Event Message Browser

Navigation: Management Console / Utilities >

The built-in event message browser lets you view all available event messages that may be logged on your system. You can simply select an event log (e.g. Application) and select one of the available event sources from that log (e.g. ntbackup) and then review all the available Event IDs from that source.

General

When launched from the filter dialog, the event message browser lets you apply the basic event properties to the filter. Additionally, you can also generate the selected event in the event log by clicking the Test button.

The event message browser can be launched from the filter dialog by clicking the Lookup button, or through menu at Tools -> Utilities -> Event Message Browser.

Insertion Strings / Creating Test Events

Most event messages use so-called insertion strings, indicated by the percentage sign followed by a number. For example, an event message in the event message browser might include the string %1, which will be replaced with useful data at run-time. For example, the event message (event id 8000 from ntbackup):

Begin Backup of '%1'

Verify: %2

Mode: %3

Type: %4

will look similar to the one below when logged to the event log:

Begin Backup of 'V:'

Verify: Off

Mode: Append

Type: Normal

since the NTBackup utility will replace the insertion strings %1, %2, %3 and %4 with data that is relevant to the current operation. When creating a test event through the event message browser, the insertion strings will all be replaced with the text specified in the Test String field, which is EventSentryTest by default.

You cannot create test events from the events in the Security event log. Only the Operating System itself may generate security-related events.

This is not a limitation of the event message browser, but instead a security measure of Windows to maintain the integrity of the Security event log.

The screenshot below shows the event message browser with the above event being displayed:

clip0369