How to find the source of a cryptic event viewer log
- by mlsteeves
I'm looking at the eventviewer logs, and I see a bunch Error entries in the Application log. (Windows Server 2008 R1). There is an error written to the logs about every 4 seconds.
I need to find out which application is causing these events, is there anyway to find this out?
Here is what each look like:
Error 12/2/2010 12:00:09 PM Application 0 None
The details for each error:
Log Name: Application
Source: Application
Date: 12/2/2010 12:00:09 PM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computer.domain
Description:
The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
the message resource is present but the message is not found in the string/message table
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-02T20:00:09.000Z" />
<EventRecordID>237167</EventRecordID>
<Channel>Application</Channel>
<Computer>computer.domain</Computer>
<Security />
</System>
<EventData>
<Binary>534F434B...</Binary>
</EventData>
</Event>
