{"id":900,"date":"2014-10-12T11:50:05","date_gmt":"2014-10-12T18:50:05","guid":{"rendered":"http:\/\/www.coretechnologies.com\/blog\/?p=900"},"modified":"2025-10-12T22:40:09","modified_gmt":"2025-10-13T05:40:09","slug":"event-viewer-troubleshoot-windows-services","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/event-viewer-troubleshoot-windows-services\/","title":{"rendered":"How to use the Event Viewer to troubleshoot problems with a Windows Service"},"content":{"rendered":"<p>\nA windows service, designed to run &#8220;headless&#8221; and unattended in the background, cannot easily employ conventional popup windows to report its activities as a user may not even be logged on. Instead, a service is encouraged to send important communication to the <b>Windows Event Log<\/b> &#8211; an administrative utility that collects and stores messages and events. Once recorded, these messages can be very helpful in troubleshooting problems, for example when a service stops unexpectedly or when it fails to start at all.\n<\/p>\n<hr class=\"blog-section\">\n<h2 class=\"blog-caption\">Viewing Events from Windows Services<\/h2>\n<p>\nUse <a href=\"http:\/\/en.wikipedia.org\/wiki\/Event_Viewer\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft&#8217;s Event Viewer<\/a> to see messages written to the Event Log. Start the application by clicking on the Start button and typing in <b>Event Viewer<\/b>, or from the Control Panel (search for it by name). The somewhat cluttered window should come up after a few seconds:\n<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/event-viewer.png\" class=\"zoomPopup\" rel=\"zoomgroup noopener noreferrer\" title=\"Event Viewer\" target=\"_blank\"><img decoding=\"async\" src=\"\/blog\/images\/event-viewer.png\" class=\"image-padding\" border=\"0\" title=\"Event Viewer (click to enlarge)\" alt=\"Event Viewer\" width=\"560\" \/><\/a><\/div>\n<p>\nThe left hand side shows a tree grouping the various logs captured on your machine. The events from Windows Services (and other applications running on your PC) are filed under <nobr><b>Windows Logs &gt; Application<\/b><\/nobr>. Navigate to that section to load the events in the center of the window, with the entire list in the top and details of the highlighted event underneath:\n<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/event-viewer-application-log.png\" class=\"zoomPopup\" rel=\"zoomgroup noopener noreferrer\" title=\"Event Viewer - Application Log\" target=\"_blank\"><img decoding=\"async\" src=\"\/blog\/images\/event-viewer-application-log.png\" class=\"image-padding\" border=\"0\" title=\"Event Viewer - Application Log (click to enlarge)\" alt=\"Event Viewer - Application Log\" width=\"560\" \/><\/a><\/div>\n<p>\nMessages from your windows service will have the <b>display name of the service in the Source column<\/b>.\n<\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\" \/><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">Important Components of an Event<\/h2>\n<p>\nThe Event Viewer shows over 10 pieces of information associated with each event, including:<\/p>\n<ul type=\"square\">\n<li><b>Level<\/b> &mdash; How important is this event?\n<p>\nEach event is classified into one of three categories:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"\/blog\/images\/event-viewer-information-icon.png\" border=\"0\" width=\"18\" height=\"18\" align=\"top\" title=\"\" alt=\"\"\/> <b>Information<\/b>: An informative yet unimportant event. You will probably see a lot of these, and they can be safely ignored unless you are digging into a specific issue from an application or service.\n<\/p>\n<p>\n<img loading=\"lazy\" decoding=\"async\" src=\"\/blog\/images\/event-viewer-warning-icon.png\" border=\"0\" width=\"18\" height=\"18\" align=\"top\" title=\"\" alt=\"\"\/> <b>Warning<\/b>: A moderately important event. These don&#8217;t necessarily signify a failure, and your software will probably limp along, but they should be reviewed regularly to see if anything mentioned can be resolved.\n<\/p>\n<p>\n<img loading=\"lazy\" decoding=\"async\" src=\"\/blog\/images\/event-viewer-error-icon.png\" border=\"0\" width=\"18\" height=\"18\" align=\"top\" title=\"\" alt=\"\"\/> <b>Error<\/b>: Indicates a critical problem or failure that may deserve your immediate attention!\n<\/p>\n<\/p>\n<\/li>\n<li><b>Date and Time<\/b> &mdash; When did this event occur?\n<\/p>\n<\/li>\n<li><b>Source<\/b> &mdash; Which application reported this event?\n<p>\nAs mentioned before, an event written by a Windows Service will contain the service&#8217;s display name as the Source.\n<\/p>\n<\/li>\n<li><b>Description<\/b> &mdash; What happened?\n<p>The full description shown prominently in the lower pane will (hopefully) provide the relevant details of the event.\n<\/p>\n<\/li>\n<\/ul>\n<p>\nFor example, this information event is from the <a href=\"\/WindowsServices\/FAQ.html#DisableInteractiveServicesDialog\" target=\"_blank\" rel=\"noopener noreferrer\">Interactive Services detection service<\/a> (&#8220;UI0Detect&#8221;) reporting that Notepad is showing itself in Session 0:\n<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/event-viewer-interactive-services-detection-event.png\" class=\"zoomPopup\" rel=\"zoomgroup noopener noreferrer\" title=\"Interactive Services Detection Service Event\" target=\"_blank\"><img decoding=\"async\" src=\"\/blog\/images\/event-viewer-interactive-services-detection-event.png\" class=\"image-padding\" border=\"0\" title=\"Interactive Services Detection Service Event (click to enlarge)\" alt=\"Interactive Services Detection Service Event\" width=\"560\" \/><\/a><\/div>\n<p><a name=\"system-logs\"><\/a><\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\" \/><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">Viewing Events <i>about<\/i> Windows Services<\/h2>\n<p>\nWhile the Application log keeps track of events from a running service, the <nobr><b>Windows Logs > System<\/b><\/nobr> area records when services are started, stopped, crash or fail to start. Look for events with the Source set to <b>Service Control Manager<\/b> (SCM). For example, here is the SCM telling us that the Windows Print Spooler service has crashed:\n<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/event-viewer-system-event.png\" class=\"zoomPopup\" rel=\"zoomgroup noopener noreferrer\" title=\"Event Viewer System Event\" target=\"_blank\"><img decoding=\"async\" src=\"\/blog\/images\/event-viewer-system-event.png\" class=\"image-padding\" border=\"0\" title=\"Event Viewer System Event (click to enlarge)\" alt=\"Event Viewer System Event\" width=\"560\" \/><\/a><\/div>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\" \/><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">Viewing Events from AlwaysUp and Service Protector<\/h2>\n<p>\nBoth AlwaysUp and Service Protector write messages to the Application section of the event logs (<nobr><b>Windows Logs &gt; Application<\/b><\/nobr>).\n<\/p>\n<p>\nFor AlwaysUp, events from your application named &#8220;My Application&#8221; will be logged with Source set to <b>My Application (managed by AlwaysUpService)<\/b>. The <a href=\"\/products\/AlwaysUp\/AlwaysUp_EventLog.html\" target=\"_blank\" rel=\"noopener noreferrer\">Event Log Messages Page<\/a> lists and explains the events reported.\n<\/p>\n<p>\nFor Service Protector, events related to your service named &#8220;MyService&#8221; will have a Source of <b>ServiceProtector: MyService<\/b>.\n<\/p>\n<p>\nAnd for both applications, events related to the starting and stopping of the underlying services themselves appear in the <nobr><b>Windows Logs > System<\/b><\/nobr> section. Look there if you have a problem with AlwaysUp itself failing to start at boot.\n<\/p>\n<div style=\"margin-top:30px\" align=\"center\">\n<div class=\"cta-button-1\">\n<table role=\"presentation\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\" align=\"left\">\n<tbody>\n<tr>\n<td align=\"center\"><a href=\"\/blog\/tag\/windows-services-2\/\" title=\"More articles about Windows Services\"><span><nobr>More about Windows Services&#8230;<\/nobr><\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<!-- relpost-thumb-wrapper --><div class=\"relpost-thumb-wrapper\"><!-- filter-class --><div class=\"relpost-thumb-container\"><style>.relpost-block-single-image, .relpost-post-image { margin-bottom: 10px; }<\/style><h3>You may also like...<\/h3><div style=\"clear: both\"><\/div><div style=\"clear: both\"><\/div><!-- relpost-block-container --><div class=\"relpost-block-container relpost-block-column-layout\" style=\"--relposth-columns: 3;--relposth-columns_t: 2; --relposth-columns_m: 2\"><a href=\"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/dropbox-service-not-working-after-update\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"My Dropbox Windows Service no longer works after Updating Dropbox \u2013 Help!\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/dropbox-trouble-150x150.png\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">My Dropbox Windows Service no longer works after Updating Dropbox - Help!<\/h2><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/windows\/is-auto-logon-safe\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Is it Safe to Automatically Log In to my Computer?\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/login-password-150x150-1.webp\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">Is it Safe to Automatically Log In to my Computer?<\/h2><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/windows-password-management\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Q&amp;A: Where does AlwaysUp store the Password for my Windows Account?\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/password-security-150x150-1.png\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">Q&amp;A: Where does AlwaysUp store the Password for my Windows Account?<\/h2><\/div><\/div><\/a><\/div><!-- close relpost-block-container --><div style=\"clear: both\"><\/div><\/div><!-- close filter class --><\/div><!-- close relpost-thumb-wrapper -->","protected":false},"excerpt":{"rendered":"<p>A windows service, designed to run &#8220;headless&#8221; and unattended in the background, cannot easily employ conventional popup windows to report its activities as a user may not even be logged on. Instead, a service is encouraged to send important communication &hellip; <a href=\"https:\/\/www.coretechnologies.com\/blog\/windows-services\/event-viewer-troubleshoot-windows-services\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":2232,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[26,290,79,147,196],"class_list":["post-900","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-windows-services","tag-alwaysup-tag","tag-event-logs","tag-event-viewer","tag-service-protector-tag","tag-windows-services-2"],"_links":{"self":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/comments?post=900"}],"version-history":[{"count":5,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/900\/revisions"}],"predecessor-version":[{"id":13163,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/900\/revisions\/13163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media\/2232"}],"wp:attachment":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media?parent=900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/categories?post=900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/tags?post=900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}