Windows 10: Understanding the Event Data of Event Viewer logs in XML format

Hello,

I'm trying to understand how to decode the %%-numbers present in some XML event data section.

For example, in the eventID 5152, I have


<EventData><Data Name='ProcessId'>0</Data><Data Name='Application'>-</Data><Data Name='Direction'>%%14592</Data><Data Name='SourceAddress'>10.0.0.76</Data> ... etc


in this case I know the direction is Incoming, but why that code? In the Microsoft reference page for that event, Direction field is an Unicode String. So maybe is that a reference to a table in a DLL? Or what?


Thanks in advance,

Fausto


***Original title: EventData %% code***

:)

 

Delete Event Log Files created in one month

Rishad,

I noticed that some type of XML coding might help to export.

I export the logs basically based on the setup of the events. For example, you have Event Viewer (Local) -> Windows Logs -> Security. And I export them to )say the month of April):

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Comma Separated Value - CSV\04.csv

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer\No Display Information\04.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer\Display Information for English\04..evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\Event Viewer Current View - XML\04.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\TXT\04.txt

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\XML\No Display Information\04.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Windows Logs\2016\Security\XML\Display Information for English\04.xml

What is getting a bit more difficult is creating the Event Viewer (Local) -> Applications and Services Logs -> Dell (OK a bit easy), but then you have Event Viewer (Local) -> Applications and Services Logs -> Microsoft -> Windows -> AAD. Which goes to:

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Comma Separated Files - CSV\01.csv

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Event Files\No Display Information\01.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\Event Files\Display Information for English\01.evtx

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\TXT\01.txt

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\XML\No Display Information\01.xml

D:\Logs\Event Viewer\Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\AAD\Operational\2016\XML\Display Information for English\01.xml

So maybe if an XML export can some export / create the proper documents, that would be great!

Thank you!

 

Error in event viewer

Hi

I keep geting the following in the Event viewer ,
The description for Event ID (4) in source ( SuperProServer ) cannot be found . the local computer may not have the necessary registry information or message DLL files to display message from a remote computer . You may be able to use /AUXSOURCE= flag to retrieve this description . The following information is part of the event, The event log file is corrupt .

has anyone any ideas has to what this means .

cheers

 

Event viewer error with event id 10016

Hello,

Thank you for posting your query on Microsoft Community forum.

I understand that you are getting an error “DistributedCOM 10016” in the event viewer logs.

• Do you face any issues on the computer?
  
• Have you made any recent changes to the computer?

This problem may occur if either of the following conditions is true:

• A program with the class ID (CLSID) that appears in the message tries to start the COM component by using the DCOM infrastructure. However, the user does not have the required permissions to start the COM component.

• The Network Service account does not have the correct permissions.

Event logs are special files that record significant events on your computer, such as when a user logs on to the computer or when a program encounters an error. Whenever these types of events occur, Windows records the event in
an event log that you can read by using Event Viewer. Advanced users might find the details in event logs helpful when troubleshooting problems with Windows and other programs.

If you do not have any issues with app or any other program I would suggest you to ignore it.

Keep us posted if you face any issues related to Windows in future. We will be glad to help you.