Windows logs record information about hardware, software, and system issues, and monitor events that occur on the system. When an ECS instance is compromised or experiences system or application issues, you can use logs to quickly pinpoint the root cause. This significantly improves efficiency and server security. This topic uses Windows Server 2022 as an example to explain how to use the system log, application log, security log, and applications and services log.
Background information
Windows logs fall into four categories:
-
system log
-
application log
-
security log
-
applications and services log
Open Event Viewer to view logs
Windows logs are enabled by default. You can open Event Viewer to view the logs after connecting to the instance.
To open Event Viewer and view logs:
-
Remotely connect to the Windows instance.
For more information, see Connect to a Windows instance by using Workbench.
-
Select , enter
eventvwrin the Run dialog box, and click OK to open the Event Viewer. -
In Event Viewer, view the following four types of logs.
NoteYou can find solutions in the Microsoft Knowledge Base by searching for the event IDs of logged errors.
System log
The system log contains events recorded by Windows system components. For example, the system log records the failure of a driver or other system component to load during startup. Windows predetermines these event types.
Application log
The application log contains events recorded by applications or programs. For example, a database program might record a file error in the application log.
Security log
The security log contains events such as valid and invalid logon attempts, as well as events related to resource use, such as creating, opening, or deleting files or other objects. You can specify which events the security log records. For example, if you enable logon auditing, the security log records logon attempts.
Applications and services log
The applications and services log is a new category of event logs. These logs store events from a single application or component, rather than system-wide events.
Change the log path and back up logs
To change the log path and back up logs:
-
In the Event Viewer window, click Windows Logs in the navigation pane on the left.
-
In the list, right-click a log name and select Type.
-
In the Log Properties window, modify the following settings as needed.
-
Log path.
-
Maximum log size.
-
The action to take when the maximum event log size is reached.
NoteBy default, logs are saved to the system disk. The default maximum log size is 20 MB. When the log file reaches this size, new events automatically overwrite the oldest ones. You can adjust these settings as needed to prevent log files from growing indefinitely while ensuring that new events are recorded.
-