How to Use Event Viewer in Windows 10

Event Viewer is Windows 10’s built-in logbook that records system, security, and application events—errors, warnings, and informational messages. This guide shows you how to open it, navigate the logs, filter for specific events, and use the data to diagnose common problems. No prior experience is needed, just a Windows 10 PC with administrative access for some actions.

What You’ll Need

• A Windows 10 PC (any edition)
• Administrator account (required to view security logs and some system logs)
• Basic understanding of what you’re troubleshooting (e.g., a recent crash, a failing driver)

Step-by-Step

1. Open Event Viewer. Press Win + R to open the Run dialog, type eventvwr.msc, and press Enter. Alternatively, click Start, type “Event Viewer,” and select the app from the results.
2. Understand the main window. The left pane lists log categories. The middle pane shows events for the selected log. The right pane has actions like “Filter Current Log” and “Create Custom View.”
3. Navigate to Windows Logs. Expand “Windows Logs” in the left pane. You’ll see:
• Application – events from programs (e.g., Office, games).
• Security – logon attempts, audit failures (requires admin).
• Setup – installation and update events.
• System – Windows components, drivers, and hardware issues.
• Forwarded Events – logs from other computers (if configured).
4. Select a log to view. Click “System” to see system-level errors. The middle pane will populate with events, newest first.
5. Read an event. Click any event. The bottom pane shows a “General” tab with the event description and a “Details” tab with XML data. Pay attention to:
• Level – Error, Warning, Information, or Audit Failure.
• Date and Time – when it happened.
• Source – which component or program logged it.
• Event ID – a unique number you can search for online.
6. Filter the log. In the right pane, click “Filter Current Log.” Check only “Error” and “Warning,” set a time range (e.g., last 24 hours), and click OK. This hides informational noise.
7. Create a custom view. For recurring troubleshooting, click “Create Custom View” in the right pane. Set your filters and name it (e.g., “System Errors – Last 7 Days”). It will appear under “Custom Views” in the left pane for quick access.
8. Search for a specific Event ID. Use the “Find” action (in the right pane) or press Ctrl + F while a log is selected. Type the Event ID (e.g., 41 for unexpected shutdowns) and it will jump to the first match.
9. Save a log for later. Right-click a log name (e.g., System) and choose “Save All Events As…” to export an .evtx file. You can open this on another PC or attach it to a forum post.
10. Clear a log. Right-click a log and choose “Clear Log…” to start fresh. This helps isolate future issues. (You’ll need admin rights.)

Common Mistakes

• Reading only the top-level error. Often the root cause is an earlier event. Sort by time and look for the first error in a chain.
• Ignoring the Source and Event ID. The description alone can be vague. The Source and Event ID are what you search for online.
• Clearing logs before diagnosing. You might lose the very event you need. Always save a copy first.
• Assuming every error is critical. Many errors are benign (e.g., a service that stops and restarts). Focus on repeated errors or those matching your symptom.
• Not using filters. Scrolling through thousands of events is inefficient. Use the filter to narrow by level and time.

Tips

• Search the Event ID online. Microsoft’s official documentation and tech forums often explain exactly what a given Event ID means and how to fix it.
• Use the “Details” tab. The XML view sometimes contains more specific info, like file paths or error codes.
• Create a custom view for common checks. For example, “System Errors – Last 24 Hours” saves you from setting filters every time.
• Check the time correlation. If your PC crashed at 3:00 PM, look for events just before that time—not after.
• Export logs before contacting support. Having a .evtx file ready speeds up remote help.
• Use the “Attach Task to This Event” action. You can set a task to run (like send an email or start a program) when a specific event occurs, which is handy for monitoring.

Troubleshooting

• Event Viewer won’t open. Run sfc /scannow in an elevated Command Prompt to repair system files. If that fails, try DISM /Online /Cleanup-Image /RestoreHealth.
• Security log is empty or inaccessible. You must be an administrator. If you are, check that auditing is enabled: Go to Security Settings > Local Policies > Audit Policy and enable the relevant policies.
• Logs are filled with irrelevant events. Use the filter to hide Information and Verbose levels. You can also set the maximum log size (right-click log > Properties) to prevent it from growing too large.
• Events are not being recorded. Check that the Windows Event Log service is running: Press Win + R, type services.msc, find “Windows Event Log,” and ensure it’s set to Automatic and started.
• You see an error but don’t know what caused it. Look for the event immediately before it, especially with the same Source or from the Kernel-Power source (Event ID 41 indicates an unexpected shutdown).
• Custom view disappears after a reboot. Custom views are stored in the registry. If they vanish, you may have a corrupted profile. Try creating a new one and see if it persists.

Frequently Asked Questions

How do I find out why my PC crashed using Event Viewer?

Look in the System log for Event ID 41 (Kernel-Power) which indicates an unexpected shutdown. Then scroll back to see the last events before that—often a driver error or hardware failure.

What is the difference between Application and System logs?

Application logs record events from software you install (like Word or Chrome). System logs record events from Windows itself, including drivers and hardware.

Can I delete events from Event Viewer?

Yes, right-click a log and choose “Clear Log…” to remove all events. You can also set a maximum size and choose to overwrite old events automatically.

Why do I see many “Information” events—are they important?

Most are routine (e.g., a service started successfully). They become useful when troubleshooting a sequence, but you can filter them out for daily use.

How do I export Event Viewer logs?

Right-click the log name (e.g., System) and select “Save All Events As…” Choose a location and format (.evtx is best). You can then open it on another PC.

Can Event Viewer help with slow performance?

Yes, look for repeated warnings or errors in the System log, especially from sources like Disk, Processor, or Network. These can indicate hardware bottlenecks.

Related

• How to Overclock Your Android Device
• Laptop Speakers Crackling: Causes & Fixes
• Passkeys Google Account: Step-by-Step Setup