5 ms·

Don't get me started on Windows Event Log. Sure it might be better structured than syslog on paper, but it's even more of a mess. Not to mention that it's reall

Don't get me started on Windows Event Log. Sure it might be better structured than syslog on paper, but it's even more of a mess. Not to mention that it's really hundreds of logs that just share a similar format and same UI.

corty 5y ago
And mostly the structure isn't really used at all, it's just plain text for a lot of log messages.
- WorldMaker 5y ago
  Plain text that you cannot even access without a complicated COM control dance in many cases. It's an interesting design for sure. I have seen and hope to never see again worst cases such as the COM control for all of .NET Framework event log messages (everything from .NET system messages to just the mostly plain text storage from applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable.
  - jjkaczor 5y ago
    "...applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable..." Don't even get me started on this... Microsoft is actually bad for this with even their own .NET-based enterprise applications. As well - it also makes gathering logs from production servers, then performing analysis on a different machine difficult, as that machine will likely have none of the dependencies required. Text... text and more text, that is universal.
jandrese 5y ago
I would complain more, except I have never ever gotten a useful bit of information out of the Event Log. Not once. It's so laughably useless I'm surprised anybody even bothers anymore. Microsoft certainly doesn't. When applications on Windows fail they never think to generate an event, not even for something as simple as a "permission denied attempting to open file 'c:\blah'". Instead it's chock full of useless noise from daemons that activate every 2 seconds to poll something and then log that everything is still ok.
- pitay 5y ago
  Not even Microsoft's core windows applications seem to generate a event log when it has a critical error. If you've disabled a service which part of its 'Settings' application uses, or Microsoft Store requires and it has a critical error then you get an general error message (which the error does not tell you that it requires a service running), but nothing in the event logs. So far event logs have been far more useful for things that aren't errors such as login and startup times for Windows.
- tinus_hn 5y ago
  Windows itself can generate logs for that! https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-object-access https://docs.microsoft.com/en-us/windows/security/threat-pro...
floren 5y ago
Huge numbers of EventIDs, and you'll get different EventIDs from different versions of Windows, and there's no database of THESE ARE THE EVENT IDS WINDOWS USES, you just have to google each one individually.

corty 5y ago

And mostly the structure isn't really used at all, it's just plain text for a lot of log messages.

WorldMaker 5y ago
Plain text that you cannot even access without a complicated COM control dance in many cases. It's an interesting design for sure. I have seen and hope to never see again worst cases such as the COM control for all of .NET Framework event log messages (everything from .NET system messages to just the mostly plain text storage from applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable.
- jjkaczor 5y ago
  "...applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable..." Don't even get me started on this... Microsoft is actually bad for this with even their own .NET-based enterprise applications. As well - it also makes gathering logs from production servers, then performing analysis on a different machine difficult, as that machine will likely have none of the dependencies required. Text... text and more text, that is universal.

jandrese 5y ago

I would complain more, except I have never ever gotten a useful bit of information out of the Event Log. Not once. It's so laughably useless I'm surprised anybody even bothers anymore. Microsoft certainly doesn't. When applications on Windows fail they never think to generate an event, not even for something as simple as a "permission denied attempting to open file 'c:\blah'". Instead it's chock full of useless noise from daemons that activate every 2 seconds to poll something and then log that everything is still ok.

pitay 5y ago
Not even Microsoft's core windows applications seem to generate a event log when it has a critical error. If you've disabled a service which part of its 'Settings' application uses, or Microsoft Store requires and it has a critical error then you get an general error message (which the error does not tell you that it requires a service running), but nothing in the event logs. So far event logs have been far more useful for things that aren't errors such as login and startup times for Windows.
tinus_hn 5y ago
Windows itself can generate logs for that! https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-object-access https://docs.microsoft.com/en-us/windows/security/threat-pro...

floren 5y ago

Huge numbers of EventIDs, and you'll get different EventIDs from different versions of Windows, and there's no database of THESE ARE THE EVENT IDS WINDOWS USES, you just have to google each one individually.