When an ECS instance is attacked or an application fails, Windows event logs help you pinpoint the problem, investigate security incidents, and restore normal operation. This topic uses Windows Server 2022 as an example.
With Event Viewer, you can:
View system, application, security, and application and service logs in one place
Look up event IDs in the Microsoft Knowledge Base to find solutions
Modify log storage paths and size limits to meet your retention needs
Log types
Windows event logs are divided into four types:
| Log type | What it records | When to use it |
|---|---|---|
| System log | Events from Windows system components, such as a driver failing to load at startup. The event types are predetermined by Windows. | Investigate OS-level failures or unexpected restarts |
| Application log | Events from applications, such as a database program recording a file error | Diagnose application crashes or errors |
| Security log | Valid and invalid logon attempts, and resource use events such as creating, opening, or deleting files. If you enable logon auditing, logon attempts are recorded here. | Audit access and investigate security incidents |
| Application and service log | A new type of event log. Events from a single application or component, rather than system-wide events | Debug a specific service or application component |
View logs in Event Viewer
Windows system logs are enabled by default.
Prerequisites
Before you begin, ensure that you have:
Connected to the Windows instance. See Connect to a Windows instance through Workbench.
Open Event Viewer and view logs
Choose Start > Run. In the Run dialog box, enter
eventvwrand click OK to open Event Viewer.In the navigation pane, select the log category you want to review:
Windows Logs: contains system, application, and security logs.
Applications and Services Logs: contains per-application and per-component logs.
Tip: Each log entry includes an event ID. Search for the event ID in the Microsoft Knowledge Base to find recommended solutions.
Modify the log path and back up logs
By default, logs are stored on the system disk with a maximum size of 20,480 KB (20 MB). When a log file reaches the limit, older entries are overwritten. Adjust these settings if you need a longer retention period or want to store logs on a separate disk.
In the left-side navigation pane of Event Viewer, click Windows Logs.
In the right-side list, right-click a log name and choose Properties from the shortcut menu.
In the Log Properties dialog box, modify the settings you need:
Parameter Description Log path The file path where the log is stored. Change this to move logs to a different disk or directory. Maximum log size (KB) The maximum size of the log file. Default: 20480 (20 MB). When maximum event log size is reached The behavior when the log file is full. By default, older entries are overwritten.