Event Viewer type command???
The answer is probably here somewhere, but it'll probably take an age to trawl through the boards.
Is there such a thing as an Event Viewer, like in Windows? I know about the one that monitors the hardware side of things, i.e the lens cover, keyboard, back cover etc.
But is there something that will give a report on software events, i.e This app was started at such a time, that app was started such a time, such an app crashed such a time.
My phone has been crashing a bit lately and I want to find out which app or service could be causing it, if it's possible?
The nearest I can think of is the dbus-monitor command.
Unlike event viewer there is no log, i but it does show you stuff in real time.
dbus is a message system used by most Linux systems. Processes attach to the "dbus" and listen and send messages.. the dbus acts like a hub, pushing the messages (and responses to messages) back and forth.
dbus-monitor will show you all the messages as they fly about..
It's not easy to read..
You could try running it in an x terminal and sending the output to the emmc
dbus-monitor > MyDocs/dbuslog
but it'll get fairly large quite quickly so I wouldn't leave it running for ever
downside, it doesn't store the time an event happened.. you could pipe it through a nasty awk script to do the same though:
dbus-monitor | awk '{print strftime()": "$0}' | tee -a MyDocs/dbus.log.txt
This would write a log to dbus.log.txt on your eMMC and each line would have the time at the start..
Similar Messages
-
When I open Safari, I always type command-plus to enlarge the view. However, I can't figure out how to permanently set the Safari screen to this view setting in the preferences. Any ideas?
Sorry, but you must Command + for every page. It's not permanent.
If you haven't tried yet, check out Zoom in Safari > Preferences > Accessibility -
Event viewer : The type initializer for 'advancedsetttings' threw an exception
I am recieving a " The type initializer for 'advancedsetttings' threw an exception" error when i try to view subscriptions in event viewer. The machine is a windows 2008r2 server. It was working before but just stoped working.
I tried loging in as the local admin account on machine and that did not work. It also does not work with an account that is a domain admin. Has anyone else experienced this or know how to fix this issue?Hi,
Based on my research, Event Subscriptions functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service, please make sure that
both of these services are running on computers participating in the forwarding and collecting process.
More information for you:
Event Subscriptions
http://technet.microsoft.com/en-us/library/cc749183.aspx
Best Regards,
Amy -
I am new to scripting (literally started reading/learning scripting a few hours ago), and I am stuck in trying to get my current script/command to filter a specific date range.
* Note: I am working with Server 2003 and 2008; because of the environment I am in, a lot of scripts (such as Powershell and VBScript) don't work; trying to stick with command line, as it appears to be the only thing that functions correctly in my environment
I am trying to search the System log in event viewer, for the most recent server reboot. Here is the command that I am currently running:
===========================================================
C:\Windows\System32\cscript C:\Windows\System32\eventquery.vbs /L System /FI "id eq 1074"
===========================================================
When run, the output looks like this:
===========================================================
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved
Listing the events in 'system' log of host 'xxxxxxxxxxxxxxx'
Type Event
Date Time Source
Information 1074
12/18/2013 2:48:06 AM USER32
Information 1074
11/20/2013 3:25:04 AM USER32
Information 1074
10/23/2013 2:06:09 AM USER32
===========================================================
What I would like it to do is only show events that have happened in the last seven days, as well as show the event details if it does find an event that matches the criteria.
Any help would be greatly appreciated. Thanks!
NickI would prefer using Powershell , you can use below code
function Get-EventViewer
param(
[string[]]$ComputerName = $ENV:COMPUTERNAME,[string]$LogName,[int]$eventid
$Object =@()
foreach ($Computer in $ComputerName)
$ApplicationEvents = get-eventlog -logname $LogName -cn $computer -after (Get-Date).AddDays(-7) | ?{$_.eventid -eq "$eventid" }
foreach ($event in $ApplicationEvents) {
$Object += New-Object -Type PSObject -Property @{
ComputerName = $Computer.ToUpper();
TimeGenerated = $event.TimeGenerated;
EntryType = $event.EntryType;
Source = $event.Source;
Message = $event.Message;
$column1 = @{expression="ComputerName"; width=12; label="ComputerName"; alignment="left"}
$column2 = @{expression="TimeGenerated"; width=22; label="TimeGenerated"; alignment="left"}
$column3 = @{expression="EntryType"; width=10; label="EntryType"; alignment="left"}
$column4 = @{expression="Source"; width=15; label="Source"; alignment="left"}
$column5 = @{expression="Message"; width=100; label="Message"; alignment="left"}
$Object|format-table $column1, $column2, $column3 ,$column4 ,$column5
$Object.GetEnumerator() | Out-GridView -Title "Event Viewer"
You can do a function call like
Get-EventViewer -LogName system -ComputerName "computername" -eventid "2017" -
Windows is Scanning and repairing drive... (- Errors in Event Viewer)
Long post, please be patient... :)
I have a fairly new (purchased 8/2013) Lenovo ThinkPad T431s with Windows 8.1 Pro 64-bit (updated from 8.0 -> 8.1). It has a very tricky error coming basically 8 / 10 boots:
Windows is Scanning and repairing drive...
Error details from Windows Event Viewer (a new similar error appears on every boot to event viewer):
A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference
number of the file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
What has been done 1st trying to fix that:
SSD disk has been changed (image from previous SSD copied back) ->
no solution, error remains
chkdsk /F /R -> no solution, error remains
SFC /scannow -> no solution, error remains
dism /online /cleanup-image /restorehealth -> no solution, error remains after a few boots
TRIED using Windows 8.1 "Update & Recovery -> Refresh Your PC without affecting your files" -> Inserted the Lenovo "Operating System Recovery Disk Windows 8 Pro (OEM Activation 3.0 Required)" BUT Windows did not accept
that DVD claiming "The media inserted is not valid"... ???
Ended up calling Lenovo Support and they instructed me to order the Recovery DVD from
Lenovorecovery.com -> Unfortunatelly Windows does not recognice the DVD(s)...
mountvol returns:
\\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3}\
(This is my C:\ drive where Windows installation resides)
\\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7}\
*** NO MOUNT POINTS ***
\\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\
*** NO MOUNT POINTS ***
\\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897}\
*** NO MOUNT POINTS ***
Then running fsutil dirty query on each returns:
Volume - \\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3} is NOT Dirty
Volume - \\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7} is NOT Dirty
Volume - \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} is Dirty
Volume - \\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897} is NOT Dirty
The chkdsk on the dirty volume
\\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\ returned:
The type of the file system is NTFS.
Insufficient storage available to create either the shadow copy storage file or
other shadow copy data.
A snapshot error occured while scanning this drive. Run an offline scan and fix.
Diskpart output on the same volume:
DISKPART> lis par
Partition ### Type Size Offset
Partition 1 Reserved 128 MB 17 KB
Partition 2 Recovery 1000 MB 129 MB
Partition 3 System 260 MB 1129 MB
Partition 4 Primary 146 GB 1389 MB
Partition 5 Recovery 350 MB 147 GB
Partition 6 Recovery 19 GB 148 GB
Questions:
1) Are my Partitions OK, haven't "touched" anything?
2) Excluded the dirty volume from boot checking with chkntfs /x
-> still the Error appears in Event viewer log (but Scanning is skipped/not shown anymore during the boot).
What is causing the error?
3) Why do I have three (3) recovery partitions?What has happened in the past days:
A) Lenovo on-site-Support changed the motherboard -> had no impact on the error (which I expected).
B) I found
instructions how to manually create USB Flash stick with a booting Custom (OEM) Recovery Image.
C) Booted with USB and performed "Refresh your PC without affecting your files."
D) Windows was refreshed but...
-->>
Still the error remains (Windows scanning and repairing drive \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} on each and every boot.
1) Related Error in Event viewer (NTFS):
A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference number of the
file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
2) Related Error in Event viewer (NTFS - Microsoft Windows NTFS):
Volume \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via
PowerShell.
-->>
Now Lenovo support is proposing a full re-install (to be performed by myself) of Windows as this is SW issue.
Summary:
- Refreshing my T431s with OEM Image does not help
- The error remains on \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5; Lenovo Recovery partition) OR at least Windows thinks so... -
When I first install windows 8.1 I was able to type "event viewer" in the metro search and start it there. Now when I do it it just gives link to descriptions of what it is. Did MS take that out now. The only way I can get to it now is
a search from control panel.TIAonly way I can get to it now is a search from control panel.TIA
Easiest method IMO: Win-x V Otherwise, since it is an Admin command you may have to type the full program name eventvwr to see it, even when you have specified to show Admin commands.
Hmm... there used to be an option somewhere to avoid that. I don't know which state mine is in. I (dimly recollect) that there was an Options item in the MUF Settings charm which would do that. It's gone. Oh. There it is.
It's Tiles not Options. FWIW in there I have Don't show Administrative tools, so that explains why I have search for the whole program name explicitly (if I want to use the Start Screen).
FYI
Robert Aldwinckle -
Multiple Event Viewer Error Ids, Corrupt Catalogs, System not working right. Please help.
Since I could not find a list of the Event Ids that was accurate at all or not too general as to be useless and Microsoft won't let us know how to fix these ourselves without having a programming degree, I am begging for help from anyone who can help
me get my computer working right again. I have some important things to get done which I can't do without my computer working. I have tried to get what I could get but I am blocked from many files which makes it difficult to get info. Please help. I appreciate
any help I can get. Thank you,
WhiteFox42
I am not sure which one is more important.
Event id 20
Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 for x64-based Systems
(KB2468871).
Event id 11
Possible Memory Leak. Application (C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted) (PID: 476) has passed a non-NULL pointer to RPC for an [out] parameter marked [allocate(all_nodes)]. [allocate(all_nodes)] parameters are always
reallocated; if the original pointer contained the address of valid memory, that memory will be leaked. The call originated on the interface with UUID ({3f31c91e-2545-4b7b-9311-9529e8bffef6}), Method number (20). User Action: Contact your application
vendor for an updated version of the application.
Event id 455
taskhost (1348) WebCacheLocal: Error -1811 (0xfffff8ed) occurred while opening logfile R:\User\App Data\Roaming\Microsoft\Templates\Local\Microsoft\Windows\WebCache\V01.log.
Event Xml:
Event id 505
wuaueng.dll (1012) SUS20ClientDataStore: An attempt to open the compressed file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed because it could not be converted to a normal file. The open file operation
will fail with error -4005 (0xfffff05b). To prevent this error in the future you can manually decompress the file and change the compression state of the containing folder to uncompressed. Writing to this file when it is compressed is not supported.
Event id 513
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object
Event id 1000
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16428, time stamp: 0x525b664c
Faulting module name: IEFRAME.dll, version: 11.0.9600.16476, time stamp: 0x52944cf2
Exception code: 0xc0000005
Fault offset: 0x00025f1d
Faulting process id: 0x1854
Faulting application start time: 0x01cf0735f0e5f0c7
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\system32\IEFRAME.dll
Report Id: e3dc1e9a-733f-11e3-b920-00215a2af202
Event id 1000
Faulting application name: msiexec.exe, version: 5.0.7601.17514, time stamp: 0x4ce79d93
Faulting module name: msvcrt.dll, version: 7.0.7601.17744, time stamp: 0x4eeb033f
Exception code: 0xc0000005
Fault offset: 0x00000000000035e1
Faulting process id: 0x1030
Faulting application start time: 0x01cf01b77867a358
Faulting application path: C:\Windows\system32\msiexec.exe
Faulting module path: C:\Windows\system32\msvcrt.dll
Report Id: f7253b17-6daa-11e3-b944-00215a2af202
Event id 1002
Computer: w7mar-64 "I don't know why it has computer as this when it should not be."
Description:
The IP address lease 192.168.200.195 for the Network Card with network address 0x08002742F261 has been denied by the DHCP server 192.168.200.1 (The DHCP Server sent a DHCPNACK message).
Event id 1008
The Windows Search Service is starting up and attempting to remove the old search index {Reason: Index Corruption}.
Event id 1008
Computer: w7mar-64
Description:
An errorUser: LOCAL SERVICE
occurred in initializing the interface. The error code is: 0x2.
Event id 1014
User: NETWORK SERVICE
Computer:
Description:
Name resolution for the name wpad.westell.com timed out after none of the configured DNS servers responded.
Event id 1015
User: N/A
Computer: w7mar-64
Description:
Event ID 1013 for the Windows Search Service has been suppressed 7 time(s) since 12:04:10 PM. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time. See Event ID 1013 for further details
on this event.
Event id 1015
Failed to connect to server. Error: 0x8007043C
Event id 1018
The description for Event ID 1018 from source EvntAgnt cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 1020
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
Event id 1028
Windows Installer has determined that its configuration data cache folder was not secured properly. The owner of the key must be either Local System or Builtin\Administrators. The existing folder will be deleted and re-created with the appropriate security
settings.
Event id 1101
.NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.Web.Entity.Design, Version=3.5.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil . Error code = 0x80010108
Event id 1500
The description for Event ID 1500 from source SNMP cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 1530
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
Event id 1530
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
6 user registry handles leaked from \Registry\User\S-1-5-21-2959539970-205720217-4182857889-1000:
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Internet Explorer\Main
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Policies
Event id 3028
Context: Windows Application, SystemIndex Catalog
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 3029
Context: Windows Application, SystemIndex Catalog
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 3036
The content source <csc://{S-1-5-21-2959539970-205720217-4182857889-1001}/> cannot be accessed.
Event id 3036
No protocol handler is available. Install a protocol handler that can process this URL type. (HRESULT : 0x80040d37) (0x80040d37)
Event id 4104
Description:
The backup was not successful. The error is: Access is denied. (0x80070005).
Event id 4228
TCP/IP has chosen to restrict the scale factor due to a network condition. This could be related to a problem in a network device and will cause degraded throughput.
Event id 4321
The name "WHITEFOXPC :0" could not be registered on the interface with IP address 192.168.1.21. The computer with the IP address 192.168.1.19 did not allow the name to be claimed by this computer.
Event id 4373
The description for Event ID 4373 from source NtServicePack cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 4879
MSDTC encountered an error (HR=0x80000171) while attempting to establish a secure connection with system WHITEFOXPC.
Event id 6000
The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
Event id 6006
The winlogon notification subscriber <TrustedInstaller> took 186 second(s) to handle the notification event (CreateSession).
Event id 7000
The Windows Audio service failed to start due to the following error:
A privilege that the service requires to function properly does not exist in the service account configuration. You may use the Services Microsoft Management Console (MMC) snap-in (services.msc) and the Local Security Settings MMC snap-in (secpol.msc) to view
the service configuration and the account configuration.
Event id 7001
The Computer Browser service depends on the Server service which failed to start because of the following error:
The dependency service or group failed to start.
Event id 7010
The index cannot be initialized.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 7023
The Block Level Backup Engine Service service terminated with the following error:
%%-2147024713
Event id 7024
The Windows Search service terminated with service-specific error %%-1073473535.
Event id 7026
The following boot-start or system-start driver(s) failed to load:
aswKbd
aswRvrt
aswSnx
aswSP
aswTdi
aswVmm
discache
spldr
Wanarpv6
Event id 7030 & 7031
The dldw_device service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
Event id 7032
The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Installer service, but this action failed with the following error:
An instance of the service is already running.
Event id 7040
The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.
Event id 7042
The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 8210
An unspecified error occurred during System Restore: (Installed Java 7 Update 45). Additional information: 0x80070003.
Event id 9000
The Windows Search Service cannot open the Jet property store.
Details:
0x%08x (0xc0041800 - The content index database is corrupt. (HRESULT : 0xc0041800))
Event id 10005
DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}
Event id 10010
15 of these with different server codes which I can't copy unless I copy all the details.
The server {3EEF301F-B596-4C0B-BD92-013BEAFCE793} did not register with DCOM within the required timeout.
Event id 12348
Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{8e79517c-6c41-11e3-b621-cb03f0618d54}\. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning
properly. Check security on the volume, and try the operation again.
Event id 15006
9 of these.
Description:
Owner of the log file or directory \SystemRoot\System32\LogFiles\HTTPERR\httperr1.log is invalid. This could be because another user has already created the log file or the directory.
Event id 31004
33 of tese.
The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
The End.
Kimberly D. White-FoxPlease provide a copy of your System Information file. Type System Information in the Search Box above the start Button and press the ENTER key
(alternative is Select Start, All Programs, Accessories, System Tools, System Information). Select File, Export and give the file a name noting where it is located. The system creates a new System Information file each time system information is accessed.
You need to allow a minute or two for the file to be fully populated before exporting a copy. Please upload to your Sky Drive, share with everyone and post a link here. Please say if the report has been obtained in safe mode.
Please upload and share with everyone copies of your System and Application logs from your Event Viewer to your Sky Drive and post a link here.
To access the System log select Start, Control Panel, Administrative Tools, Event Viewer, from the list in the left side of the window select Windows
Logs and System. Place the cursor on System, select Action from the Menu and Save All Events as (the default evtx file type) and give the file a name. Do the same for the Applications log. Do not provide filtered files.
For help with Sky Drive see paragraph 9.3:
http://www.gerryscomputertips.co.uk/MicrosoftCommunity1.htm
Some Event Viewer reports are generated solely because the computer is in safe mode or safe mode with networking. You have at least one example of this in your long list. If you do not see the same report for a time when
the computer was in normal mode then it can be disregarded.
You will find some general advice on interpreting Event Viewer reports here:
http://www.gerryscomputertips.co.uk/syserrors5.htm
Hope this helps, Gerry -
Events show pictures in Events view but have no contents when opened
Hi. Using iPhoto 9.5.1 with Mavericks 10.9.1 with library storage on Mavericks Server. When I go to Events view (under Library on the upper left navigation panel) I see events and on each I can hover over and scroll through and see the pictures. When I double click to open the event, no photos show. When I go to Photos view I see the pictures.
Thoughts on what to do? Thanks.Back Up and try rebuild the library: hold down the command and option (or alt) keys while launching iPhoto. Use the resulting dialogue to rebuild. Choose to Repair Database. If that doesn't help, then try again, this time using Rebuild Database.
-
How do you change the Event Viewer archive location in Server 2008 R2?
We're wanting to redirect the security and system event viewer logs to the D:\ on a Server 2008 R2 box
We've got the current logs to save there, however all archived system/security logs are still being saved on the c:\ in their default location in %windir%\system32... and killing the OS partition.
I can write something up in PoSh and schedule it, but I'd rather use any built-in capabilities first...
I've taken a peek in the HKLM\Services\CurrentControlSet... hive where the event viewer behavior is configured and do not see an option to set a path for the archive location...Unfortunately, you cannot customize the location of archived event logs in Windows. The logs will always be archived to %windir%\system32\Winevt\Logs\Archive-xxxxxx
There'd be some scripts can help you automatically archived logs to another location. You can find them here: http://gallery.technet.microsoft.com/scriptcenter/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=security
Regards,
Zhang
TechNet Subscriber Support
If you are
TechNet Subscriptionuser
and have any feedback, please send your feedback here. -
IPhoto events view broken after import, images missing
I'm running the latest iPhoto on a 10.8.2 Retina MacBook Pro and experience some strange import problems since the end of last month.
My library holds more then 26.000 images right now and whenever I try to import some new images by dragging them from Finder to the iPhoto library the images (and videos) get imported... but when I try to view the event afterwards it doesn't open and the scrolling of the complete events view is broken. The scrollbar moves but thumbnails of events don't! I'm not able to use the events view anymore after a try to open such broken event.
When I use the regular photos view (the 2nd item in the left menu) I can see and use these new images... until I quit and restart iPhoto. Afterwards many images are missing – see http://cl.ly/JrjF for an example. I can delete those broken events... but not empty the trash afterwards. It just hangs while purging all entries.
Has anyone experienced this already?
I'm importing iPhone images uploaded to the DropBox "Camera Uploads" folder. But I can't believe it has to do with anything related to this.
I've also disabled the Photostream feature (not the shared ones) in iPhoto because I got tired of splitted events due to Photostream missing some images now and then. Maybe it has to do with that disabled feature. I'll try to reenable it after restoring my 5 days old backup (120GB) a second time now.
Thanks for your help... let's hope I can solve this.This sounds like a damaged database.
Try this test:
Hold down the option (or alt) key and launch iPhoto. From the resulting menu select 'Create Library'
Import a few pics into this new, blank library. Is the Problem repeated there?
If it's not then back to your main Library:
Option 1
Back Up and try rebuild the library: hold down the command and option (or alt) keys while launching iPhoto. Use the resulting dialogue to rebuild. Choose to Repair Database. If that doesn't help, then try again, this time using Rebuild Database.
If that fails:
Option 2
Download iPhoto Library Manager and use its rebuild function. (In Library Manager it's the FIle -> Rebuild command)
This will create an entirely new library. It will then copy (or try to) your photos and all the associated metadata and versions to this new Library, and arrange it as close as it can to what you had in the damaged Library. It does this based on information it finds in the iPhoto sharing mechanism - but that means that things not shared won't be there, so no slideshows, books or calendars, for instance - but it should get all your events, albums and keywords, faces and places back.
Because this process creates an entirely new library and leaves your old one untouched, it is non-destructive, and if you're not happy with the results you can simply return to your old one.
Regards
TD -
Hi brothers,
After installed the Moss 2007(basic) , I find some error in event view. The event ID is "6102". More detail information is shown below.
Event Type: Error
Event Source: Office SharePoint Server
Event Category: Launcher Service Event ID: 6102Date: 11/27/2007Time: 8:22:17 AMUser: N/AComputer: MOSS-001Description:LoadBalancer.RegisterLauncher failed: Unable to connect to the remote server For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Please help me, thanks.Hi,
i think this has to do with the "Document Conversions Load Balancer Service".
If you don't need the service than try to stop it:
Start Central Administration > Operations > Services and stop the service.
or
If you need it the service, try this:
Start Central Administration > Operations > Service Account
Change the service account to "Document Conversions Load Balancer Service" And Select a "Network Services" Click Save
Hope this helps!
Cheers,
Daniel Bugday
Web:
SharePoint Forum
Blog:
Daniel Bugday's SharePoint Blog -
Hi,
I am seeing the following errors on the subcriber Event Viewer system log. Does anyone know what is causing this.
Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 4/28/2006
Time: 10:12:19 AM
User: N/A
Computer: CCM_SUB
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{81B27D00-C66E-4969-A4CA-A2E89101A90E}. The backup browser is stopping.
Data:
0000: 05 00 00 00 ....
and also this
Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 4/28/2006
Time: 10:12:19 AM
User: N/A
Computer: CCM_SUB
Description:
The browser was unable to retrieve a list of servers from the browser master \\CCM_PUB on the network \Device\NetBT_Tcpip_{81B27D00-C66E-4969-A4CA-A2E89101A90E}. The data is the error code.
Data:
0000: 05 00 00 00 ....
Cheers,
Rafiq.http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_troubleshooting_guide_chapter09186a008011b369.html#wp1047403
Browser Service: Every 2 Hours, an Error Occurs in the Event Log on the Subscriber
Symptom
Error Message The browser server has failed to retrieve the backup
list too many times on transport \Device\netBT_Tcpip (c96xxx)
The backup browser is stopping.
Warning: The browser was unable to retrieve a list of servers from the browser master \\AACCMP1 on the network \Device\netBT_Tcpip (c96xxx) the data is the error code.
Probable Cause
Cause indicates a NIC card problem. You need to upgrade the OS to a newer version.
Corrective Action
Procedure
Step 1 If you have an MCS-7830 and build the OS with the new 2000.1.2 OS installation, run the OS upgrade version 2000.1.3 to fix the NIC card problem.
If this is not your problem, verify the following actions:
Step 2 Ensure that your WINS address is correct.
Step 3 Ensure that Enable NetBIOS over TCP/IP is chosen.
Step 4 Ensure that the WINS address is correct on the master browser \\AACCM1.
Cheers
Please rate post if helpful. -
Calendar View: Unable filter Recurring Event by Start/End Time and Group by Recurring Event View
Hi All,
I have just found several issues with Calendar View from WSS 3.0:
Unable to filter by [Start Time] and [End Time]
I am not sure why these 2 columns doesn't appear in the Filtering column in the View Settings. The workaround found in the internet is to create calculated column for Start Time and and End Time. However, it doesn't work for Recurring Event, the calculated column will show only first recurring event Start Time.
Unable to use "Group By"
When I create new view in Calendar using format: "Standard View, with Expanding Recurring Events", there is no option to specify "Group By". Anyone knows how to show all recurring event in List view and grouped by Start Time (or any other column).
Thank you and apprecate for any idea.Hello,
I got this from a colleague of mine so I can't take credit for it but here might be a possible workaround:
1. Create two new Columns called Start Filter and End Filter. Make these columns Calculated Columns with formulas of [Start Time] and [End Time] respectively. The columns should be of the Date and Time\Date and Time type and should not be displayed on the Default View.
2. Click Advanced Settings and choose Yes to the question "Allow management of Content Types" in the Content Types section. Click OK.
3. Click on the Event Content Type. Open the two columns created in step 1 and select "hidden" for both of them. Click OK.
4. Back at the list settings create a new view or edit an existing view. When you get to the filter section choose "Show items only when the following is true" and select the following:
Start Filter
is less than or equal to
[Today]
And
End Filter
is greater than or equal to
[Today]
5. Click OK to save the view.
6. Open the List view web part that is displaying the recently changed calendar and change the view to the newly created or newly edited view. Click Apply, OK.
-Aseem Nayar
This posting is provided "AS IS" with no warranties, and confers no rights -
Event Viewer reporting continuous problem with Firefox
I had to disable McAfee Site Advisor because if enabled I could not use the back and forth arrows on the browser in some instances. In trying to track this problem down I discovered there is a continuous problem reported in Event Viewer with this information:
The entry <C:\USERS\CINDY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\PV0GC0WS.DEFAULT\CACHE\_CACHE_003_> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)
Can anyone please help with this?The error could be something trivial, it will depend really on what problems you are having, and I note you have made a few other posts.
* One article you may find useful is [[Basic troubleshooting]]
* Also see [[Safe Mode]] & [[Troubleshooting extensions and themes]]
** Note when using safe mode normally do not make changes in the first dialogue Window you see just click on the continue button (Unless you really do want to reset something)
** Also note whilst Safe Mode does disable plugins, it will not always stop all external software interacting with firefox .
A basic principle of troubleshooting is to reduce as many unknown interactions as possible, so in the case of Firefox disabling or removing as many extras as possible.
If you are determined to check what is in the firefox caches then use ''about.cache'' simply type it into the location bar and hit return, it is relatively user friendly and shows masses of info about what is cached, there is also an [https://addons.mozilla.org/en-us/firefox/addon/cacheviewer/ add-on cacheviewer] Even without the add-on you may be able to figure out what the item is, and whether or not it is updating.
I do not even use Vista, but presumably an event log entry may not necessarily relate directly to Firefox use.
''"in the hash map cannot be updated.
Context: Application, SystemIndex Catalog "''
I would hazard a guess that the above message may relate to disk indexing; if so it will possibly have nil impact upon Firefox operation.
I do recall problems being mentioned on this forum about Site Advisor and Firefox, and note some versions are on the [https://www.mozilla.com/en-US/blocklist/ blocklist] for Firefox 4. If you have problems with SiteAdvisor it would be worth ensuring you have the very latest compatible release of Site Advisor. -
How to enable the Exchange 2010 Admin Audit logs in Event Viewer
How to enable the Exchange 2010 Admin Audit(Mailbox Auditing) logs in Event Viewer.
- Sivashankar. Please mark as answer/useful if my contribution is helpfulHi Siva,
We could execute the command below to view Administrator Audit Logging settings:
Get-AdminAuditLogConfig
If it is not enabled, please run the command below:
Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
In addition, here are some references for you to utilize this feature:
Configure Administrator Audit Logging :
http://technet.microsoft.com/en-us/library/dd335109(v=exchg.141).aspx
Search the Administrator Audit Log :
http://technet.microsoft.com/en-us/library/ff459262(v=exchg.141).aspx
Regards,
Rebecca Tu
TechNet Community Support
Maybe you are looking for
-
[SOLVED] upgraded linux 3.15.8-1 to 3.16.1-1 but uname showing 3.15
I am hoping I am just missing something simple with this. After upgrading my laptop today from 3.15 to 3.16 my network adapter and Xorg stopped working. Network adapter is giving me the error: timed out wating for device sys-subsytem-net-devices-ens5
-
Galaxy5 comcast emails and hang ups
cannot view comcast emails. when i tap to read they disappear. contacted comcast, stated to contact verizon. also, when galaxy 5 rings and I choose to hangup rather than answer, it does not hang up.
-
I want to purchase several songs at a time. Is there a shopping cart in iTunes?
I am trying to download several songs from iTunes stores. There seems to be no provision for adding many songs and check out. Every time I click on a song, I am asked a password, then billing information and the card is charged. So, is I wish to down
-
When I try to update my ipod touch from 4.2.1 I get an error 1604 can someone help?
I had previously installed ios5 to see it and then downgraded my ipod back and now I can't upgrade.
-
CS3 - Broken hyperlinks after Package Book For Print
I've posted a similar problem here a few weeks ago, but no answers, so hopefully I can get some help here with a more specific problem description... I have created a an INDB, including several "chapter" INDD files, linked PNG images and hyperlinks t