A couple of examples of this are a printer driver that fails silently, and you won’t notice until the next time you go to print something, or a networking component fails taking down a Homegroup or Internet Access.  Fortunately Windows does include a handy wizard utility to alert you when something happens silently in the background, and you access it in the Event Viewer.

The first step is to find the original error.  This isn’t actually as difficult as it sounds as events are all clearly labelled with plain English explanations.  The details will include the name of the driver, application or service which has stopped working and it’s normally not too difficult to find what you’re looking for as you can further drill down by the appropriate date and time.  There will never be too many errors and warnings on your system which again makes it easier to find the specific error event you are looking for.

Once you have found the appropriate error, double click to open it and all instances of the error will be shown.  Here is where we we attach a task to this event to let us know when it occurs next.  Why might we want to do this?  It could be that the error is caused by a conflict with another piece of software or hardware, or that some other force external to the failed component is causing the problem.  Attaching a task and alerting the user to the error can help you to diagnose the problem because, especially if it’s happening regularly you ought to be able to see a pattern.

In the right hand panel of the Event Viewer for a specific event you will see the option to Attach [a] Task to This Event and this is what you should click.  There are several things you can do, for instance run a program.  You could have a PowerShell or other script to report on the error.  Windows contains the command line WEVTUTIL which can be used to export the details of events from the Event Viewer as a text file, and you can read more about how you can use this command here.

You can also send an email, but note that this will only work if you have an email client such as Microsoft Outlook installed and configured.  What we want to do though is alert the user with a message.

The wizard really coiuldn’t be simpler and will allow you to set the title and content of a dialog message box.  For instance you might set the title as “Component Failure Alert!” and the message as “Please stop what you’re doing and phone IT, a component has failed and we need to know exactly what was happening and what you were doing on your computer the instant this message appeared.”

In short, attaching tasks to the event viewer can be incredibly useful, especially if you use Command or PowerShell scripts to automatically report on the problem, and the email system to then send the file on to someone.  It a great way for an IT department to be able to detect, diagnose and find a solution to the problem without the end user having to be too involved in the process, and given that tasks can be exported and installed on multiple machines quite simply this is a Windows feature that I’m surprised isn’t used much more often.

The Windows Event Viewer logs many system events automatically. This includes installations, hardware errors and events that are important to diagnose a system. Two of those values that get recorded automatically by default are the boot performance and the shutdown performance of the Windows operating system.

The time recorded here is often more accurate than the time recorded by third party software such as Soluto, BootRacer or Boot Timer.

Event Manager

Launch the Event Manager the following way. Bring up the run box with the hotkey Windows-r, type in eventvwr and hit enter.

The program displays a tree structure in the left sidebar, the contents of the selected folder in the middle and actions on the right. I suggest you click on the hide action button in the toolbar to increase the available room.

Microsoft has changed the Event Viewer significantly for Windows Vista which means that Windows XP users will see a different layout than Vista or Windows 7 users.

The events that we want to analyze are event 100 which logs the boot performance, and event 200 which logs the shutdown performance of the Windows system.

Follow the tree structure to the following folder:

Applications and Services Log > Microsoft > Windows > Diagnostics-Performance > Operational

Windows XP users can sort the system events to find all events with the numbers 100 and 200.

The event listing list the date and time of the event, the event number and the task category. If you click on an event you see detailed information about it in the lower half of the interface. Locate the entry Boot Duration for Boot Performance events, or Shutdown Duration for Shutdown Performance events.

Divide the time by 1000 to get the boot or shutdown time in seconds. The value listed is milliseconds.

Now what can you do with the information? You could analyze boot performance optimizations for instance, or analyze the system’s boot time over time. I personally like to use the information to measure the impact of newly installed software on the system boot time.

What’s the boot duration of your computer?

Why would you want to do this?  You can commonly find that drivers, services or software in Windows can crash without you even being aware of it.  The only time you find out is later on when you want to perform an action such as print a document, attach to a corporate network or run a piece of bespoke software.  These events can very often be triggered by something the user is doing at the time, perhaps running another piece of software or performing a specific action.

This is where attaching an action to an event becomes useful.  In the Event Viewer in Windows you can launch a program, send an email (if the user has a desktop email client installed) or alert the user to the fact that something has occurred.

It’s very easy to do this to.  Once you’re in the Event Viewer (either through the Computer Management console, the Control Panel or by typing Event into the Start Menu search box) keep double clicking on the event type and the error itself until you get to the screen you see here.

In the right hand panel (highlighted) is an option to attach a task to the event.  It’s here that we’ll find all of our options.  This will pop up a window in which we can define the task.  We can specify whether we want to run a program (more on this in a bit), send an email (for which we’ll need email software installed on the PC) or display a pop-up alert.

When you’re finished you will see an option to display further properties for this task.  You can tick this box for even more control and options.

It’s here that we can specify additional tasks to run and in what order we want things to happen.

I talked a little while ago about running a program.  There are a couple of very useful Command Line and PowerShell utilities that can come in very handy here.  I won’t go into detail on them in this article but they are both well documented on the Microsoft website.

You can run the program CMD.EXE with either the /c switch to carry out a command string and then stop, or the /k switch to continue afterwards (see here for more details on command line switches).  It’s here you can use the WEVTUTIL command to automatically poll the event viewer for data and perform an action such as saving it to the user’s desktop.  This can then immediately be sent to a support person for review.  You can get full information on WEVTUTIL here.

You can also run POWERSHELL.EXE or involve the PowerShell command from the Command Line to automatically generate a System Health Report.  The command you would use here is Get-RmsSystemHealthReport -Path <drive>:\Report [-StartTime <start_time>] [-EndTime <end_time>] -ReportType <report_type>.  Full details of this command can be found here.

Any tasks you add can be viewed and edited in the Windows Task Scheduler and all in all, being able to add actions to events can be a real time-saver when it comes to diagnosing problems in Windows… especially those annoying intermittent ones.

Windows Event Viewer Plus was recently released for a faster way of using the Event log in the Windows operating system. The portable software can be used to view event logs from local computer systems as well as remote PCs.

All available event logs are displayed in a sidebar on start, and the main pane will be filled with recent entries after a selection has been made.

A double-click on an event log entry opens a small window with detailed information about that specific event.

These information can be exported to the local computer system. Windows Event Viewer Plus provides access to four web search modules that can be used to search Bing Search, Google Search, Yahoo Search or the Microsoft Support site for that error.

That’s comfortable as it gets rid of the copy and paste when working with the standard Windows Event Viewer and researching events on the Internet. The portable program links to several Tools in the menubar including memory diagnostics, check disk and the system file checker.

Windows Event Viewer Plus is responsive and faster to navigate than the built-in Windows Event Viewer. It does however lack a lot of features that the Event Viewer offers like the ability to search in the event log, sort it by one of the parameters (e.g. time) or to attach tasks to events.

Windows Event Viewer Plus is available for download at the Windows Club website. The program ran fine on a 64-bit Windows 7 Professional system. It should run fine on most Windows systems as well.

Acronis Drive Monitor is a free hard disk monitoring software that uses SMART information and the Windows event log to display important events to the system user. The program is pretty basic, which is surprising considering its size of nearly 18 Megabytes.

On startup a summary is displayed, which displays disk problems, backup information and critical events. Disk problems are directly linked to SMART parameters, and the program will either report that all disks are working normally, or that problems have been encountered.

acronis drive monitor

Critical events taps right into the Windows event log and displays high risk events of the system’s storage devices. Backup finally has probably been added to distribute or sell Acronis products as it proposes to download Acronis backup software if no backup software is detected on the system.

Links lead to detailed information about each of the information provided by the software. Probably the most interesting feature of the program is the critical events listing which makes use of the Windows Event log. Not many hard drive monitoring applications offer this feature.

Then again, it is possible to create those custom alerts quite easily without third party software.

The page displays all critical events, sorted by date. Included in the listing is the risk evaluation rating, severity, source and event id. A double-click on an event displays detailed information about that specific event, with a link to the Acronis Knowledge Base website for additional information.

critical events

The Disks page lists the usual information about the primary partition of the computer. We did not find an option to make the drive monitor display those information for other connected drives.

Finally, the program can create four types of alerts that are send to an email address that needs to be configured in the program’s options. Alerts can be configured for temperature levels, critical events, disks monitoring errors and backup monitoring errors.

Acronis Drive Monitor does not offer anything that other tools or even Windows first party tools do not offer. Some users may still be inclined to give the program a try, it is free after all. The program supports both 32-bit and 64-bit editions of the Windows operating system. Downloads are provided at the Acronis website after registration.

You can start the Event Viewer in Windows using the keyboard shortcut [Windows R], typing [eventvwr.msc] and hitting [enter]. Navigate in the Event Manager using the menu on the left side using the following path: Applications and Services Logs => Microsoft => Windows => Diagnostics-Performance => Operational. This will lead directly to the location that contains performance diagnostics not only for the Windows shutdown but also for standby and boot performance issues.

A good way to start is to sort the columns by Task Category. Click on the Task Category title and look for Shutdown Performance Monitoring entries. Each entry will contain information about the application or process that was causing problems during shutdown including the time it took to shutdown that process. A process that takes very long to shutdown is usually the problem for the shutdown problems.

Once the process or application has been identified it is a matter of finding out why it is causing the delay. It could be outdated or incompatible with that version of Windows and to a lesser extent a faulty version or driver. A good way to start is to look for updates for that software and install those if they are available. It might be easier on the other hand to simply deactivate or uninstall the software if that is possible.

A good way to start would be to look up the Event Id in a database that contains a list of them. This has to be done manually if you use the default Event Viewer.

The software Event Log Explorer is a free for personal use software that adds more comfort and functions to working with the Event Log in Windows. It basically displays the same amount of information but offers ways to quickly lookup Event Ids on the Internet. A right-click on an Event Id will provide the user with the option to look it up in the Event Id database or Microsoft Knowledge Base.

That’s actually only one of the new functions that make the product a great replacement. The quick filtering function is another one. Whenever you right-click on a column you can quickly filter for that value, right-clicking on a date for example gives the option to filter events of that date.

Another interesting addition is that the description of the event is available in a third pane that has been added. If you use the default Event Viewer you have to right-click the event and select Properties to get the description which gives more details about the event.

The only limitation of the free version is that it does not allow you to connect to more than three computers.