Page 3 of 4 FirstFirst 1234 LastLast
  1.    09 Apr 2016 #20
    Join Date : Jul 2015
    Posts : 251
    windows 10 pro 64

    Quote Originally Posted by Brink View Post
    Hello drugo,

    The event logs are stored in the folder below.

    %SystemRoot%\System32\Winevt\Logs
    Hi Brink
    thanks a lot

    is there an utility to open these logs taken for example from an image?
    i mean i would like to mount an image made some days ago , save this folder from the image to H:\event
    is there a program that can open them ?
    my event viewer can't do it , there is no any load features
    just to track when the error did appear

    thanks again Brink , always the number 1


    ps i tried to post a link , but i guess it's against the rules ,isn't it?
      My ComputerSystem Spec
  2.    09 Apr 2016 #21
    Join Date : Oct 2013
    Posts : 24,410
    64-bit Windows 10 Pro build 17017
    Thread Starter

    Sure you, could mount the image file, then be able to access and open them as usual.
      My ComputersSystem Spec
  3.    10 Apr 2016 #22
    Join Date : Jul 2015
    Posts : 251
    windows 10 pro 64

    Quote Originally Posted by Brink View Post
    open them as usual.
    Hi
    but if i open myeventview it points to the%SystemRoot%\System32\Winevt\Logs , and not to my image
    need a program to open them
      My ComputerSystem Spec
  4.    10 Apr 2016 #23
    Join Date : Feb 2015
    Bamberg Germany
    Posts : 17,007
    Win10 Pro, Win10 Pro N, Win10 Home, Win10 Pro Insider Fast Ring, Windows 8.1 Pro, Ubuntu

    Quote Originally Posted by drugo View Post
    Hi
    but if i open myeventview it points to the%SystemRoot%\System32\Winevt\Logs , and not to my image
    need a program to open them
    @drugo I think he means on the mounted image,
    find C:\WINDOWS\System32\Winevt\Logs,
    then you just double click the the log you want to view and Event Viewer should open up so you can read it.

    When you mount it, make sure you give access to restricted folders, and make it writable(the writable only happens in memory and doesn't make any permanent changes).
    ***Note: Some logs are just plain empty.***

    Here is a quick screen capture I just made to show you. It's not meant to be a video tutorial, but should give you an idea of how to do it, I hope it get's you further

    ***I just fixed the video a bit, and added a small explanation of what to do.***

    Last edited by Cliff S; 10 Apr 2016 at 06:17. Reason: Changed video address to updated version
      My ComputersSystem Spec
  5.    10 Apr 2016 #24
    Join Date : Jul 2015
    Posts : 251
    windows 10 pro 64

    Quote Originally Posted by Cliff S View Post
    @drugo I think he means on the mounted image,
    find C:\WINDOWS\System32\Winevt\Logs,
    then you just double click the the log you want to view and Event Viewer should open up so you can read it.

    When you mount it, make sure you give access to restricted folders, and make it writable(the writable only happens in memory and doesn't make any permanent changes).
    ***Note: Some logs are just plain empty.***

    Here is a quick screen capture I just made to show you. It's not meant to be a video tutorial, but should give you an idea of how to do it, I hope it get's you further
    Hi Cliff
    Amazing!!!!!
    thanks a lot!
    can i download the youtube video ?
      My ComputerSystem Spec
  6.    10 Apr 2016 #25
    Join Date : Feb 2015
    Bamberg Germany
    Posts : 17,007
    Win10 Pro, Win10 Pro N, Win10 Home, Win10 Pro Insider Fast Ring, Windows 8.1 Pro, Ubuntu

    You're welcome drugo!
    I'm glad it helped.
    You should be able to. I'm new at posting on YouTube, so if you can't, let me know what I need to set, so it can be.
      My ComputersSystem Spec
  7.    15 Apr 2016 #26
    Join Date : Feb 2015
    Bamberg Germany
    Posts : 17,007
    Win10 Pro, Win10 Pro N, Win10 Home, Win10 Pro Insider Fast Ring, Windows 8.1 Pro, Ubuntu

    @Brink,
    Hey Shawn, I've been messing around now with the mounted Macrium image option for a bit.
    Even though it say "Make writable Note: Changes are temporary and will be discarded", I have found out, you can copy from the mounted image, and paste into the "host".

    This might come in useful to repair something, or get an installer(like maybe a driver or 3rd party program, you need to repair or reinstall without have to reimage and loose current updates and changes. I have successfully copy & pasted .dlls and other system files.

    It might be worth a tutorial, for non invasive repairs. Or, would this be more of something, for the video geeks?
      My ComputersSystem Spec
  8.    15 Apr 2016 #27
    Join Date : Oct 2013
    Posts : 24,410
    64-bit Windows 10 Pro build 17017
    Thread Starter

      My ComputersSystem Spec
  9.    21 Apr 2016 #28
    Join Date : Oct 2014
    Arnold, MD
    Posts : 27,971
    Triple boot - Win 10 Pro, Win 10 Pro Insider (2) - (and a sprinkling of VMs)

    Quote Originally Posted by Cliff S View Post
    @Brink,
    Hey Shawn, I've been messing around now with the mounted Macrium image option for a bit.
    Even though it say "Make writable Note: Changes are temporary and will be discarded", I have found out, you can copy from the mounted image, and paste into the "host".

    This might come in useful to repair something, or get an installer(like maybe a driver or 3rd party program, you need to repair or reinstall without have to reimage and loose current updates and changes. I have successfully copy & pasted .dlls and other system files.

    It might be worth a tutorial, for non invasive repairs. Or, would this be more of something, for the video geeks?
    Quote Originally Posted by Brink View Post
    @Cliff S, @Brink - Just an add-on... Same procedure can be used on a Restore Point. A small utility System Restore Explorer | Nics Blog can be used to mount a Restore Point. Copy/paste to host any file in the restore point, user data, system data, etc. Delete the Restore Point if desired. Just thought I'd pass it on. TC
    Last edited by f14tomcat; 21 Apr 2016 at 09:11.
      My ComputersSystem Spec
  10.    21 Apr 2016 #29
    Join Date : Oct 2013
    Posts : 24,410
    64-bit Windows 10 Pro build 17017
    Thread Starter

    Thank you.
      My ComputersSystem Spec

 
Page 3 of 4 FirstFirst 1234 LastLast


Similar Threads
Tutorial Category
Event Viewer -- Audit Failure 5061
I continue to get this event in the Event Log under Audit Failure. I never had in Windows 8.1 and it started after upgrading to 10. Does anyone have a clue about it? Cryptographic operation. Subject: Security ID: SYSTEM Account...
Performance & Maintenance
Worried about event viewer errors
hi guys managed to install windows 10 and everything seems to be working great. I looked in event viewer and I'm getting loads of errors, the same over and over. one is that keeps coming up is kernel-power event id 137 The system...
Performance & Maintenance
Clearing event viewer entries
How can I construct a .bat file to clear entries in the event viewer. Thanks
General Support
TONS of errors in event viewer
I just clean installed my windows, and have not made any changes as to what would cause these errors.... but in event viewer, since install on the 29th, i have 800 errors and warnings. ive noticed on my other PC that i just installed 10 on...
Performance & Maintenance
Repeating errors in Event Viewer on reboot - Win 10 Pro 64-bit
I'm getting certain repeating errors in Event Viewer when I reboot my new Win Pro 64-bit (after yesterday's upgrade from Win 8.1 Pro 64-bit). Please see the details and post your thoughts here: ...
BSOD Crashes and Debugging
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 07:02.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums