Windows 11 Event Viewer Cheat Sheet
Sidebar
Operating Systems · Windows 11 Event Viewer Cheat Sheet
Event Viewer's logs and filters, the event IDs that matter when a PC crashes or misbehaves, and the PowerShell and wevtutil equivalents. Event IDs and counts quoted as here were read from the System and Application logs of the PC this was written on (Windows 11 Pro, build 26300) as a normal user; the Security log is not readable without administrator rights. The Event Viewer window itself was not clicked through.
Opening and Layout
eventvwr.mscWin+R, or right-click Start > Event ViewerWindows LogsApplication, Security, Setup, System, Forwarded EventsApplications and Services LogsPer-component logs; Microsoft > Windows > … holds hundreds (e.g. Kernel-Power, WHEA)Custom Views > Administrative EventsCritical, Error and Warning from all logs in one list: a good first lookMiddle paneThe event list; the bottom pane has the General text and a Details tab (Friendly or XML view)Right pane (Actions)Filter Current Log, Create Custom View, Save All Events As, Attach Task, Refresh, Clear LogLevels
CriticalLevel 1: serious failure, e.g. Kernel-Power 41ErrorLevel 2WarningLevel 3InformationLevel 4VerboseLevel 5: diagnostic detailAudit success / failureKeywords used in the Security logFilter Current Log
LoggedA time range: last hour, last 24 hours, 7 days, 30 days or customEvent levelTick Critical, Error, Warning to cut the noiseBy sourceChoose the provider, e.g. Microsoft-Windows-Kernel-PowerEvent IDsType 41,6008 to include; -7036 (with a minus) to exclude; 1-100,-17 for a range minus oneTask category / KeywordsNarrow further; usually unnecessarySave Filter to Custom ViewKeep a useful filter for next timeDetails tab > XML ViewShows the raw event, including the named fields (e.g. BugcheckCode)Event IDs for Crashes and Restarts (System Log)
Kernel-Power 41Critical: restart without a clean shutdown (4 here). BugcheckCode 0 = no stop codeEventLog 6008The previous system shutdown at … was unexpected (3 here)EventLog 6005 / 6006The Event Log service started / stopped: roughly boot and shutdown (41 / 38 here)Kernel-General 12The operating system started (41 here)User32 1074A process or user initiated a restart/shutdown, with the reason (39 here)Kernel-Power 109Shutdown transition started: normal (37 here)WER-SystemErrorReporting 1001After a blue screen: the code, four parameters and dump path (2 here)WHEA-Logger 17 / 18 / 19Hardware error reports. Per third-party guides, 18 is a fatal machine-check, 19 a corrected one. None hereEvent 1001 here has the Provider name Microsoft-Windows-WER-SystemErrorReporting, not BugCheck: filter on the first.
Event IDs for Disks, Services and Updates
disk 7The device … has a bad block (1,402 here)disk 11The driver detected a controller error on … (128)disk 51An error was detected on device … during a paging operation (326)disk 153The IO operation … was retried (1,693)Ntfs 55File system structure is corrupt: run chkdsk (none here)Service Control Manager 7034 / 7031A service terminated unexpectedly / and will be restartedService Control Manager 7045A new service was installed: useful when something new appearsWindowsUpdateClient 19 / 20Update installed successfully / installation failure (435 / 44 here)Application Error 1000A program crashed: faulting application and moduleApplication Hang 1002A program stopped respondingGet-WinEvent (PowerShell)
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=41}All unexpected-restart events, newest firstGet-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddHours(-24)}Critical and Error events in the last dayGet-WinEvent -LogName System -MaxEvents 20The 20 newest eventsGet-WinEvent -LogName System -FilterXPath "*[System[(EventID=6008)]]"XPath filter (what Event Viewer builds from your filter)Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0Which logs hold anything([xml]$e.ToXml()).Event.EventData.DataRead an event's named fields ($e is one event from the above)$e.MessageThe rendered text of one eventUse -ProviderName and -Id inside the hashtable, together with LogName; a wrong provider name gives The parameter is incorrect.
wevtutil (Command Prompt)
wevtutil qe System /q:"*[System[(EventID=41)]]" /c:5 /rd:true /f:textQuery: the 5 newest event-41s as textwevtutil elList every log namewevtutil gl SystemShow a log's settings (size, retention, path)wevtutil epl System C:\evidence\System.evtxExport a log (may need admin)wevtutil cl SystemClear the log. Destroys evidence: export first, and do not do it while investigatingLog Size and Safety
Right-click a log > PropertiesMaximum log size and what to do when fullSystem / Application here20 MB each; the System log was full and reached back only to 21 JulyEnlarge a logRaise Maximum log size (e.g. to 100 MB) so crashes stay available for longer; needs admin. Undo: set the old size backSave All Events As…Saves an .evtx file you can reopen in Event Viewer on any PCOpen Saved Log…View an exported log without touching the live oneClear Log…Offers to save first. Don't clear logs while a problem is openCounts here are a snapshot
The numbers in brackets are from this PC on 24 October 2026 and will differ on yours. The IDs and sources are what to keep.
A log that wrapped has lost its past
The System log here holds only 20 MB and reaches back about three months. If a problem is rare, export the log when it happens, or the evidence may be overwritten before you look.