How-To Export Windows Event Logs

Modified on Wed, 16 Mar, 2022 at 4:34 PM

Purpose

When submitting a ticket , it is sometimes necessary to upload relevant Windows event logs in addition to the Veeam logs.

Event logs exported using default settings can be missing important information. This article describes two different methods of exporting Windows event logs and which logs tend to be most useful for certain types of support cases. 

Solution

Below are the two common methods you can use to gather event logs...

  1. Export EVTX with Display Information (MetaData)
  2. Export as CSV


Method 1: Export EVTX with Display Information (MetaData)

An .evtx file alone does not contain the text of most events, so uploading an .evtx file without the associated Display Information can delay resolution of your support case. Even with the display information, an .evtx contains only the UTC time of the events and not the source time zone (Event viewer adjusts the displayed time to your local time zone).

Steps to Export .evtx with Display Information

  1. Open Event Viewer (eventvwr.msc).
  2. Locate the log to be exported in the left-hand column.
  3. Right-click the name of the log and select Save All Events As…
  4. Enter a file name that includes the log type and the server it was exported from.
    For example, when exporting the Application event log from server named HV01, enter Application_HV01.
  5. In Save as type , select Event Files .
  6. Include display information.


    User-added image

  7. Be sure to include the LocaleMetaData folder when packaging logs for upload.

    User-added image


Please package all files into a single .zip archive

Method 2: Export as CSV

  1. Open Event Viewer (eventvwr.msc).
  2. Locate the log to be exported in the left-hand column.
  3. Right-click the name of the log and select Save All Events As…
  4. Enter a file name that includes the log type and the server it was exported from.

    For example, when exporting the Application event log from server named HV01, enter Application_HV01.

  5. In Save as type , select CSV (Comma Separated) .

    User-added image



Please package all files into a single .zip archive

Method 3: Collect entire log folder from Windows.

  1. Navigate to C:\Windows\System32\winevt\Logs
  2. Archive (ZIP\7z\RAR) the entire contents of the Logs folder.

Please package all files into a single .zip archive

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article