Server Maintenance Tip: Windows Server 2008 Event Logs

  • calender Image October 18, 2011
  • Posted By Eric Schlissel
Blog Image

Ever wonder what your Windows Servers are doing when you leave the office? The answers are only a few clicks away located in the Event Logs! Combing the event logs should be part of your daily system checks as an IT Professional.
First go to Administrative Tools on a Windows Server and open Event Viewer. There are many categories in the Event Viewer depending on what is installed on your server. We will focus on Application, Security and System for now.

windows-server-2008-event-viewer
Windows Server 2008 Event Viewer

There are 3 types of events, Informational, Warning and Error for each category.
Most of the time the Information events are things to be aware of, but do not require action. An example of an Information event from the Application Log is Event ID 1704. This is stating that Group Policy Objects have been applied. Good information to know and no action required.
windows-server-event-viewer-application-information-logs

Windows Server Event Viewer Application Information LogsA Warning event is something to be aware of, look into and potentially act upon. An example of a warning from the System Log is Event ID 36. This warning event is one that is very important to be aware of and may actually require attention. It indicates that the Time Service has not synchronized in a certain amount of time. This may not sound important in the very beginning, but a Windows Domain requires Time Synchronization for many services to function. If the event is continually logged than action will be required. A slight delay in Time Sync can happen from time to time.

windows-server-2008-event-viewer-system-warning-logs
Windows Server 2008 Event Viewer System Warning Logs

An Error event is usually something that requires immediate attention and may be prohibiting the server from function normally. One example of an error message taken from the System Log is Event ID 1059. This error is referring to the DHCP Server not being Authorized. Definitely an important message to pay attention to, however this may not be an emergency. If a server has DHCP installed, but is not authorized because another server or device handles DHCP then this message can be ignored. If it is the only source for DHCP than attention is necessary.

windows-server-event-viewer-system-error-logs
Windows Server Event Viewer System Error Logs

Another example of an error taken from the System Log is Event ID 5719. This is normally a critical error indication some type of network problem because the computer could set up a secure session with a Domain Controller. This will in most cases require immediate attention.

Windows Server Event Viewer System Error Logs
Windows Server Event Viewer System Error Logs

These are just a few among many Events from a Windows Server 2008 Event Viewer. To be an effective IT Professional you must know your environment; be aware of what services are installed on your network and what systems they reside on. Look at the logs each day to know what is going on within the environment. It’s all right there at your finger tips.

Server Maintenance Tip

Server Maintenance Tip: Windows Server 2008 Event Logs

Ever wonder what your Windows Servers are doing when you leave the office? The answers are only a few clicks away located in the Event Logs! Combing the event logs should be part of your daily system checks as an IT Professional.
First go to Administrative Tools on a Windows Server and open Event Viewer. There are many categories in the Event Viewer depending on what is installed on your server. We will focus on Application, Security and System for now.

windows-server-2008-event-viewer
Windows Server 2008 Event Viewer

There are 3 types of events, Informational, Warning and Error for each category.
Most of the time the Information events are things to be aware of, but do not require action. An example of an Information event from the Application Log is Event ID 1704. This is stating that Group Policy Objects have been applied. Good information to know and no action required.
windows-server-event-viewer-application-information-logs

Windows Server Event Viewer Application Information LogsA Warning event is something to be aware of, look into and potentially act upon. An example of a warning from the System Log is Event ID 36. This warning event is one that is very important to be aware of and may actually require attention. It indicates that the Time Service has not synchronized in a certain amount of time. This may not sound important in the very beginning, but a Windows Domain requires Time Synchronization for many services to function. If the event is continually logged than action will be required. A slight delay in Time Sync can happen from time to time.

windows-server-2008-event-viewer-system-warning-logs
Windows Server 2008 Event Viewer System Warning Logs

An Error event is usually something that requires immediate attention and may be prohibiting the server from function normally. One example of an error message taken from the System Log is Event ID 1059. This error is referring to the DHCP Server not being Authorized. Definitely an important message to pay attention to, however this may not be an emergency. If a server has DHCP installed, but is not authorized because another server or device handles DHCP then this message can be ignored. If it is the only source for DHCP than attention is necessary.

windows-server-event-viewer-system-error-logs
Windows Server Event Viewer System Error Logs

Another example of an error taken from the System Log is Event ID 5719. This is normally a critical error indication some type of network problem because the computer could set up a secure session with a Domain Controller. This will in most cases require immediate attention.

Windows Server Event Viewer System Error Logs
Windows Server Event Viewer System Error Logs

These are just a few among many Events from a Windows Server 2008 Event Viewer. To be an effective IT Professional you must know your environment; be aware of what services are installed on your network and what systems they reside on. Look at the logs each day to know what is going on within the environment. It’s all right there at your finger tips.

You also might be interested in

Related Image

FAQ: GeekTek Rebranding as XOverture

calender ImageJuly 28, 2021 We’re excited to announce that as of 7/29/2021 the IT services company formerly known as GeekTek will be changing our name and branding to XOverture! Why the Name Change? Our CEO Eric Schlissel started GeekTek …

Server Maintenance Tip: Windows Server 2008 Event Logs Read More »

Read full post
Related Image

Press Release: GeekTek, MSP of the Year, to Rebrand as XOverture

calender ImageJuly 28, 2021 LOS ANGELES, CA – July 15, 2021 – GeekTek, the boutique managed IT services provider and consultancy headquartered in Los Angeles, and winner of various awards from CRN, MSPmentor, and Channel Partner Insight, including 2019 …

Server Maintenance Tip: Windows Server 2008 Event Logs Read More »

Read full post
Related Image

5G Business Implications - What to Expect

calender ImageJuly 12, 2021 With the introduction of 5G cell networks, the world is about to change forever. 5G has been hailed as a panacea for any connectivity issues that have arisen in the past, as well as a …

Server Maintenance Tip: Windows Server 2008 Event Logs Read More »

Read full post