How to Check Event Logs in Windows 11 (Event Viewer Guide)

Eric DawsonByEric Dawson Computers & Software

Windows 11 keeps a running record of nearly everything happening on your PC, and you can check event logs through Event Viewer, the diagnostic tool built into every edition of the operating system. Open it by typing Event Viewer into the Start menu search bar, or press the Windows key plus R, enter eventvwr.msc, and select OK. The tool sorts activity into logs for system events, application errors, and security actions, and each entry carries a severity level so serious problems stand out. Filtering by log, date, or severity turns thousands of entries into the handful that explain a crash, a failed sign-in, or an unexpected restart.

How to Open Event Viewer in Windows 11

Open Event Viewer in Windows 11 through Start menu search, the Run dialog, or the Power User menu. Each route reaches the same window within a few seconds.

Selecting Start and typing “Event Viewer” is the fastest option for most people, since the app appears at the top of the results list within a keystroke or two. Keyboard users can press the Windows key plus R to open the Run dialog, type eventvwr.msc, and press Enter.

Pressing the Windows key plus X opens the Power User menu, where Event Viewer sits next to Device Manager and Disk Management. Administrators who already work inside Computer Management can right-click the Start button, choose Computer Management, expand System Tools in the left pane, and click Event Viewer.

Method Steps Best For
Start Menu Search Type “Event Viewer” in the search bar General users, quickest access
Windows Key Plus R Press Windows key plus R, type eventvwr.msc Power users, keyboard preference
Windows Key Plus X Press Windows key plus X, select Event Viewer Power users, consistent with admin tools
Computer Management Right-click Start, choose Computer Management, expand System Tools, click Event Viewer IT professionals, system administration context

What the Windows Logs Categories Show

Four categories make up the Windows Logs section: System, Application, Security, and Setup, and each one covers a different slice of what the computer has been doing. That structure has existed since Windows NT 3.1, so anyone who used older versions of Windows will find it familiar.

System Log

System log entries record Windows services, drivers, startup problems, unexpected restarts, and hardware failures. Check it first when a PC restarts on its own, a driver will not load, or a service refuses to start.

Application Log

Application log entries cover desktop program crashes, software errors, and service failures tied to third-party programs. Consult it when one specific program keeps closing without warning.

Security Log

Security log entries track sign-in attempts, failed logins, and access events, and viewing them requires administrator access. A run of failed sign-ins here can point to an unauthorized access attempt rather than a typo.

Setup Log

Setup log entries show Windows update activity and feature installation history. Look here after an update stalls or a feature install does not finish.

What the Event Severity Levels Mean

Every entry in Event Viewer carries one of five severity levels: Critical, Error, Warning, Information, or Verbose, and the level is the fastest way to judge how urgent an entry is. Critical events point to a crash or a failure serious enough to stop the system, while Information entries simply record routine operations and make up most of the log.

Level Color Meaning Common Use
Critical Red System crashes or critical failures Highest priority troubleshooting
Error Red Serious problems Needs prompt attention
Warning Yellow Minor issues Watch for a repeating pattern
Information White Normal operations Routine logging
Verbose Detailed Diagnostic information In-depth troubleshooting

Error entries mark serious problems, though not every error signals a recurring issue. Minor issues fall under Warning, and most do not need action unless the same one repeats. Verbose entries add detailed diagnostic information for deep troubleshooting rather than a first pass through the log.

How to Filter and Search for Specific Events

Filter events by right-clicking a log and selecting “Filter Current Log,” which narrows results by level, date range, source, event ID, or keyword and shows every match at once. Use “Find” in the Actions pane instead when searching for one keyword or event ID and stepping through matches one at a time.

Custom time ranges cover the last hour, the last 24 hours, or a specific date range set by hand. Narrowing the level to only Critical and Error surfaces the events that matter within seconds, which beats scrolling through the default view of the past week’s activity.

Few things reassure me like a maker’s PDF manual, perhaps because I can turn ordinary caution into a ritual and call it competence. For filtering and searching specific events, I start with the time range and then narrow by level or event ID, since one alarming red entry is often just my brain volunteering to panic ahead of the evidence.

How to Create a Custom View for Repeat Checks

Build a reusable filter by selecting “Custom Views” and then “Create Custom View,” picking the log category or source to include, and saving it under a name that will be easy to recognize later. Saved views appear in the left navigation pane, ready to open without rebuilding the filter each time.

Custom views work well for a recurring check, such as watching only Critical and Error entries from the System log after a repeated crash. Setting one up once saves the trouble of reapplying the same filter every time a problem resurfaces.

How to Export or Clear Event Logs

Export a log through “Save All Events As” to keep a copy for a troubleshooter or for personal records. Clear a log through “Clear Log” when it takes up too much space, and choose to save it first in case the entries are needed later.

Regular log rotation policies also help keep space in check on systems that generate a high volume of events, since older entries roll off automatically once a log reaches its configured size.

What Common Event ID Numbers Mean

Six event ID numbers turn up in most troubleshooting sessions, and knowing them saves time compared with reading every description in full. Event ID 41 marks an unexpected shutdown or crash, while 6006 marks a clean shutdown and 6008 marks one that was not.

Event ID Type Meaning
41 Critical Unexpected shutdown or system crash
1000 Error Application crash
6006 Information Clean Windows shutdown
6008 Error Previous shutdown was unexpected
7034 Error Service terminated unexpectedly
4625 Error (Security log) Failed sign-in attempt

Service failures show up as event ID 7034, application crashes as event ID 1000, and failed sign-ins in the Security log as event ID 4625. Searching for a specific ID with the Find tool is often faster than reading through a full day of entries.

How to Check Event Logs in Windows 11 Without Opening Event Viewer

IT professionals managing several machines often skip the graphical window entirely and pull event data through PowerShell, Command Prompt, Windows Admin Center, or Reliability Monitor. Each option reaches the same underlying logs through a different interface.

PowerShell

PowerShell retrieves recent entries with a single command, such as Get-EventLog -LogName System -Newest 10, and can export the results to a CSV file for further review. Scripting a recurring check this way beats opening Event Viewer by hand every time.

Command Prompt

Command Prompt reaches the same logs through the wevtutil command, run from a window opened as administrator. It handles querying and managing event logs without a graphical interface at all.

Windows Admin Center

Windows Admin Center provides a web-based interface for managing event logs across multiple systems at once. Anyone responsible for more machines than they can check one at a time tends to rely on it.

Reliability Monitor

Reliability Monitor shows the same underlying events on a visual timeline instead of a list. Search for “reliability history” through Windows key plus S to open it and spot the point where problems started at a glance.

What to Do if Event Viewer Doesn’t Show the Problem

Match the timestamp of the problem to the timestamps in the log first, since an event that occurred minutes before or after the issue is unlikely to be the cause. Sort by Critical events before anything else, since they point to the most serious failures.

If the Log Is Too Full to Find Anything

Narrow the view with Filter Current Log before scrolling further, restricting the level to Critical and Error and setting a time range around when the problem happened. A default view covering the past week often buries the one entry that matters under routine Information events.

If You Don’t Have Administrator Access

Sign in with an administrator account, or ask whoever manages the PC to check the Security log, since standard accounts cannot open it. The System and Application logs remain visible without elevated access on most setups.

If the System Log Doesn’t Explain the Problem

Check the Application log next for a program-specific crash, then switch to Reliability Monitor for a timeline view of the same events. Spotting a pattern is often easier on that timeline than while scrolling through raw entries one at a time.

Example: Diagnosing an Unexpected Restart Step by Step

A PC that restarts without warning almost always leaves a trail in the System log, and matching a few event ID numbers to their timestamps usually points straight to the cause. The walkthrough below follows that process from open to explanation.

  1. Open the System log. Launch Event Viewer, expand Windows Logs, and select System.
  2. Filter by time. Use Filter Current Log and set the range to the hour before the restart, based on when the screen went dark.
  3. Look for event ID 41. A Critical entry with event ID 41 confirms the shutdown was not a clean one rather than a planned restart.
  4. Check the next boot for event ID 6008. This entry confirms the previous shutdown was unexpected, matching what the event ID 41 entry already showed.
  5. Scan the minutes before event ID 41 for event ID 7034. An entry showing a service terminated unexpectedly in that window often points to the specific driver or service that triggered the crash.

Event IDs 41, 6008, and 7034 together turn a mystery restart into a specific service to investigate rather than a guess about failing hardware. The same approach applies to any unexplained crash: filter to the window around the event, then read backward from the Critical entry to whatever logged just before it.

This guide does not set out default log sizes or retention rules on this page; configure them for your own PC if needed.

Frequently Asked Questions

Do I Need Administrator Rights to Open Event Viewer?

Standard accounts can open Event Viewer and read the System, Application, and Setup logs without extra permission. Administrator access is required specifically for the Security log, since it holds sign-in and access records. Ask an administrator to check that log if your account lacks the rights.

How Far Back Does Event Viewer Show Events?

Event Viewer’s default view displays a summary of events from the past week. Older entries stay available and searchable, but they fall outside the default summary until a filter or a custom time range is applied. Setting a wider range pulls in everything the log still holds.

What Is the Difference Between Event Viewer and Reliability Monitor?

Reliability Monitor and Event Viewer differ mainly in how they present the same data. Event Viewer lists raw events log by log, with full detail for each entry, while Reliability Monitor plots the same underlying data on a timeline, making it easier to see when a pattern of problems began. Many troubleshooting sessions start with Reliability Monitor for the overview and move to Event Viewer for the detail.

Is It Safe to Clear Event Logs?

Clearing a log removes its entries and frees up space, and Event Viewer offers the option to save the log first before clearing it. Saving a copy first is worth doing if the entries might matter later for troubleshooting or for a record. Clearing does not stop Windows from continuing to log new events afterward.

What Does Event ID 1000 Mean?

Event ID 1000 marks an application crash in the log. It shows up in the Application log alongside the name of the program that crashed and the module involved. Matching the timestamp to when the program closed unexpectedly confirms which entry to look at.

Checking event logs comes down to opening Event Viewer through whichever route is fastest, then narrowing straight to the log and severity level that matches the problem instead of scrolling through everything at once. A saved custom view or a quick PowerShell command turns a one-time check into a routine that takes seconds the next time something goes wrong.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.