Hi, In this post familiarizes to use the windows event viewer that is inbuilt into the Windows OS.
Event Viewer - Event Viewer is an application that captures all the events that occurs in the Windows OS In simple words it provides the logging functionality.
Eg - Shutting down is an event in Windows and is captured with the event id 6005
Here we shall create a custom view that captures the time of logins and logouts on the Windows OS.
The same method can be used to capture other events also
Note -
The event id for system turn on is 6005
The event id for system turn off is 6006
Steps to follow
1) Open event viewer by typing evenvwr.exe in the run window
2)Right click on the custom view and click on create custom view
3)In the create custom view window check the Information check box option and then select the By Log
check box and in the drop down expand windows log and then select the system check box
4)In the event id text box enter the values 6005,6006 Press OK
5)In the next window give the name to the view that we created
The above steps creates a custom view that indicated only the event logs when the system is turned on or turned off
Now open the view by double click on the created view.
This technique can be used to create separate views for different events by knowing the event ids for different events.
Best way to find the more information about an event id is to just google the event id
Eg - type "windows event id 6006" in google
Further Reading-
Event Viewer - Event Viewer is an application that captures all the events that occurs in the Windows OS In simple words it provides the logging functionality.
Eg - Shutting down is an event in Windows and is captured with the event id 6005
Here we shall create a custom view that captures the time of logins and logouts on the Windows OS.
The same method can be used to capture other events also
Note -
The event id for system turn on is 6005
The event id for system turn off is 6006
Steps to follow
1) Open event viewer by typing evenvwr.exe in the run window
2)Right click on the custom view and click on create custom view
3)In the create custom view window check the Information check box option and then select the By Log
check box and in the drop down expand windows log and then select the system check box
4)In the event id text box enter the values 6005,6006 Press OK
5)In the next window give the name to the view that we created
The above steps creates a custom view that indicated only the event logs when the system is turned on or turned off
Now open the view by double click on the created view.
This technique can be used to create separate views for different events by knowing the event ids for different events.
Best way to find the more information about an event id is to just google the event id
Eg - type "windows event id 6006" in google
Further Reading-
