About Event Viewer

Learn how to use Event Viewer.

1. From the Start menu, select All Programs, then select Administrative Tools, and then select Event Viewer.

   The Event Viewer window appears.

2. Select Windows Logs.
3. Double-click Application to open the Application view window.

Application View Window displays the Application view window, Application View Definitions shows what is recorded in each column, and Event Viewer Icons interprets icons that appear on the left hand side of the viewer.

Figure 7-1 Application View Window

Description of "Figure 7-1 Application View Window"

Table 7-2 Application View Definitions

Column Name	Definition
Date and Time	Date and time at which an event took place
Source	Application that recorded an event
Event ID	Unique number assigned to an event
Task Category	Classification of events

Table 7-3 Event Viewer Icons

Icon	Event Type	Suggested Action
Exclamation Point in Red Circle	Error	Error identification. Always check these icons.
Lowercase "i" in Blue Circle	Information	Noncritical system events. Check these icons only to track a specific event.
Exclamation Point in Yellow Triangle	Warning	Special events, such as instance termination or services shutdown. Investigate these icons, but they are usually noncritical.

Learn how to manage Event Viewer.

1. Right-click the event log in which you want to set size, and select Properties.

   The event Log Properties window appears.

2. Use the up and down arrow keys to set the size you want in the Maximum log size box.
3. Under When maximum event log size is reached, select one of the options that you want. The options are as follows:

   • Overwrite events as needed (oldest events first)

   • Archive the log when full, do not overwrite events

   • Do not overwrite events (clear log manually)

4. If you want to clear the log contents, click Clear Log.
5. Click OK.

   You return to Event Viewer.

   Note:

   Audit information cannot be spooled to a file. AUDIT_FILE_DEST is supported on Windows to write XML format audit files when AUDIT_TRAIL is set to XML or XML,EXTENDED format and thus must be added to the initialization parameter file.

Learn how to read an Event Viewer.

Oracle Database for Windows events are displayed with a source of Oracle.SID.

Event number 34 specifies an audit trail event. These events are recorded if the parameter AUDIT_TRAIL is set to db (true) or os in the initialization parameter file. Option os enables systemwide auditing and causes audited records to be written to Event Viewer. Option db enables systemwide auditing and causes audited records to be written to the database audit trail (table SYS.AUD$). Some records, however, are written to Event Viewer.

Event numbers other than 34 specify general database activities, such as an instance being started or stopped.

When you double-click an icon in Event Viewer, the Event Properties dialog box appears with more information about the selected event. Event Properties General Tab, for example, shows details about Event ID 4112. In the General tab, you find a text description of the event. In the Details tab, you can select Friendly View to see the System and Event Data in words or XML View to see the same information in XML format, as shown in Event Properties Details Tab.

Figure 7-2 Event Properties General Tab

Description of "Figure 7-2 Event Properties General Tab"

Figure 7-3 Event Properties Details Tab

Description of "Figure 7-3 Event Properties Details Tab"