In today’s topic, we’re going to talk about the importance of logs and what they’re used for. Logs are important when we need to perform a search to identify the cause of problems or changes in an operating system. Using the log, we can visualize errors in the system, audit it, find out about events performed by applications or even the actions of a user. We use the term troubleshooting when we’re looking for the cause of a problem, troubleshooting is the process of identifying and correcting problems, and system logs can tell us where to check.
To view the logs in Windows Server it’s very simple, go to Server Manager, which usually opens automatically when you log in to Windows. If it’s not open, click on the start menu > Server Manager > Tools > Event Viewer. As shown in the image below.
The screen that will open is the log viewer screen. The Windows Server log viewer is very broad and has a lot to explore. It’s not possible to explore the entire event viewer in a single post, but we’ll highlight the main points.
The logs in Windows are divided into categories for better organization, in the image below for example, the Windows logs category is highlighted, where we have the Application, Security, Installation, System and Forwarded Events sessions, this is where we can find the logs related to each type of event, the Applications and services category, is a category for the logs of Windows Server functions and resources.
Log messages are also classified according to their criticality, they can be classified as information, warning, error, critical level or detailed mode, below is a query of a log in which I intentionally provoked so that we can visualize and understand how a log message is presented.
I accessed the Windows logs category and the system session to analyze a log, I caused an abrupt system shutdown to simulate the server shutting down as if the power was off or the server was turned off by the power button, in other words, we didn’t shut down the server in a friendly way using the start menu and the shutdown option, this type of shutdown can cause damage to the operating system or even the disks, Windows considers this event to be critical.
By clicking on the log we can see the message that tells us that the system was restarted without a correct shutdown, then the message tells us in which situations this error is generated, we can also see that each log has the date and time of the event, so we know exactly when it occurred, this is a simple example to familiarize us with the log messages and how they are displayed.
You will have to explore the event viewer to understand more about it, because as I said before, it is full of options, you will have to understand in which category and session you should look when a problem occurs, because different problems and events are located in different categories and sessions, the log is very useful to understand in a very broad way what is happening on the server, it helps to correct problems, it helps to identify when exactly an event occurred, it is useful to help with security and also to correct configurations of functions and resources that are presenting problems in their operation.
I hope this post helps you better understand the importance of logs.
