How To Solve Any Windows Problem with Event ID

Saikat Basu 26-07-2009

To paraphrase from the ditty “Don’t Quit” – When things go wrong as they sometimes will; don’t quit. Because for every Windows crash there’s a way to lick the problem without dialling assistance.


Windows glitches, errors and crashes are a pain in the rear. More often a reboot (or a smack on the sides) is a quick fix. It gets the work done but it still leaves the puzzler out there – why did the system crash in the first place?

To remove the vulnerability (we know that Window’s has tons of them!) and troubleshoot errors, it’s necessary to diagnose and cure. This is where the Event Viewer makes a worthy entrance.

An event, as described by Microsoft, is any significant happening in a system or in a program that should be brought to a user’s attention. It can be a system crash, an application freeze or the ominous ‘Blue Screen of Death How To Analyze A Windows Blue Screen Of Death With WhoCrashed Read More ‘. The notification is duly logged by the system in a log (the event logs) which we can see using the Event Viewer. The Event Log Service registers application, security, and system related events in Event Viewer. Thus we can pinpoint the exact source of a problem and diagnose to prevent future errors.

The Event Viewer has been a part of the Windows OS since the early days of Windows NT. In Windows Vista, it has been modernized to Windows Event Log. In Windows XP, the Event Viewer can be found under Control Panel – Administrative Tools – Event Viewer. That’s where we are now headed for some familiarization.

The Three Logs



Windows XP logs events basically in three logs – Application Log, Security Log and System Log. Additional logs may be created by other applications like anti-virus and Internet Explorer.

  • In Application Log events are posted by programs. For instance, a program hang is reported here. The reporting though depends on the program; if it has been coded to report events.
  • In Security Log security violation related events like valid and invalid logons are posted. It also records things like clock adjustments and file sharing permissions. This log is disabled by default and only a user with administer privileges can view this log.
  • In System Log, events related to system failures like startup errors (for instance a failed driver), hardware crashes (a webcam froze) et al find a mention.

How to Read the Event Viewer


  • The Event Viewer is structured around easy to understand information like – the Date and Time of each event are given with the Source of each problem. The source can be a program, a single file of a program or a system file. The View menu has a Filter which lets you sort the log information in a few ways.
  • Most of the logs are of the Type “˜Information’. But some types like ‘Errors‘ and ‘Warning’ are worth looking into. (The Security Log also has the Success Audit or Failure Audit types.)
  • The Error Properties box comes up with a double click.  The box provides a slightly elaborate description about the specific error. There is a link provided which links to Microsoft Support. The details of the error can be sent but more often than not it fails to provide a solution.


  • Event ID is the column which gives us a number to work with. Using this number, we can track the error type and learn about it in more detail. This is the same number which is used by the support guys for troubleshooting. Note: Event IDs may change over time with installation of service packs and patches.

Using the Event ID to Target and Solve

The Event ID numeric value is a key identifier for the problem. The web is a good place to do some DIY troubleshooting.


EventID is a rich database of logged events. The site has a repository of 10,496 event IDs and 497 event sources with a lot more info provided by contributors. Enter the Event ID number and the Source and the site’s search engine filters out the possible resolutions for the particular event. Most of the solutions are contributed by users from their experience. Non members can search using basic search. Paid subscribers get better features like an advanced search and searching for event IDs from a specific source.

Some other search features available for all users are:

  • Copy paste the log entry for search
  • Lookup error codes other than Windows event IDs
  • Redirect Microsoft’s error lookup link to with a registry fix.

Getting all your answers through the website or with a general web search might not ultimately solve the problem. But it will give you a better grasp of things before you call in the boffins.

Using Event ID is just one way. Previously we looked at a few other diagnostic ways to vault over ‘run of the mill stuff’ like stalled Windows. Here’s a small troubleshooter’s list:


Related topics: Computer Maintenance, System Monitor.

Affiliate Disclosure: By buying the products we recommend, you help keep the site alive. Read more.

Whatsapp Pinterest

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. mike
    November 20, 2017 at 6:53 pm

    I have an issue I am trying to track down:

    failure to connect to a windows service system event notification server.

    Can't remember doing anything out of the ordinary, it's Win 7 system and so far rummaging around on the net hasn't yielded any clues or fixes.

  2. Marion S
    July 28, 2009 at 5:38 pm has helped me out tremendously at work. We have 450 users and 106 servers. I am the only admin in the company and I'm expected to know everything ther is about these servers. I got a paid subscription and it was well worth it! I would recommend this to any admin.

    • Saikat
      July 28, 2009 at 10:01 pm

      I too discovered the website quite late. Do you know of any other website which has such a database of IDs?