The event logs contain the most important information for diagnosing application and operating system failures, determining the health and status of a system and verifying that system and applications are operating properly.

Windows systems store all logs in binary .Evt files and there are three basic event logs: Application (AppEvent.Evt), System (SysEvent.Evt), and Security (SecEvent.Evt). Windows 2000 (and later) servers may contain additional event logs: DNS Server (DNSEvent.Evt), File Replication Service (NtFrs.Evt), and on Active Directory domain controllers, Directory Service (NTDS.Evt).

System log tracks miscellaneous system events like startup, shutdown and events like hardware and controller failures. The Application log is an important source for application status information. When properly integrated with the Windows operating system, applications can report their errors to the Event log by recording an event entry into the Application log. Security log tracks events such as logon, logoff, changes to access rights, and system startup and shutdown.

Windows event logs can be useful for ;

-Securing your network from internal attacks

-Monitoring availability of your critical applications

-Centralized eventlog management integrated with your network monitoring software