Collect an Event ID and neighboring product events#

When to use this procedure#

Use this first when an event contains dynamic detail or several failures occur together.

Applies to#

This procedure applies to WinSyslog.

Prerequisites#

  • Use an account that can read the product configuration and Windows diagnostic state.

  • Replace angle-bracket placeholders with values from the affected system.

Safety#

  • Run diagnostic checks before changing configuration.

  • Remove passwords, private keys, license data, and other secrets from evidence.

Configuration path#

Event Viewer > Windows Logs > Application > Filter Current Log.

Procedure#

  1. Record the Event Log source, Event ID, level, timestamp, and complete General and Details data.

    Expected result: The affected object and its effective settings are identified.

    If it fails: Return to the complete Event Log detail and configuration export before changing settings.

  2. Run the native Windows checks below from the affected product host.

    $start=(Get-Date '<EVENT_TIME>').AddMinutes(-5)
$end=(Get-Date '<EVENT_TIME>').AddMinutes(5)
Get-WinEvent -FilterHashtable @{LogName='Application';StartTime=$start;EndTime=$end} | Where-Object ProviderName -eq '<EVENT_SOURCE>' | Format-List TimeCreated,Id,LevelDisplayName,Message

    Expected result: The output contains the first product failure and later state or recovery events.

    If it fails: Increase the bounded time window and verify the Event Log source shown on the Event ID page.

  3. Perform one uniquely identifiable product test through the same service, rule, or action.

    Expected result: The intended destination records the test exactly once.

    If it fails: Collect the first new product event and bounded debug output; do not change unrelated settings.

Verify the result#

Repeat the affected operation, confirm its positive output, and verify that queues, collection positions, or remote delivery continue normally.

Evidence to collect#

  • The complete Event Log entry and neighboring product events with timestamps.

  • The command output, relevant configuration export, and bounded debug log from the same interval.