Tutorials · Windows Event Logs

How to query Windows Event Logs

Reduce a noisy event log to the providers, event IDs, levels and time windows that matter.

Start with errors and warnings

SELECT TOP 200
  TimeGenerated, EventID,
  EventTypeName, SourceName, Message
FROM System
WHERE EventTypeName IN ('Error event','Warning event')
ORDER BY TimeGenerated DESC;

Find recurring event IDs

SELECT SourceName, EventID, COUNT(*) AS total
FROM System
GROUP BY SourceName, EventID
ORDER BY total DESC;

Narrow the time window

Add a timestamp filter around the incident. A small window makes correlations with deployments and restarts easier to see.