Event Viewer is the first place to look when something goes wrong on Windows — and one of the most underused tools in the box. Most people open it, feel overwhelmed by the noise, and close it again. With a little structure it becomes a precise diagnostic instrument.<\/p>\n
Every event carries a level: Information<\/strong>, Warning<\/strong>, Error<\/strong> or Critical<\/strong> (plus Audit Success<\/em>\/Audit Failure<\/em> in the Security log). When triaging, filter to Error and Critical first — that removes most of the noise instantly.<\/p>\n Each entry tells you the Source<\/strong> (which component logged it), the Event ID<\/strong> (a number identifying the specific event type), the Level<\/strong>, the user<\/strong> and timestamp<\/strong>, and a details pane (readable on the General tab, or as raw XML on the Details tab). The Event ID is the key you will search the web and your own notes for.<\/p>\n Right-click a log and choose Filter Current Log<\/em> to narrow by level, Event ID, time range or source. When you find a filter you use often, save it as a Custom View<\/em> so it is one click away next time — for example, “all Errors and Criticals in the last 24 hours across System and Application.”<\/p>\nAnatomy of an event<\/h2>\n
Cut through the noise with filters and custom views<\/h2>\n
Useful Event IDs to recognise<\/h2>\n