Windows Event Viewer
As an engineer, I am sure you are well aware of Windows Event Viewer. It is a built-in tool that can be used to view and filter event logs on a local or remote computer. The events shown there are generated by the operating system, services, server roles, and applications. This is the most commonly used tool in Windows systems for auditing and troubleshooting purposes.
We also can write custom events to event logs. This is useful if you plan to run a script or action based on a particular event ID. This can be done by using the Write-Eventlog cmdlet.
As shown in the following screenshot, Windows Event Viewer (Local) has four different categories to group event logs:
Figure 19.1: Windows Event Viewer
In the preceding list, Windows Logs and Application and Service Logs both have additional predefined subcategories.
