Step-by-Step Guide to Accessing Windows Network Logs

Want to analyze your Windows network logs but not sure where to start? Here's a quick guide to help you access, filter, and export network logs using built-in Windows tools like Event Viewer and PowerShell.

How to Access Network Logs Using Event Viewer

Event Viewer provides a user-friendly interface to review network logs on Windows. This built-in tool categorizes logs and includes filtering options, making it easier to pinpoint network issues that could impact your trading activities.

Opening Event Viewer

To open Event Viewer, press Windows+R, type eventvwr, and hit Enter. Alternatively, you can search for "Event Viewer" in the Start Menu and select it. Once open, explore the organized log categories to locate entries related to network activity.

Locating Important Network Logs

Start by checking the System log under Windows Logs for general network events. For more detailed logs, navigate to Applications and Services Logs > Microsoft > Windows > NetworkProfile > Operational. Pay attention to specific Event IDs such as:

• 4004: Indicates network state changes.
• 27: Logs network adapter disconnects.
• 10000: Highlights DCOM-related issues.
• 4042: Found in the NCSI log, often related to connectivity problems.

You can also explore DHCP/Operational logs for additional insights. Once you’ve identified these key logs, use filtering tools to zero in on the most critical events.

Filtering and Customizing Log Views

Since raw logs can be overwhelming, filtering and creating custom views can help you focus on the data that matters most, especially during active trading periods.

To filter logs, right-click a log (e.g., System) and select Filter Current Log. Choose levels like Warning and Information, and enter specific Event IDs such as 27, 4004, 4042, or 10000 to refine your results. For even easier access, create a custom view that combines logs from multiple sources.

Here’s how to set up a custom view:

1. Right-click Custom Views in the Event Viewer tree and select Create Custom View.
2. Use the By log option to include logs from Windows Logs (e.g., System) and relevant Applications and Services Logs (e.g., NetworkProfile/Operational, NCSI, and DHCP/Operational).
3. Save the view with a name like "Trading VPS Network Events" for quick access during trading hours.

"Event ID 27 in Windows Server 2022 typically pertains to a network-related issue, specifically to the network adapter. This event is logged when the network link is disconnected, meaning the network adapter has lost its connection to the network." - ChartVPS

Using these filtering methods, you can turn Event Viewer into a focused diagnostic tool, helping you maintain stable network performance for your VPS during critical trading times.

How to Access and Export Logs Using PowerShell

PowerShell is a powerful tool for automating network monitoring on your VPS. It enables you to script event checks, export logs, and even schedule monitoring tasks, making it an essential resource for maintaining a stable environment.

QuantVPS Windows Server VPS plans give you a Windows Server environment for these tools, with 24/7 US-based support if you get stuck.

Using Get-WinEvent for Advanced Queries

While the Event Viewer provides a graphical interface for accessing logs, PowerShell takes it a step further with the Get-WinEvent cmdlet. This command gives you precise control over log queries, allowing you to focus on specific events, time frames, or log sources.

To get started, open PowerShell with administrative privileges. For example, to view the latest 50 events from the System log, use:

Get-WinEvent -LogName System -MaxEvents 50

If you need to pinpoint specific events, such as network adapter disconnects (Event ID 27), you can filter them like this:

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 27}

To monitor multiple network-related issues, combine Event IDs in a single query:

Get-WinEvent -LogName System | Where-Object {$_.Id -in @(27, 4004, 4042, 10000)}

You can also filter logs by time, which is particularly useful during trading hours. For instance, to see events from the last two hours:

Get-WinEvent -LogName System | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)}

For specialized network logs, you can target specific paths. Here are a couple of examples:

• Network profile changes:

  Get-WinEvent -LogName "Microsoft-Windows-NetworkProfile/Operational"
  

• DHCP-related events:

  Get-WinEvent -LogName "Microsoft-Windows-Dhcp-Client/Operational"
  

Exporting Logs for Analysis

Exporting logs to CSV files is a straightforward way to analyze data offline, share it with support teams, or maintain compliance records. PowerShell makes this process flexible.

To export logs, combine Get-WinEvent with Export-Csv. For example, the following command exports network adapter disconnect events (Event ID 27) and state changes (Event ID 4004) to a CSV file:

Get-WinEvent -LogName System | Where-Object {$_.Id -in @(27, 4004)} | Export-Csv -Path "C:\NetworkLogs\network_events.csv" -NoTypeInformation

If you want to include specific details like timestamps and messages, you can refine the export:

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 27} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\NetworkLogs\disconnect_events.csv" -NoTypeInformation

For daily trading reports, you can combine logs from multiple sources into a single file. This command gathers all network events from the current day and creates a timestamped CSV file:

Get-WinEvent -LogName System, "Microsoft-Windows-NetworkProfile/Operational" | Where-Object {$_.TimeCreated -gt (Get-Date).Date} | Export-Csv -Path "C:\NetworkLogs\daily_network_$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation

Common PowerShell Commands for Traders

Certain PowerShell commands are particularly helpful for traders who rely on stable network performance. Here are a few examples:

• DNS resolution issues:
  Identify errors from the last 30 minutes that might affect trading platform connectivity:

  Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" | Where-Object {$_.TimeCreated -gt (Get-Date).AddMinutes(-30) -and $_.LevelDisplayName -eq "Error"}
  

• Windows Firewall blocks:
  Check if legitimate trading traffic has been blocked in the last hour:

  Get-WinEvent -LogName "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" | Where-Object {$_.Id -eq 5152 -and $_.TimeCreated -gt (Get-Date).AddHours(-1)}
  

• NIC reset events:
  Review network interface card (NIC) disconnections from the past 24 hours:

  Get-WinEvent -LogName System | Where-Object {$_.Id -eq 27 -and $_.TimeCreated -gt (Get-Date).AddDays(-1)} | Select-Object TimeCreated, Message
  

To streamline monitoring, you can combine multiple queries into a single script. For example, this script collects network events from the past four hours and exports them to a timestamped CSV file:

$Events = Get-WinEvent -LogName System | Where-Object {$_.Id -in @(27, 4004) -and $_.TimeCreated -gt (Get-Date).AddHours(-4)}
$Events += Get-WinEvent -LogName "Microsoft-Windows-NetworkProfile/Operational" | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-4)}
$Events | Sort-Object TimeCreated | Export-Csv -Path "C:\NetworkLogs\health_check_$(Get-Date -Format 'HHmm').csv" -NoTypeInformation

For ongoing monitoring, save frequently used commands as.ps1 script files. These scripts can be scheduled to run during non-trading hours, ensuring regular reports without manual effort. This proactive approach keeps your trading environment optimized and stable.

Managing Logs on Trading VPS

Setting Log Retention Policies

Windows Event Logs come with default size limits, which can cause older entries to be overwritten during high-volume trading sessions. For instance, the System log has a default size of 20 MB and overwrites older events when full. This can be problematic during volatile market conditions where preserving logs is critical.

To adjust these settings, open Event Viewer and navigate to the log you want to configure. Right-click System under Windows Logs, select Properties, and modify the maximum log size. Setting the System log size to 100 MB is a good starting point for QuantVPS users.

If compliance is a priority, consider enabling the "Archive the log when full, do not overwrite events" option. This archives logs with timestamps (e.g., Archive-System-2025-08-12-14-30-15-123.evtx) when the log reaches capacity. Keep an eye on disk space, as QuantVPS plans range from 50 GB on VPS Starter to over 2 TB on Dedicated+ Servers.

For those who prefer PowerShell, log retention policies can be adjusted programmatically. Use the following command to set the System log size to 100 MB:

wevtutil sl System /ms:104857600

You can confirm the change with:

wevtutil gl System

Once retention settings are configured, automate log exports to streamline monitoring and analysis.

Automating Log Exports

Optimizing log retention is just the first step; automating log exports ensures you always have access to recent data without manual intervention. Using Windows Task Scheduler, you can schedule PowerShell scripts to run during non-trading hours, preparing logs for pre-market analysis.

Here's an example PowerShell script that exports network events from the previous trading day. Save it as DailyNetworkExport.ps1:

$ExportPath = "C:\TradingLogs\Network_$(Get-Date -Format 'yyyy-MM-dd').csv"
$StartTime = (Get-Date).Date.AddDays(-1).AddHours(9).AddMinutes(30)  # 9:30 AM previous day
$EndTime = (Get-Date).Date.AddDays(-1).AddHours(16)  # 4:00 PM previous day

$NetworkEvents = Get-WinEvent -LogName System | Where-Object {
    $_.Id -in @(27, 4004, 4042) -and 
    $_.TimeCreated -ge $StartTime -and 
    $_.TimeCreated -le $EndTime
}

$NetworkEvents | Select-Object TimeCreated, Id, LevelDisplayName, Message | 
Export-Csv -Path $ExportPath -NoTypeInformation

To schedule this script, open Task Scheduler, create a new task, and set the trigger for 5:00 AM EST daily. Configure the action to execute:

powershell.exe -File "C:\Scripts\DailyNetworkExport.ps1"

For more specialized needs, you can set up separate schedules for different log types. For instance, DNS logs might update every 30 minutes during market hours, while firewall logs could be exported weekly. This approach minimizes performance impact on your trading systems.

Remote Access Considerations

Remote access to logs can be a lifesaver when troubleshooting issues in real-time. Start by enabling PowerShell remoting on your QuantVPS with the following command:

Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "YOUR_LOCAL_IP" -Force

Replace YOUR_LOCAL_IP with your actual IP address. For broader access, you can use *, but keep in mind this reduces security. From your local machine, establish a remote session with:

$Session = New-PSSession -ComputerName "YOUR_VPS_IP" -Credential (Get-Credential)

Once connected, you can query logs without disrupting trading processes. For example, retrieve recent System log events with:

Invoke-Command -Session $Session -ScriptBlock {
    Get-WinEvent -LogName System | Where-Object { $_.Id -eq 27 -and $_.TimeCreated -gt (Get-Date).AddHours(-1) }
}

If you prefer a graphical interface, you can use Computer Management for remote Event Viewer access. Right-click the root node, select Connect to another computer, and enter your VPS IP and credentials.

To enhance security, use strong passwords, restrict IP access, and add firewall rules. For example, limit PowerShell remoting to a specific IP range:

New-NetFirewallRule -DisplayName "PSRemoting-Restricted" -Direction Inbound -Protocol TCP -LocalPort 5985 -RemoteAddress "192.168.1.0/24" -Action Allow

This setup ensures secure remote access while maintaining the integrity of your trading environment.

Conclusion

By leveraging Event Viewer and PowerShell, you can gain a deeper understanding of Windows network log analysis, ensuring your trading environment remains efficient and reliable. Together, these tools allow you to detect and address network issues before they impact your operations.

Key Takeaways

Use Get-WinEvent for advanced log analysis. Microsoft recommends Get-WinEvent because it provides full access to modern Windows Event Log features. This is particularly useful for specialized logs like Microsoft-Windows-NetworkProfile/Operational or Windows Defender Firewall channels.

Combine Event Viewer with PowerShell automation for a well-rounded monitoring approach. Event Viewer helps you familiarize yourself with log structures, locate significant event IDs, and conduct quick visual checks. Meanwhile, PowerShell enables automated exports, precise filtering, and cross-machine queries, making your monitoring process more efficient.

Secure automated exports and retention settings for critical data. Schedule PowerShell exports during off-peak hours using Task Scheduler. A quick morning review of Event Viewer for errors and warnings, alongside automated PowerShell reports (e.g., failed logons with Event ID 4625), ensures you’re prepared for potential issues.

Track trader-specific network events to prevent disruptions. Monitoring these events can help you identify and address issues like platform disconnects or latency spikes before they affect order execution during high-pressure market conditions.

Enable secure remote troubleshooting. Use PowerShell remoting with IP restrictions and Event Viewer’s "Connect to another computer" feature for remote log analysis. This setup is particularly useful during trading hours when direct server access might not be feasible.

As the saying goes, “Prevention is better than cure.” A stable trading environment depends on proactive steps - visually identifying issues in Event Viewer, automating monitoring with Get-WinEvent, and ensuring proper retention settings to keep your systems running smoothly.

Return to the server's network logs

A remote desktop gives you a place to revisit the same server and its diagnostic output. QuantVPS's server workspace dashboard contains the login details, and server support is available 24/7. Keep the network-log timestamps with the connection problem you are investigating.

FAQs

How can I use PowerShell to automatically export and analyze network logs on Windows?

To automate the export of network logs with PowerShell, you can rely on cmdlets like Get-EventLog or Get-WinEvent. These tools let you pull logs from your system and apply filters for specific event types or IDs, so you can zero in on the data that matters most. After narrowing down the results, you can use the Export-Csv cmdlet to save the logs in a CSV format, making them easy to analyze later.

For complete automation, you can pair your PowerShell script with Task Scheduler. This approach ensures that logs are collected on a regular basis, with a single system or multiple servers, including VPS setups. Automating this process not only saves time but also guarantees quick access to critical information when troubleshooting or fine-tuning your trading infrastructure.

What are the advantages of setting up custom views in Event Viewer to monitor network activity?

Setting up custom views in Event Viewer allows you to filter and organize network logs based on specific criteria like event type, source, or time frame. This approach helps you zero in on the most relevant data, making it easier to spot potential issues quickly.

These custom views are particularly valuable in trading environments where time is of the essence. By focusing only on the logs that matter, you can monitor network performance more efficiently, ensuring a stable and secure foundation for trading operations.

How can I make sure important network logs on my VPS aren’t lost during periods of heavy activity?

To avoid losing critical network logs during periods of high activity, consider increasing the maximum size of event logs, like the security log. This adjustment allows the system to store more data, reducing the risk of logs being overwritten too soon.

You should also implement log retention policies to determine how long logs are stored and enable log forwarding to a remote server for secure backups. These measures ensure that essential data is preserved and your trading environment remains stable, even during busy times.