How to Check Windows Event Viewer: A Comprehensive Guide

Introduction / Why This Is Needed

Windows Event Viewer is a built-in system tool that records information about the operating system, installed applications, and hardware. It is the first and primary source of data when diagnosing random slowdowns, program crashes, login errors, and hardware issues. Understanding the basics of working with Event Viewer allows you to independently find the causes of problems or provide a specialist with precise data (event ID, source, time), significantly speeding up the resolution process.

After completing this guide, you will be able to confidently open the log, find the necessary events, filter them by key parameters, and export logs for further use.

Requirements / Preparation

Before you begin, ensure that:

1. You have a user account with administrator privileges (especially for viewing the "System" and "Security" logs).
2. You are running Windows 10 or Windows 11. The interface and paths are virtually identical.
3. The problem you want to investigate has already occurred or is currently happening in the system. Try to act immediately after an error occurs to prevent events from being overwritten.

Step-by-Step Guide

Step 1: Open Event Viewer

There are several quick ways to launch eventvwr.msc:

• Modern (recommended): Press Win + R, type eventvwr.msc, and press Enter.
• Via Search: In the Start menu, begin typing "Event Viewer" and select the found application.
• Via Control Panel: Open "Control Panel" → "Administrative Tools" → "Event Viewer".

The Event Viewer window will open with a tree structure on the left.

Step 2: Explore the Log Structure

In the left part of the window, expand the Windows Logs node. You will see three main categories:

• Application: Events from installed programs (e.g., Microsoft Office, browsers, games). Errors here are often related to specific software.
• System: Events from hardware drivers and the Windows kernel. Service failures, driver loading issues, and disk errors are logged here.
• Security: Events related to auditing (logins, file access). Requires administrator privileges for full viewing.

Logs from third-party applications (e.g., .NET Runtime, Microsoft-Windows-PowerShell) may also be present.

Step 3: Filter Events for Search

To avoid manually scrolling through thousands of entries, use a filter:

1. Select the desired log (e.g., System).
2. In the right-hand "Actions" pane, click Filter Current Log....
3. In the window that opens, configure the parameters:
   • Level: Most often, search for Error and/or Warning. Information events are usually excessive.
   • Event ID: If you know the numeric error code (e.g., 1001), enter it. Ranges can be used.
   • Time: Specify the period of interest (e.g., "Last 24 hours" or specific dates).
   • Source: Filters by the component that generated the event (e.g., Disk, Service Control Manager, Winlogon).
4. Click OK. The event list will be refiltered.

Step 4: Analyze the Found Event

You need to "read" the found event. To do this:

1. Double-click the event line in the central pane.
2. The Event Properties window will open.
3. Key fields to analyze:
   • Level: Error, Warning, Information.
   • Source: The name of the module or service that generated the entry (e.g., Service Control Manager).
   • Event ID: The numeric identifier (e.g., 7031, 41). This is the most important parameter for finding a solution online.
   • Description: The textual description of the error. It often contains technical details, file names, or service names.
   • Event Data: Additional hex data that may be needed by developers.

Tip: Copy the Event ID and Source, enter them in FixPedia or Google in the format: "Event ID" Windows "Source" (e.g., "7031" Windows "Service Control Manager").

Step 5: Export the Log or Event

To save a log or send it to technical support:

• Export the entire filtered log:
  1. Ensure the desired log is selected in the tree on the left.
  2. In the Action menu, select Save All Events As....
  3. Specify a filename and save in .evtx format. This file can be opened on another Windows computer.
• Copy a single event:
  1. Select the event in the list.
  2. Press Ctrl+C or in the Action menu select Copy.
  3. Paste (Ctrl+V) into a text editor (Notepad, Notepad++). You will get all the event details in readable text form.

Verification of Results

You have successfully checked the Event Viewer if:

1. You managed to open Event Viewer and saw the list of logs.
2. Using the filter, you found at least one event with level Error or Warning in the last 24 hours.
3. You identified the Event ID and Source for the problem you are interested in.
4. You know how to export data (copy a single event or save the entire log).

If no "Error" level events are found, the problem may be non-systemic (software settings, network issues) or may have already been resolved after a reboot.

Possible Issues

• "Access denied" when opening the "System" or "Security" logs.
  • Solution: Run "Event Viewer" as an administrator (find eventvwr.msc in the Start menu, right-click → "Run as administrator").
• The log is empty or contains very few entries.
  • Cause: The log retention policy may be set to "Overwrite events as needed" and old entries have already been deleted. Events may also be logged only when a specific component is enabled (e.g., login auditing).
  • Solution: Configure the log settings: right-click on the log → "Properties". Increase the log size or change the overwrite policy.
• Cannot find an event by a known ID.
  • Cause: The filter is set incorrectly (e.g., the wrong log or event level is selected).
  • Solution: First, select the correct log (Application or System). Remove the level filter or set it to "Critical" and "Error". In the Event ID field, enter only the numeric value, without words.
• The event exists, but the description is unclear or in English.
  • Solution: Use the Event ID and Source to search online. Add the word windows and your OS version to the query. Many Event IDs are documented in Microsoft Docs.