MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

How to Save and Open Logs
Lesson 2 Using Event Viewer
18-17
Saving logs allows you to maintain a history of events. Many companies have policies
on archiving logs for a specified period—especially auditing-related events in the Security
log.
To work with a log, right-click the log you want to configure in Event Viewer, and then
click one of the options described in Table 18-4.
Table 18-4 Options to Archive, Clear, or View a Log File
To Do this
Save the log Click Save Log File As, and then type a filename.
Clear the log Click Clear All Events to clear the log. Windows XP Professional creates
a security log entry, stating that the log was cleared.
Open a saved log Click Open Log File.
Open a new log Click New Log View to create a second view of the selected log. By
view
default, this view is named the same as the original view with a copy
number appended in parentheses. For example, if you create a new
view of the System log, the default name for the new view is System
(2). Right-click the new view and click Rename to change the name.
You can use different views to look at log files filtered different ways
or to open saved logs.
Lesson Review
The following questions are intended to reinforce key information presented in this
lesson. If you are unable to answer a question, review the lesson materials and try the
question again. You can find answers to the questions in the “Questions and Answers”
section at the end of this chapter.
1. What are the three Windows XP Professional logs you can view with Event
Viewer, and what is the purpose of each log?