs "Archive when full".
• Forward (WEF) — collector: wecutil qc + create Subscription (Source Initiated vs Collector Initiated) → events land in ForwardedEvents on collector; docs: wecutil and Windows Event Forwarding.
• Attach Task — right pane → Attach Task To This Event... → Trigger on ID → Action Start a Program → e.g., powershell.exe -File C:\Scripts\CollectDump.ps1. This is Windows' built-in "on this error, run remediation" — useful for auto-collecting dumps on 1000 or alerting on 4625 bursts.

Key Event IDs Reference — Keep This Table

Full list lives in each provider's documentation; filter by Source + ID rather than memorizing all 17k IDs.

How to Keep Logs Healthy — Size, Retention, and Audit

Per-log Properties → General: set Maximum log size (default 20 MB for Security is often too small for busy DCs — raise to 128–256 MB after monitor). "Overwrite events as needed" loses old events; "Archive the log when full, do not overwrite" keeps everything but fills disk; "Do not overwrite" requires manual clear. Security typically should not auto-overwrite in regulated envs — forward and archive. Path and size controlled via wevtutil sl or Group Policy. See Audit logon events for enabling the very events you need to analyze.

Remote Logs, Forwarded Events, and Performance at Scale

Once local filtering feels natural, scale to many machines without RDPing each one.

• Remote query: Get-WinEvent -ComputerName srv01 -FilterHashtable @{LogName='System'; ID=6008; StartTime=(Get-Date).AddDays(-7)} via WinRM (Enable-PSRemoting on target). For workgroup, use wevtutil qe Security /r:srv01 /u:domain\user /p:pass. No share needed — the log service streams.
• Windows Event Forwarding (WEF): collector runs wecutil qc then Subscriptions (Source Initiated is typical — clients push). Configure via Group Policy: Computer → Policies → Administrative Templates → Windows Components → Event Forwarding. Events land centrally in ForwardedEvents, already filtered by the subscription XPath (e.g., only 4625), so the collector isn't flooded.
• Performance: Get-WinEvent -FilterHashtable with LogName + ID + StartTime uses the indexed .evtx and returns in <1s even with 500k Security events; piping to Where-Object after pulling all events is what makes scripts feel slow. For offline forensics, copy .evtx via wevtutil epl and query with Get-WinEvent -Path locally — no live host load.

Docs: wecutil, Windows Event Forwarding, Get-WinEvent -ComputerName.

Permissions, Retention, and "Why Can't I See Security?"

Beginners often hit empty Security or Access Denied — that's by design. Security requires membership in Event Log Readers or Administrators, and UAC prompts for Viewer unless you Run as Administrator. On domain-joined machines, Group Policy may cap Security at 20 MB (default) causing overwrites in hours on busy DCs — raise via wevtutil sl Security /ms:268435456 (256 MB) or GP (Computer → Windows Settings → Security Settings → Event Log → Maximum security log size). Audit must be enabled before events appear: secpol.msc → Local Policies → Audit Policy → Audit logon events (Success, Failure) or Advanced Audit Policy: Audit Logon/Logoff → Logon — without this, 4624/4625 never write. Reference: Audit Logon events and wevtutil sl (set log).

Save, Don't Lose — Export Format Guidance

When you filter to a useful view, save filtered first: Right pane → Save Filtered Log File As... → File name security-4624-last7d.evtx → choose Display Information: Display Information bundles locale strings so another PC renders friendly text; Locale embeds your language. For sharing with auditors, always hand over .evtx plus Export-Csv derived .csv — the .evtx is tamper-evident and re-queryable with XPath, the .csv is human-sortable. See Event Logging formats.

Common Beginner Mistakes — Don't Clear Before You Export

• Clearing Security without backup — Clicking Clear Log without "Save and Clear" deletes forensic evidence. Always wevtutil epl Security C:\Backup\sec-$(Get-Date -Format yyyyMMdd).evtx before cl.
• Filtering after pulling all events — Get-WinEvent LogName Security | Where Id -eq 4624 pulls 500k rows then filters. Use -FilterHashtable @{LogName='Security';ID=4624} to filter inside the log service.
• Reading .evtx in Notepad — .evtx is binary indexed; Notepad shows NUL squares. Use Viewer, Get-WinEvent -Path, or wevtutil.
• Ignoring time zones — merging Windows Local (e.g., 09:14) with Apache 13:55:36 -0700 without UTC conversion makes correlation off by hours, worse at DST spring-forward where 02:00 repeats.

Tip: create a "Beginner Triage" Custom View now — Windows Logs → Create Custom View → Event levels Error + Warning, Event logs System & Application, IDs 1000,1001,6008,7045,7034, Last 24 hours → Save as Triage 24h. Reopen daily; it's faster than remembering IDs.

Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-7)} | Group-Object Id | Sort Count -Descending | Select Id,Count -First 10 | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddDays(-1)} | Measure-Object

Keep Custom Views and .evtx backups — they make tomorrow's triage one click, not one hour.

Frequently Asked Questions

What is Event Viewer in Windows?

A Microsoft Management Console snap-in (eventvwr.msc) that reads .evtx logs: System, Application, Security, Setup, and Forwarded Events. Left pane navigates, center shows rows by Level/Date/Source/ID, double-click shows General/Details XML, right pane filters and saves.

What's the difference between Get-WinEvent and Get-EventLog?

Get-WinEvent is modern — reads all logs including Security and Applications and Services Logs, supports -FilterHashtable/-FilterXPath and -Path for offline .evtx, 10–100× faster. Get-EventLog is legacy — System/Application/Security only, no new channels, slower.

How do I find the cause of a blue screen or app crash using Event Viewer?

Check Application log IDs 1000 (faulting app + module 0xc0000005 etc.) and 1001 (Bucket) plus System 6008 (unexpected shutdown) and 7045/7034 (service). Note Faulting application path and Exception code in Details→XML, then search the Bucket ID at Microsoft's troubleshooting.

What is Event ID 4624 and 4625?

Security log: 4624 = successful logon (check Logon Type: 2 console, 3 network, 7 unlock, 10 RDP; read IpAddress and TargetUserName from Data), 4625 = failed logon (bad password). Filter both together and group by IP to spot brute force.

How do I export Windows Event Logs?

GUI: right pane → Save Filtered Log File As → .evtx (preserves XML) . For scripts: wevtutil epl Security C:\Forensics\sec.evtx or PowerShell Get-WinEvent ... | Export-Csv sec.csv -NoType (CSV for Excel, but keep .evtx as truth).

Can I view Linux Apache/Nginx logs together with Windows logs?

Yes — export Windows events to UTC ISO8601 and parse Apache Combined Log Format and Nginx error logs with parsers first, then join by timestamp. Use an Apache access log parser and an Apache & Nginx error log analyzer to normalize fields, and a log timestamp converter to align timezones — then correlate 4624 RDP at 14:32:10Z with 403 at 14:32:12Z.