Page 3 of 4 FirstFirst 1234 LastLast

  1. Joined : Jul 2015
    Posts : 244
    windows 10 pro 64
       2016-04-09 #20

    Brink said: View Post
    Hello drugo,

    The event logs are stored in the folder below.

    %SystemRoot%\System32\Winevt\Logs
    Hi Brink
    thanks a lot

    is there an utility to open these logs taken for example from an image?
    i mean i would like to mount an image made some days ago , save this folder from the image to H:\event
    is there a program that can open them ?
    my event viewer can't do it , there is no any load features
    just to track when the error did appear

    thanks again Brink , always the number 1


    ps i tried to post a link , but i guess it's against the rules ,isn't it?
      My System SpecsSystem Spec


  2. Joined : Oct 2013
    Posts : 17,447
    64-bit Windows 10 Pro build 15014
       2016-04-09 #21

    Sure you, could mount the image file, then be able to access and open them as usual.
      My System SpecsSystem Spec


  3. Joined : Jul 2015
    Posts : 244
    windows 10 pro 64
       2016-04-10 #22

    Brink said: View Post
    open them as usual.
    Hi
    but if i open myeventview it points to the%SystemRoot%\System32\Winevt\Logs , and not to my image
    need a program to open them
      My System SpecsSystem Spec


  4. Joined : Feb 2015
    Bamberg Germany
    Posts : 12,923
    Microsoft Windows 10 Pro 64-bit 14393 Multiprocessor Free
       2016-04-10 #23

    drugo said: View Post
    Hi
    but if i open myeventview it points to the%SystemRoot%\System32\Winevt\Logs , and not to my image
    need a program to open them
    @drugo I think he means on the mounted image,
    find C:\WINDOWS\System32\Winevt\Logs,
    then you just double click the the log you want to view and Event Viewer should open up so you can read it.

    When you mount it, make sure you give access to restricted folders, and make it writable(the writable only happens in memory and doesn't make any permanent changes).
    ***Note: Some logs are just plain empty.***

    Here is a quick screen capture I just made to show you. It's not meant to be a video tutorial, but should give you an idea of how to do it, I hope it get's you further

    ***I just fixed the video a bit, and added a small explanation of what to do.***

    Last edited by Cliff S; 2016-04-10 at 06:17. Reason: Changed video address to updated version
      My System SpecsSystem Spec


  5. Joined : Jul 2015
    Posts : 244
    windows 10 pro 64
       2016-04-10 #24

    Cliff S said: View Post
    @drugo I think he means on the mounted image,
    find C:\WINDOWS\System32\Winevt\Logs,
    then you just double click the the log you want to view and Event Viewer should open up so you can read it.

    When you mount it, make sure you give access to restricted folders, and make it writable(the writable only happens in memory and doesn't make any permanent changes).
    ***Note: Some logs are just plain empty.***

    Here is a quick screen capture I just made to show you. It's not meant to be a video tutorial, but should give you an idea of how to do it, I hope it get's you further
    Hi Cliff
    Amazing!!!!!
    thanks a lot!
    can i download the youtube video ?
      My System SpecsSystem Spec


  6. Joined : Feb 2015
    Bamberg Germany
    Posts : 12,923
    Microsoft Windows 10 Pro 64-bit 14393 Multiprocessor Free
       2016-04-10 #25

    You're welcome drugo!
    I'm glad it helped.
    You should be able to. I'm new at posting on YouTube, so if you can't, let me know what I need to set, so it can be.
      My System SpecsSystem Spec


  7. Joined : Feb 2015
    Bamberg Germany
    Posts : 12,923
    Microsoft Windows 10 Pro 64-bit 14393 Multiprocessor Free
       2016-04-15 #26

    @Brink,
    Hey Shawn, I've been messing around now with the mounted Macrium image option for a bit.
    Even though it say "Make writable Note: Changes are temporary and will be discarded", I have found out, you can copy from the mounted image, and paste into the "host".

    This might come in useful to repair something, or get an installer(like maybe a driver or 3rd party program, you need to repair or reinstall without have to reimage and loose current updates and changes. I have successfully copy & pasted .dlls and other system files.

    It might be worth a tutorial, for non invasive repairs. Or, would this be more of something, for the video geeks?
      My System SpecsSystem Spec


  8. Joined : Oct 2013
    Posts : 17,447
    64-bit Windows 10 Pro build 15014
       2016-04-15 #27

      My System SpecsSystem Spec


  9. Joined : Oct 2014
    Arnold, MD
    Posts : 17,431
    Triple Boot 10 Pro & 10 Insider Pro & 8.1 Pro
       2016-04-21 #28

    Cliff S said: View Post
    @Brink,
    Hey Shawn, I've been messing around now with the mounted Macrium image option for a bit.
    Even though it say "Make writable Note: Changes are temporary and will be discarded", I have found out, you can copy from the mounted image, and paste into the "host".

    This might come in useful to repair something, or get an installer(like maybe a driver or 3rd party program, you need to repair or reinstall without have to reimage and loose current updates and changes. I have successfully copy & pasted .dlls and other system files.

    It might be worth a tutorial, for non invasive repairs. Or, would this be more of something, for the video geeks?
    Brink said: View Post
    @Cliff S, @Brink - Just an add-on... Same procedure can be used on a Restore Point. A small utility System Restore Explorer | Nics Blog can be used to mount a Restore Point. Copy/paste to host any file in the restore point, user data, system data, etc. Delete the Restore Point if desired. Just thought I'd pass it on. TC
    Last edited by f14tomcat; 2016-04-21 at 09:11.
      My System SpecsSystem Spec


  10. Joined : Oct 2013
    Posts : 17,447
    64-bit Windows 10 Pro build 15014
       2016-04-21 #29

    Thank you.
      My System SpecsSystem Spec


 
Page 3 of 4 FirstFirst 1234 LastLast


Similar Threads
Tutorial Category
Event Viewer -- Audit Failure 5061
I continue to get this event in the Event Log under Audit Failure. I never had in Windows 8.1 and it started after upgrading to 10. Does anyone have a clue about it? Cryptographic operation. Subject: Security ID: SYSTEM Account...
Performance & Maintenance
Worried about event viewer errors
hi guys managed to install windows 10 and everything seems to be working great. I looked in event viewer and I'm getting loads of errors, the same over and over. one is that keeps coming up is kernel-power event id 137 The system...
Performance & Maintenance
Clearing event viewer entries
How can I construct a .bat file to clear entries in the event viewer. Thanks
General Support
TONS of errors in event viewer
I just clean installed my windows, and have not made any changes as to what would cause these errors.... but in event viewer, since install on the 29th, i have 800 errors and warnings. ive noticed on my other PC that i just installed 10 on...
Performance & Maintenance
Repeating errors in Event Viewer on reboot - Win 10 Pro 64-bit
I'm getting certain repeating errors in Event Viewer when I reboot my new Win Pro 64-bit (after yesterday's upgrade from Win 8.1 Pro 64-bit). Please see the details and post your thoughts here: ...
BSOD Crashes and Debugging
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 17:24.
Find Us
Twitter Facebook Google+



Windows 10 Forums