Hacker News Reader

Comment by coldacid | Hacker News Reader

Don't get me started on Windows Event Log. Sure it might be better structured than syslog on paper, but it's even more of a mess. Not to mention that it's really hundreds of logs that just share a similar format and same UI.

View on HN

I would complain more, except I have never ever gotten a useful bit of information out of the Event Log. Not once. It's so laughably useless I'm surprised anybody even bothers anymore. Microsoft certainly doesn't.

When applications on Windows fail they never think to generate an event, not even for something as simple as a "permission denied attempting to open file 'c:\blah'". Instead it's chock full of useless noise from daemons that activate every 2 seconds to poll something and then log that everything is still ok.

Not even Microsoft's core windows applications seem to generate a event log when it has a critical error. If you've disabled a service which part of its 'Settings' application uses, or Microsoft Store requires and it has a critical error then you get an general error message (which the error does not tell you that it requires a service running), but nothing in the event logs. So far event logs have been far more useful for things that aren't errors such as login and startup times for Windows.

Windows itself can generate logs for that!

https://docs.microsoft.com/en-us/windows/security/threat-pro...

Huge numbers of EventIDs, and you'll get different EventIDs from different versions of Windows, and there's no database of THESE ARE THE EVENT IDS WINDOWS USES, you just have to google each one individually.

And mostly the structure isn't really used at all, it's just plain text for a lot of log messages.

Plain text that you cannot even access without a complicated COM control dance in many cases. It's an interesting design for sure.

I have seen and hope to never see again worst cases such as the COM control for all of .NET Framework event log messages (everything from .NET system messages to just the mostly plain text storage from applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable.

"...applications written in .NET) accidentally badly unregistered leaving all of the event log messages unreadable..."

Don't even get me started on this... Microsoft is actually bad for this with even their own .NET-based enterprise applications. As well - it also makes gathering logs from production servers, then performing analysis on a different machine difficult, as that machine will likely have none of the dependencies required.

Text... text and more text, that is universal.

Reply on news.ycombinator.com