Windows Event Viewer Event ID's

[misscrf]

Why is it so hard to find an index of the event ID's listed in the application and system event viewers for Windows 2003 server? Grr.
Does anyone know where I can get these? I would be most appreciative!

(It's my birthday!)

misscrf

It is never too late to become what you could have been ~ George Eliot

 

[itsp1965]

Your best bet is to go

http://www.eventid.net

which covers most of the EventIDs encounetered by sysadmins and possible solutions. Hope this helps.

 

[misscrf]

but you havve to pay for that. Are you saying that the only way to get the event codes is to pay for them?

misscrf

It is never too late to become what you could have been ~ George Eliot

 

[itsp1965]

This is not entirely true, you can use Eventid.net for general lookups. A paid subscription though will allow you to access the links listed at the bottom of the comments, but otherwise you should be able to use it.

 

[misscrf]

Thank you. My problem is that I need to find when msxml 4 sp2 was last installed on a server. I don't know, though, what ID that would be, so that I can sort by ID's. Any ideas?

Thanks!

misscrf

It is never too late to become what you could have been ~ George Eliot

 

[kmcferrin]

You can sort by source, and it would be Windows Installer. Unless you used Windows Update, in which case it would probably be Windows Update Agent. An event ID of 19 means installation was successful. You could also sort by Category (which would be installation).

Or you could just open Event Viewer, go to the View menu, and select Find. Then on the description line put XML. If that term is in the description (which it should be) then it will find it for you.

 

[misscrf]

Thank you. I searched the application and system viewers for xml in the description. I cannot seem to find how this keeps getting installed on this server. I need to keep it off. I have automatic updates turned off. Any thoughts? Are there any other logs or locations to find installs that are happening on a server, when and how?

Thank you,

misscrf

It is never too late to become what you could have been ~ George Eliot

 

[kmcferrin]

Automatic updates, WSUS/SUS, or any patch management system would be likely culprits. Applications that might require that SP level might come with that as part of the installation package. On top of that, the MSI could be pushed out by GPO or even manually installed by someone who thinks it is necessary. Even manually going to Windows update you could get it.