Event Logging Overview

Applies To: Windows Server 2003, Windows Server 2003 with SP1

By default, a computer running the Microsoft® Windows® Server 2003, Standard Edition; Windows® Server 2003, Enterprise Edition; Windows® Server 2003, Web Edition; or Windows® Server 2003, Datacenter Edition operating system records events in three kinds of logs:

• Application. Contains events logged by applications or programs.

• Security. Records events such as valid and invalid logon attempts, as well as events related to resource use.

• System. Contains events logged by Windows system components.

Logging begins automatically when Windows is started. For each type of log, you can filter the events to be viewed, designate the number of entries to view, specify how long to save entries, and specify whether to automatically overwrite existing events when the log becomes full.

You view Windows event logs through Event Viewer. You can open Event Viewer by using any one of the following methods:

• From the Start menu, click Run. In the Open box, type eventvwr, and then click OK.

• At the command prompt, type start eventvwr, and then press ENTER.

• From the Start menu, point to Administrative Tools, and then click Event Viewer.

• From the Start menu, point to Administrative Tools, and then click Computer Management. Event Viewer is listed under the System Tools node. The benefit of this display is that IIS Manager is in the same window under the Services and Applications node.

For more information about event logs and Event Viewer, see "Event Log Overview" in Help and Support Center for Windows Server 2003.

Operating system events related to IIS are logged in the event logs. These logs are not the same as the IIS logs that record specific information about Web site usage and activity. For more information about IIS logs, see Analyzing Log Files in this reference.