Event Viewer: Find and Fix Windows Errors

Event Viewer is a built-in Windows tool that logs nearly everything that happens on your PC, from application crashes and driver failures to system shutdowns and security events. When something goes wrong, the logs often contain the exact error code and the component that failed, which turns guesswork into a targeted fix. This guide shows you how to open Event Viewer, find the relevant log for your problem, and read the details so you can resolve the issue or know exactly what to search for.

What You’ll Need

• A Windows PC (Windows 10 or Windows 11)
• Administrator rights (needed to view some security logs and to perform certain fixes)
• The approximate time the problem occurred, if you know it (helps narrow the search)

Step-by-Step

1. Open Event Viewer. Press Windows + R, type eventvwr.msc, and press Enter. Alternatively, search for “Event Viewer” in the Start menu and click the top result.
2. Understand the main layout. The left pane has three main sections: Custom Views, Windows Logs, and Applications and Services Logs. The middle pane shows events in the selected log, and the bottom pane shows details for the selected event.
3. Start with Custom Views. Expand Custom Views and click Administrative Events. This pre-filtered view shows only Errors, Warnings, and Critical events from all logs, which is the fastest way to spot a problem.
4. Identify the time of the problem. Look at the Date and Time column in the middle pane. Find events that occurred right when your issue happened (e.g., a crash at 3:15 PM). Errors are marked with a red circle with an X; warnings are yellow triangles.
5. Click an event to see its details. The General tab gives a plain-language description. The Details tab shows the raw XML, which includes the Event ID and the Source (the program or component that logged it). Write down both.
6. If the problem is a crash, check the Application log. Expand Windows Logs and click Application. Look for events where the Source is the name of the crashing program (e.g., “Application Error” or the app name). These often contain a faulting module name and an exception code.
7. For blue screens or driver issues, check the System log. Expand Windows Logs and click System. Filter for the time of the crash. Look for sources like Kernel-Power (event 41 means unexpected shutdown), BugCheck (blue screen), or Disk (storage errors).
8. Filter a log to reduce noise. Right-click any log (e.g., System) and choose Filter Current Log. Check only Error and Critical, and set a time range in the Logged drop-down (e.g., “Last hour” or “Last 7 days”). Click OK.
9. Search for a specific event ID. If you already know the error code (e.g., 1001, 7000), click Find in the right-hand Actions pane, type the number, and press Enter. It will jump to the next matching event.
10. Save the log for research. Right-click the log name (e.g., System) and choose Save All Events As. Save it as an .evtx file. You can then open this file on another PC or attach it to a forum post for help.
11. Clear a log after a fix. Right-click the log and choose Clear Log. Choose “Clear” to empty it, or “Save and Clear” to keep a copy. This makes future troubleshooting easier because new errors stand out.
12. Use the details to search for a fix. Take the Event ID and Source (e.g., “Event ID 1000, Source: Application Error”) and search the web. Most known issues have a documented fix or a Microsoft support page.

Common Mistakes

• Looking at the wrong log. Application crashes are in the Application log, not System. Driver and hardware issues are in System. If you look in the wrong place, you will miss the error.
• Ignoring the time stamp. Event Viewer logs thousands of events. If you do not focus on the exact time of your problem, you will waste time on unrelated errors.
• Chasing every warning. Many warnings are harmless (e.g., a printer that was off, or a service that retried). Only investigate errors and criticals that correlate with your actual symptom.
• Misreading the event level. A red X is an Error, a yellow triangle is a Warning, and a blue info icon is informational. An error does not always mean the problem is still happening; it may be a one-time glitch.
• Forgetting to check the Details tab. The General tab sometimes says “The description for Event ID X cannot be found.” The Details tab still contains the raw data, including the faulting module and error code.

Tips

• Create a custom view for a specific app. Right-click Custom Views > Create Custom View. Under Event sources, select the program you care about (e.g., “Chrome” or “Windows Update”). This gives you a dedicated log for that app.
• Use the Actions pane. The right-hand pane has “Attach a Task to This Event,” which can trigger a script or notification when a specific error occurs again. Useful for intermittent issues.
• Check the Reliability Monitor instead for crashes. Search for “Reliability Monitor” in the Start menu. It shows a timeline of failures and is often easier to read than raw logs for app crashes and updates.
• Export a log before clearing. Always save a copy before clearing a log. If the fix does not work, you will still have the original evidence.
• Look at the “Source” column first. The source tells you which component logged the event (e.g., “Disk,” “Service Control Manager,” “NVIDIA”). This is often more useful than the description.

Troubleshooting

Event Viewer won’t open. Press Windows + R, type eventvwr.msc and try again. If it still fails, run sfc /scannow in an elevated Command Prompt to repair system files. A corrupted system file is the usual cause.

The log is empty or shows no errors. Make sure you are looking at the right log. If you filtered by time, clear the filter. Also check the Applications and Services Logs section, especially Microsoft > Windows, where many component-specific logs live (e.g., Diagnosis-Performance for slow startup logs).

You see an error but cannot read the description. The message “The description for Event ID X cannot be found” is common when the source is from a third-party app. Use the Details tab and look for <EventData> — it contains the raw values. Search for the Event ID and Source online instead of relying on the description.

Too many events to find the one you need. Use the Filter Current Log option and set a narrow time range (e.g., “Last 5 minutes”). If the problem happened at a specific time, set the From and To dates to a 10-minute window around that time.

Events point to a hardware problem but the device works. A single error may be a one-time glitch. If the same error repeats every few minutes, it is a real problem. Right-click the log and choose Properties; the General tab shows the log size and when it was last written. A growing log with repeated errors confirms an active issue.

Frequently Asked Questions

What is the Event ID and why does it matter?

The Event ID is a unique number that identifies the type of event. It is the single most useful piece of information for searching for a fix. For example, Event ID 41 (Kernel-Power) means the PC shut down unexpectedly. Search for “Event ID 41” and you will find targeted solutions.

What is the difference between an Error and a Warning?

An Error means something failed — a program crashed, a driver failed, or a service stopped. A Warning means something is not ideal but did not fail, such as a disk that is nearly full or a service that recovered after a delay. Warnings can become errors if ignored.

Can I delete or clear the Event Viewer logs?

Yes. Right-click a log and choose Clear Log. This is safe; it does not affect your system. It is a good idea after fixing a problem, so new errors are easy to see. You cannot delete the log file itself while Windows is running.

Why does Event Viewer show errors even when my PC works fine?

Many errors are benign. For example, a service that failed to start once and then retried successfully, or a network device that was unplugged. Only errors that happen repeatedly and correlate with a visible symptom (crash, freeze, slow performance) are worth investigating.

How do I find out which program caused a blue screen?

In the System log, look for a BugCheck event (Event ID 1001) right before the Kernel-Power event. The BugCheck event details (in the Details tab) contain the bugcheck code and often the faulting driver file. Search for that code to find the fix.

Can I use Event Viewer to see why my PC shut down overnight?

Yes. In the System log, look for Kernel-Power Event ID 41 (unexpected shutdown) or Kernel-Power Event ID 107 (system resumed from sleep). Also check for User32 Event ID 1074, which shows a user or app initiated a shutdown, and Kernel-General Event ID 12 for the OS start time.

Related

• Pin a Note to Top of Notes List on iPhone
• Fix msmpeng.exe High CPU Usage: Step-by-Step
• Install and Use Synaptic Package Manager on Linux