Event Viewer records what Windows, drivers, services, and applications are doing behind the scenes. It looks overwhelming because normal background activity sits beside real errors, but the right log and filters make it useful quickly.
This guide applies to Windows 10 and Windows 11 using the built-in Event Viewer app.
Does This Affect You?
Use Event Viewer when a PC crashes, restarts unexpectedly, freezes, throws a vague error, or when a support person asks for a log. It gives each event a time, source, level, and event ID, which makes troubleshooting far more specific than guessing.
Open Event Viewer and Check the System Log
The System log is the best first stop for hardware, startup, driver, power, and crash-related entries.
- Click Start, type Event Viewer, and open it.
- In the left pane, expand Windows Logs and click System.
- Look at the Level column. Start with Error and Critical entries. Ignore routine Information entries unless you have a reason to inspect them.
- Sort by Date and Time so the newest events appear first.
- Find an error from the same time as the crash, freeze, shutdown, or driver issue. Double-click it.
- Read the General tab and note the Source and Event ID. Searching those together with your symptom often points to the right fix.
Filter the Log to Remove Noise
Filtering is the difference between useful troubleshooting and scrolling through thousands of harmless entries.
- With System selected, click Filter Current Log in the right Actions panel. Use Application instead if a specific app is crashing.
- Under Event level, check Critical, Error, and optionally Warning.
- Set Logged to a useful range such as the last hour, last 24 hours, or a custom time range around the problem.
- Enter an Event ID if you already know one, or leave the field blank to see all matching events.
- Click OK and review the shortened list.
Helpful Event Viewer Tips
Save a Reusable View
If you check the same kind of issue often, right-click Custom Views and choose Create Custom View. For example, save a view that shows errors from the last seven days.
Know a Few Common IDs
Event ID 41 from Kernel-Power usually means Windows detected an unexpected shutdown. Event ID 1001 often records bugcheck details after a blue screen. Event ID 6008 means Windows noticed the previous shutdown was not clean.
Export Logs for Help
Right-click a log such as System and choose Save All Events As to export it. That file can be shared with support without giving someone remote access to your computer.
Use the Right Log
System covers Windows components, drivers, power, and hardware. Application covers crashes and faults from individual programs. If one app closes unexpectedly, check Application for entries using that app name as the source.
Sources
- Microsoft Learn: Event Viewer overview
- Microsoft Support: Troubleshoot blue screen errors
- Microsoft Learn: Windows event log reference