Event Types

By Adrian Grigorof, MCSE

Windows NT/2000/XP/2003/Vista have 3 types of logs

Application Log - Contains events reported by various applications installed on the Windows NT server. These can be Microsoft or 3-rd party applications. 

File: %SystemRoot%\System32\Config\AppEvent.evt

Security Log - Contains all the auditing and security events. 

File: %SystemRoot%\System32\Config\SecEvent.evt

System Log - Contains events reported by Windows NT system components (processes, kernel, drivers.

File: %SystemRoot%\System32\Config\SysEvent.evt

Windows servers configured with Active Directory have 3 additional logs:

Directory Service - Contains events reported by Active Directory

File: %SystemRoot%\System32\Config\Director.evt

DNS Server - Contains events reported by Microsoft Windows 2000 DNS Server.

File: %SystemRoot%\System32\Config\DNSEvent.evt

File Replication Service - Contains events reported by Microsoft FRS Service.

File: %SystemRoot%\System32\Config\NTFrs.evt

Note: Win2K Professional cannot read any of the DNS/FRS/DS logs, unless the Admin pack is installed.

Windows event logs contain 5 types of events:

Information - An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.

Error - A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an error will be logged.

Warning - An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a warning will be logged.

Success Audit - An audited security access attempt that succeeds. For example, a user's successful attempt to log on to the system will be logged as a Success Audit event.

Failure Audit - An audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.