IN THE LEFT PANE, CLICK THE LOG YOU WANT TO VIEW.WINDOWS DISPLAYS T...

5. In the left pane, click the log you want to view.Windows displays the events in the log file in the right window, as shown in Fig-ure 18-7.

F18us07

Figure 18-7 Use Event Viewer to view information contained in Windows XP Professional logs.You will encounter five types of events in the logs you view in Event Viewer. A uniqueicon identifies each event type so that you can easily distinguish between entries. Thefive types of events you will encounter are as follows:Error This type of entry, indicated by an icon with a red X, means that a significantproblem has occurred, such as a service that might not have started properly.Warning This type of entry, indicated by an icon with a yellow exclamation point,means that an event has occurred that is not currently detrimental to the systembut might indicate a possible future problem.Information This type of entry, indicated by an icon with a blue “i,” means that asuccessful operation has occurred. For example, a service starting successfullymight trigger this type of event.Audit Success This type of entry, indicated by a key icon, means that an auditedsecurity access attempt—for example, a successful logon to the system—was suc-cessful.Audit Failure This type of entry, indicated by a lock icon, means that an auditedsecurity access attempt—for example, a failed attempt to open an audited file ordirectory—was not successful.

How to View an Event

Double-click any event in the right pane of Event Viewer to open the Event Propertiesdialog box (see Figure 18-8), which shows a description of the event. The up anddown arrow buttons let you move through the events in the log without having toclose the Event Properties dialog box and then reopen it for each event you want toview. The Copy button (showing the Copy icon) copies the information about theevent to the Windows Clipboard.

F18us08

Figure 18-8 Open an event’s Properties dialog box to see a description of the event.The Event Properties dialog box contains the following information to help you iden-tify an event:Date and Time The date and time that the event occurred.Type The type of event (Information, Warning, and so on).User The user with which the event is associated. Many events do not have an asso-ciated user.Computer The computer on which the event occurred.Source The service that experienced the event.Category The category associated with the event. Most events, particularly in theSystem log, do not have categories. Some application developers specify a cate-gory for events that concern the application, so you will see some events in theApplication log that have an associated category. In the Security log, the categoryindicates the type of event that was audited.