How to view and save the Event Log on your Windows VPS

What this is#

The Event Log is where Windows explains itself, why a service didn't start, what crashed, who tried to log in. Reading it is half of Windows troubleshooting; saving it is how you preserve evidence (before a reboot clears the picture) and share it without screenshots-of-scrollbars. Both take a minute.

Viewing: the three logs that matter#

Right-click Start → Event Viewer (or run eventvwr). Under Windows Logs:

• System: Windows itself and services, service start failures, driver issues, unexpected shutdowns live here.
• Application: your software's errors, app crashes, SQL Server complaints, IIS application errors.
• Security: logons and audit events, including the brute-force noise and Event 4625.

Reading tips that save time: sort by Level (Error/Critical first, Information is mostly noise), and use Filter Current Log (right-hand pane) to cut to a time window ("when did it break?") or a specific Event ID. The Event ID plus Source is the searchable unit, paste those two into a search engine or an AI chatbot with the message text, and most events decode instantly.

Saving a log (the .evtx file)#

• Whole log: right-click the log (say, System) → Save All Events As... → .evtx. When asked about display information, include it, that keeps the file readable on other machines.
• Just your filtered slice: apply the filter first, then right-click → Save Filtered Log File As..., a small file with only the relevant events, usually what you actually want.
• Command line (great over a slow session or in scripts):

wevtutil epl System C:\Users\Administrator\Desktop\system-log.evtx

• PowerShell, when you want text rather than .evtx (for pasting a handful of events):

Get-WinEvent -LogName System -MaxEvents 50 | Format-List TimeCreated, Id, ProviderName, Message > $env:USERPROFILE\Desktop\system-events.txt

Anyone can open an .evtx, double-clicking it loads it in Event Viewer on any Windows machine, so the file travels well.

Attaching logs to a support ticket, the right way#

Event logs are exactly the machine output a good ticket wants: save the filtered slice around the incident time (not the 200 MB full log), attach the .evtx or the exported text, and describe in your own words what happened and when, the log corroborates your story rather than replacing it.

Two housekeeping notes#

• Don't clear logs to "clean up", they rotate themselves (old events age out as the log hits its size limit), and cleared logs are exactly what you'll wish you had after the next incident. Clearing the Security log in particular is what intruders do, not what owners do.
• Logs survive reboots, but the context in your head doesn't, when something odd happens, save the filtered slice then, timestamped, while you still know what you're looking at.

Still need help?#

You can open a support ticket. So we can help on the first reply, it's worth mentioning:

• the VPS hostname or IP,
• which log and Event ID you're looking at,
• the saved .evtx or exported text, if you have it.

Related questions#

• "How do I open Event Viewer on my Windows VPS?"
• "How do I save the event log as a file?"
• "How do I export only certain events (filtered log)?"
• "Which Windows log shows why a service failed?"
• "How do I attach event logs to a support ticket?"