Using the Event Viewer

This guide shows how to use the Event Viewer, the central log tool of Windows Server, to find the cause of failed services or crashed applications. You learn how to filter logs for errors and interpret Event ID, source and level.

Step 1

Open Event Viewer

The most direct way to open the console is via the "Run" command (Shortcut: Win + R).

Launch Console

eventvwr.msc

Step 2

Understand Log Categories

Under "Windows Logs" in the left pane, you will find the three most relevant categories for troubleshooting:

Application

Errors from installed software like web servers or databases.

Security

Logs for login attempts, permissions, and security audits.

System

Critical messages from Windows components (drivers, services).

Step 3

Filter for Errors

Since logs can contain thousands of entries, you should filter the view to find problems quickly:

1Right-click a category (e.g., System) > "Filter Current Log...".

2Under "Event level", select only Critical and Error.

3Optionally limit the time range and click OK to display only severe issues.

Analysis

Interpret an Event

Click on an event to see the details below. These three values are essential for your diagnosis:

Event IDUnique error number

SourceThe responsible component

LevelSeverity of the issue

Troubleshooting tip: Always search for the combination of Source and Event ID (e.g., "Kernel-Power ID 41") to quickly find solutions in technical forums.

Microsoft Documentation

Learn more about managing system logs on the official Microsoft Learn portal.

Microsoft Learn