Windows logs an enormous amount of activity in the background — every crash, every driver failure, every unexpected shutdown gets recorded somewhere before you ever notice a problem. Event Viewer is where that record lives. It has a reputation for being overwhelming, mostly because the default view dumps thousands of routine, harmless entries alongside the handful that actually explain what went wrong, and nothing points you at the difference.
Opening Event Viewer and Finding Your Way Around
Search "Event Viewer" in the Start menu, or run eventvwr.msc. The left pane organizes logs into categories under "Windows Logs":
- Application: Events logged by installed software — a program crashing usually shows up here.
- Security: Login attempts, permission changes, and other access-related events (mostly relevant on managed/business machines with auditing enabled).
- System: Events logged by Windows itself and its drivers — this is usually the first place to check after an unexpected restart or a driver-related crash.
Each entry has a severity level: Information (routine, expected), Warning (something worth noting but not necessarily broken), and Error or Critical (something actually failed). The vast majority of entries in any log are Information — ignore those when troubleshooting and focus on Warning, Error, and Critical.
Investigating a Specific Problem
Rather than scrolling through everything, filter to the relevant time window:
- Click "System" (or "Application," depending on what crashed) in the left pane.
- In the right pane, click "Filter Current Log."
- Set "Event level" to Critical, Error, and Warning (uncheck Information and Verbose).
- If you know roughly when the problem happened, set the "Logged" dropdown to a custom time range around that window rather than searching the entire log.
- Click OK — the filtered list is now short enough to actually scan.
Click any entry to see its details in the lower pane. The "General" tab gives a plain-language description; the "Details" tab gives the raw XML data, useful mainly when searching for the exact error further online. Note the Event ID number and the Source (which service or driver logged it) — these two together are what you'd search for if the description alone doesn't explain the issue.
Diagnosing an Unexpected Restart or Blue Screen
After an unexpected reboot, check the System log for an event with source "Kernel-Power," Event ID 41 — this specifically flags an unclean shutdown (the system restarted without Windows shutting down normally, often from a crash, power loss, or hardware fault). If a blue screen occurred, search the System log around that timestamp for an event with source "BugCheck," which records the specific stop code — that stop code is far more useful for research than "it just crashed," since each code points at a different category of cause (memory, driver, storage, etc).
What Event Viewer Won't Tell You
Event Viewer explains what Windows and its components logged — it won't diagnose problems that don't generate log entries, like general slowness from too many background processes, which is better investigated through Task Manager and our guide to managing Windows services. It's also not a performance monitor; for tracking CPU, memory, and disk usage over time, the Resource Monitor and Performance Monitor tools (both reachable from Task Manager) are the better fit, alongside confirming your actual hardware specs in our guide to checking PC specs if you suspect the hardware itself is the bottleneck.
Using Event Viewer to Diagnose a Failing Driver
Driver problems are one of the more common reasons people end up in Event Viewer, and they tend to show a recognizable pattern: repeated Warning or Error entries from the same Source (the driver or service name) clustered around the times a specific piece of hardware was used — a printer, a webcam, a docking station. If the same source keeps appearing across multiple sessions, that's a stronger signal than a single one-off entry, and it's worth checking the manufacturer's site for an updated driver even if Windows Update hasn't flagged one. Device Manager, reachable by right-clicking the Start button, will also show a yellow warning icon on a device with a known driver problem, which is often a faster first check than digging through logs.
Setting Up Task Scheduler to Act on Specific Events
A lesser-known feature: right-clicking any log entry offers "Attach Task to This Event," which opens a wizard that can trigger an action (running a script, sending a notification, launching a program) automatically whenever that same type of event occurs again. This is more of a power-user feature than something most people need day to day, but it's genuinely useful for catching an intermittent problem that only happens when you're not at the computer to notice it in the moment.