Key takeaway
Compare an event with system, application and server records from the same time window. Check current audit and logging settings first: an event that was not recorded cannot be recovered from a log later.
Choose the right Event Viewer log
In Event Viewer, Windows Logs contains Application, Security, Setup, System and Forwarded Events; Application and Services Logs contains product and service channels. Narrow the time window using the user report or monitoring signal, then filter by provider, Event ID and level. Direct file access is usually unnecessary; Event Viewer filters and exports support a safer, repeatable investigation.
Narrow the time window
Choose a window before and after the event; note the system clock and time zone.
Select log and level
System covers drivers and services, Application covers software errors, and Security contains audit events.
Compare related records
Compare multiple sources by time, provider, user or correlation ID.
Read errors with PowerShell
Get-WinEvent queries Windows Event Log and ETW logs. FilterHashtable applies time, channel and level conditions while reading the log, which is preferable to retrieving a large log before filtering it. This example reads a limited set of Error-level events from the System log for the last 24 hours. Some channels require additional permissions.
$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 2; StartTime = $since } -MaxEvents 100 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message
Read Security events in context
In the Security log, 4624 indicates a successful logon and 4625 an unsuccessful attempt. An Event ID alone is not proof of compromise: compare the account, logon type, source address, host, time and expected behavior for that account. Event generation depends on audit policy; for example, recording an object permission change as 4670 may require suitable auditing and an object SACL. Event 4688 records process creation, but its command-line field is enabled through a separate audit policy. Check each Event ID against current Microsoft documentation and your Windows version.
4624 and 4625
Successful and failed logons; analyze them with the user, logon type, source host and outcome.
Audit policy
Confirm the audit category needed for the event is enabled.
Export and sharing
Limit support exports; messages can contain user, host and internal infrastructure details.
Configure IIS W3C logging
IIS 7 and later uses W3C format by default; logged fields are selected at server or site level. The #Fields line records the field order in that file. Date/time, client IP, method, URI stem, HTTP status, substatus and time-taken are often useful for diagnosis. UriQuery, referrer, user agent and custom fields may contain sensitive values, so enable them only when needed. In IIS Manager, check the format, directory and fields under the site’s Logging settings; the usual default directory is %SystemDrive%\inetpub\logs\LogFiles.
HTTP status
A 404 may indicate a missing resource and a 5xx a server-side problem; use substatus and application logs to narrow the cause.
Time and volume
Fields such as time-taken and bytes sent can help relate a slow request to resource load.
Field selection
Select fields for the task and assess the risk of sensitive data in query strings and referrers.
Compare web-server logs
Access log formats and field names differ across Apache, NGINX and IIS, so inspect real sample lines and headers before configuring a parser. Method, URI, status, response size, user agent and time help explain traffic patterns and server errors. Do not trust user-agent text alone when analyzing crawlers; it is supplied by the client and can be imitated. A log shows requests seen by the server, not a user’s full journey or intent.
| Source | What it shows | Check |
|---|---|---|
| Access log | Request, response status, transfer and timing. | Check the format header and field order. |
| Error/application log | A server or code error, component and context. | Correlate with access records by request ID and time. |
Manage rotation and retention
IIS can start a new file on a time period or configured size threshold; this does not set retention by itself. Windows Event Log maximum size and full-log behavior are configured separately. Linux logrotate can rotate, archive and compress files by time or size; check whether the application continues writing to a renamed file. For each environment, define archive copies, access rights, deletion timing and disk-usage alerts. An organization’s responsible specialist must determine whether its retention rule meets applicable legal or industry requirements.