Disclaimer: This topic may be contributed by the community or involve information about third-party products. We recommend that you visit the official website of the community or third-party products for help and support. The third-party products are not supported by Alibaba Cloud after-sales service. This topic is for reference only. Alibaba Cloud does not make guarantees or warranties, express or implied.
Overview
This topic describes how to use Windows Event Viewer to view instance operational logs.
Description
Take note of the following items:
- Before you perform high-risk operations such as modifying the specifications or data of an Alibaba Cloud instance, we recommend that you check the disaster recovery and fault tolerance capabilities of the instance to ensure data security.
- Before you modify the specifications or data of an Alibaba Cloud instance, such as an Elastic Compute Service (ECS) instance or an ApsaraDB RDS instance, we recommend that you create snapshots or enable backups for the instance. For example, you can enable log backups for an ApsaraDB RDS instance.
- If you have granted specific users the permissions on sensitive information, such as usernames and passwords, or submitted sensitive information in the Alibaba Cloud Management Console, we recommend that you modify the sensitive information at the earliest opportunity.
When a Windows instance restarts automatically, resource exceptions, or application errors occur, you can use the Event Viewer provided by Windows to check the corresponding events for troubleshooting. This topic uses Windows Server 2008 as an example to describe the purpose of event viewers.
Go to Windows Event Viewer
- Connect to and log on to the ECS instance.
- Click Start and choose Administrative Tools > Server Manager > Diagnostics > Event Viewer.
View Windows logs
In the event viewer, the commonly used Windows logs include system log, security log, and application log.
System Logs
- Events caused by system log entry system exceptions.
- You can view system logs such as system updates and insufficient memory resources.
- Exclamation mark (!) Indicates a warning, which generally does not seriously affect the use.
- Multiple warning events such as insufficient memory resources may cause slow host cards or false death.
- For more information about events, click Event Log Online Help.
Security logs
- The logon information of the security log entry server, or the audit events of some policies.
- During remote login, if the login is normal, the audit will be successful. If an exception occurs, such as an incorrect password, the message Audit Failed is displayed.
- For more information about events, click Event Log Online Help.
The SDK demo.
- The application log entry the events of some applications or system default programs installed on the server.
- For example, the event records of site services running on the instance, MySQL,PHP,IIS and other related applications.
- For more information about events, click Event Log Online Help.
View application and service logs
In the Event Viewer, application and service logs contain event logs for various other important service components in the Windows system.
- Open Event Viewer and choose Microsoft > Windows > TerminalServices-LocalSessionManager > Operational. The access log of the user's remote desktop is recorded. You can use this log to locate problems related to remote login.
- Click Start and choose Administrative Tools > Server Manager > Diagnostics > Event Viewer > Application and Service Logs to view application and service logs.
Note: For more information about events, click Event Log Online Help.
Applicable scope
- ECS