{"id":21798,"date":"2026-09-13T16:31:50","date_gmt":"2026-09-13T13:01:50","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/windows\/%d8%a2%d9%85%d9%88%d8%b2%d8%b4-%d8%a8%d8%b1%d8%b1%d8%b3%db%8c-system-log-%d8%af%d8%b1-windows-server\/"},"modified":"2026-09-13T16:44:21","modified_gmt":"2026-09-13T13:14:21","slug":"windows-server-system-log-review","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/windows\/windows-server-system-log-review\/","title":{"rendered":"\u0622\u0645\u0648\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc System Log \u062f\u0631 Windows Server"},"content":{"rendered":"\n

\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n

\u062f\u0631 Windows Server \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0627\u062a\u0641\u0627\u0642\u0627\u062a \u0645\u0647\u0645 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u060c \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u060c Driver\u0647\u0627\u060c Storage\u060c Network\u060c Shutdown \u0648 Restart \u062f\u0631 Windows Event Log<\/strong> \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n

\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Log\u0647\u0627 \u0628\u0631\u0627\u06cc \u0639\u06cc\u0628\u200c\u06cc\u0627\u0628\u06cc \u0633\u0631\u0648\u0631:<\/p>\n\n\n\n

System\n<\/code><\/pre>\n\n\n\n
\u0627\u0633\u062a.<\/p>\n\n\n\n
Event Viewer \u0627\u0628\u0632\u0627\u0631 \u062f\u0627\u062e\u0644\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u06cc\u0646 Event\u0647\u0627 \u0627\u0633\u062a \u0648 Windows Event Log \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0648 \u0633\u062e\u062a\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0645\u0631\u06a9\u0632 \u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
\u062f\u0631 \u0627\u06cc\u0646 \u0622\u0645\u0648\u0632\u0634 \u0631\u0648\u0634 \u0628\u0631\u0631\u0633\u06cc System Log \u062f\u0631 Windows Server 2025<\/strong> \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 Event Viewer\u060c PowerShell \u0648 wevtutil<\/code> \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n
\n\n\n\n
System Log \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n
System Log \u0634\u0627\u0645\u0644 Event\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u062a\u0648\u0633\u0637 Windows \u0648 \u0627\u062c\u0632\u0627\u06cc \u0633\u0637\u062d \u0633\u06cc\u0633\u062a\u0645 \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u062f\u0631 \u0627\u06cc\u0646 \u0642\u0633\u0645\u062a \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f:<\/p>\n\n\n\n
    \n
  • Startup \u0648 Shutdown<\/li>\n\n\n\n
  • Restart \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647<\/li>\n\n\n\n
  • Service\u0647\u0627<\/li>\n\n\n\n
  • Driver\u0647\u0627<\/li>\n\n\n\n
  • Disk \u0648 Storage<\/li>\n\n\n\n
  • File System<\/li>\n\n\n\n
  • Network Adapter<\/li>\n\n\n\n
  • Windows Time<\/li>\n\n\n\n
  • Kernel<\/li>\n\n\n\n
  • Power<\/li>\n\n\n\n
  • \u0628\u0631\u062e\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc \u0633\u062e\u062a\u200c\u0627\u0641\u0632\u0627\u0631\u06cc<\/li>\n<\/ul>\n\n\n\n
    \u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0647\u0646\u06af\u0627\u0645 Troubleshooting \u0645\u0634\u06a9\u0644\u0627\u062a Windows Server \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0648\u0644\u06cc\u0646 \u0642\u0633\u0645\u062a\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f:<\/p>\n\n\n\n
    Windows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \u0631\u0648\u0634 \u0627\u0648\u0644: \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 Event Viewer \u0627\u0632 Server Manager<\/h1>\n\n\n\n
    \u062f\u0631 Windows Server \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0632 Server Manager \u0648\u0627\u0631\u062f Event Viewer \u0634\u0648\u06cc\u062f.<\/p>\n\n\n\n
    \u0645\u0633\u06cc\u0631:<\/p>\n\n\n\n
    Server Manager\nTools\nEvent Viewer\n<\/code><\/pre>\n\n\n\n
    \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632 \u0634\u062f\u0646 Event Viewer\u060c \u0627\u0632 \u0633\u0645\u062a \u0686\u067e \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Event Viewer (Local)\nWindows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0631\u0648\u0634 \u062f\u0648\u0645: \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 Event Viewer \u0627\u0632 Start<\/h1>\n\n\n\n
    \u062f\u0631 Start \u0639\u0628\u0627\u0631\u062a \u0632\u06cc\u0631 \u0631\u0627 \u062c\u0633\u062a\u062c\u0648 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Event Viewer\n<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633 \u0628\u0631\u0646\u0627\u0645\u0647 Event Viewer \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0639\u062f \u0648\u0627\u0631\u062f:<\/p>\n\n\n\n
    Windows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u0634\u0648\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0631\u0648\u0634 \u0633\u0648\u0645: \u0627\u062c\u0631\u0627\u06cc \u0645\u0633\u062a\u0642\u06cc\u0645 Event Viewer<\/h1>\n\n\n\n
    \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc:<\/p>\n\n\n\n
    Win + R\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0632\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    eventvwr.msc\n<\/code><\/pre>\n\n\n\n
    \u0648 Enter \u0628\u0632\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0627\u06cc\u0646 \u0631\u0648\u0634 \u06cc\u06a9\u06cc \u0627\u0632 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627 \u0628\u0631\u0627\u06cc \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 Event Viewer \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0648\u0631\u0648\u062f \u0628\u0647 System Log<\/h1>\n\n\n\n
    \u0628\u0639\u062f \u0627\u0632 \u0628\u0627\u0632 \u0634\u062f\u0646 Event Viewer \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Event Viewer (Local)\nWindows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u062f\u0631 \u0642\u0633\u0645\u062a \u0645\u0631\u06a9\u0632\u06cc Event\u0647\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \u0647\u0631 Event \u0634\u0627\u0645\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0627\u0633\u062a:<\/p>\n\n\n\n
    \u0633\u062a\u0648\u0646<\/th>\u062a\u0648\u0636\u06cc\u062d<\/th><\/tr><\/thead>
    Level<\/td>\u0633\u0637\u062d Event<\/td><\/tr>
    Date and Time<\/td>\u0632\u0645\u0627\u0646 \u0631\u062e\u062f\u0627\u062f<\/td><\/tr>
    Source<\/td>\u0633\u0631\u0648\u06cc\u0633 \u06cc\u0627 Component \u0627\u06cc\u062c\u0627\u062f\u06a9\u0646\u0646\u062f\u0647 Event<\/td><\/tr>
    Event ID<\/td>\u0634\u0646\u0627\u0633\u0647 Event<\/td><\/tr>
    Task Category<\/td>\u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc Event<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    Event Level \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n
    Event\u0647\u0627\u06cc Windows \u062f\u0627\u0631\u0627\u06cc Level\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n
    Level<\/th>\u0645\u0641\u0647\u0648\u0645<\/th><\/tr><\/thead>
    Critical<\/td>\u0645\u0634\u06a9\u0644 \u0628\u0633\u06cc\u0627\u0631 \u062c\u062f\u06cc<\/td><\/tr>
    Error<\/td>\u062e\u0637\u0627\u06cc\u06cc \u06a9\u0647 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0627\u0631\u062f<\/td><\/tr>
    Warning<\/td>\u0647\u0634\u062f\u0627\u0631 \u06cc\u0627 \u0634\u0631\u0627\u06cc\u0637 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc<\/td><\/tr>
    Information<\/td>\u0631\u0648\u06cc\u062f\u0627\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0639\u0627\u062f\u06cc<\/td><\/tr>
    Verbose<\/td>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0633\u06cc\u0627\u0631 \u062c\u0632\u0626\u06cc<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \u0628\u0631\u0627\u06cc Troubleshooting \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0628\u062a\u062f\u0627 \u0628\u0627\u06cc\u062f \u0631\u0648\u06cc \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062a\u0645\u0631\u06a9\u0632 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Critical\nError\nWarning\n<\/code><\/pre>\n\n\n\n
    \u0627\u0645\u0627 \u0648\u062c\u0648\u062f \u06cc\u06a9 Error \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0628\u0647 \u0627\u06cc\u0646 \u0645\u0639\u0646\u06cc \u0646\u06cc\u0633\u062a \u06a9\u0647 Server \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u0645\u0634\u06a9\u0644 \u062c\u062f\u06cc \u062f\u0627\u0631\u062f. \u0628\u0627\u06cc\u062f \u0632\u0645\u0627\u0646 Event\u060c Source\u060c Event ID \u0648 Message<\/strong> \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 \u062c\u0632\u0626\u06cc\u0627\u062a \u06cc\u06a9 Event<\/h1>\n\n\n\n
    \u0631\u0648\u06cc Event \u0645\u0648\u0631\u062f\u0646\u0638\u0631 Double Click \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u062f\u0648 Tab \u0627\u0635\u0644\u06cc \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n
    General\nDetails\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u062a\u0628 General<\/h1>\n\n\n\n
    \u062f\u0631:<\/p>\n\n\n\n
    General\n<\/code><\/pre>\n\n\n\n
    \u062a\u0648\u0636\u06cc\u062d \u0642\u0627\u0628\u0644 \u062e\u0648\u0627\u0646\u062f\u0646 Event \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062f\u06cc\u062f\u0647 \u0634\u0648\u062f:<\/p>\n\n\n\n
    The service terminated unexpectedly.\n<\/code><\/pre>\n\n\n\n
    \u06cc\u0627:<\/p>\n\n\n\n
    The system has rebooted without cleanly shutting down first.\n<\/code><\/pre>\n\n\n\n
    \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Log Name\nSource\nEvent ID\nLevel\nTime Created\nMessage\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u062a\u0628 Details<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0641\u0646\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0648\u0627\u0631\u062f:<\/p>\n\n\n\n
    Details\n<\/code><\/pre>\n\n\n\n
    \u0634\u0648\u06cc\u062f.<\/p>\n\n\n\n
    \u062f\u0648 \u062d\u0627\u0644\u062a \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n
    Friendly View\nXML View\n<\/code><\/pre>\n\n\n\n
    \u062d\u0627\u0644\u062a XML \u0645\u062e\u0635\u0648\u0635\u0627\u064b \u0647\u0646\u06af\u0627\u0645 Troubleshooting \u062a\u062e\u0635\u0635\u06cc \u06cc\u0627 \u0627\u0631\u0633\u0627\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0631\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u06cc\u0644\u062a\u0631 \u06a9\u0631\u062f\u0646 System Log<\/h1>\n\n\n\n
    \u0631\u0648\u06cc:<\/p>\n\n\n\n
    System\n<\/code><\/pre>\n\n\n\n
    \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0627\u0632 \u067e\u0646\u0644 \u0633\u0645\u062a \u0631\u0627\u0633\u062a:<\/p>\n\n\n\n
    Filter Current Log...\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    Microsoft \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Event\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Filter Current Log<\/strong> \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Event\u0647\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Source \u06cc\u0627 \u0645\u0634\u062e\u0635\u0627\u062a \u062f\u06cc\u06af\u0631 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u06cc\u0644\u062a\u0631 \u0628\u0631\u0627\u0633\u0627\u0633 Event Level<\/h1>\n\n\n\n
    \u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n
    Event level\n<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u06af\u0632\u06cc\u0646\u0647\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Critical\nError\nWarning\nInformation\nVerbose\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc \u0645\u0647\u0645 \u0645\u0639\u0645\u0648\u0644\u0627\u064b:<\/p>\n\n\n\n
    Critical\nError\nWarning\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u06cc\u0644\u062a\u0631 \u0628\u0631\u0627\u0633\u0627\u0633 \u0632\u0645\u0627\u0646<\/h1>\n\n\n\n
    \u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n
    Logged\n<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f Event\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 \u0632\u0645\u0627\u0646 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    Last hour\nLast 12 hours\nLast 24 hours\nLast 7 days\nCustom range\n<\/code><\/pre>\n\n\n\n
    \u0627\u06af\u0631 \u06a9\u0627\u0631\u0628\u0631 \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 Server \u0633\u0627\u0639\u062a \u0645\u0634\u062e\u0635\u06cc Restart \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Event\u0647\u0627\u06cc \u0647\u0645\u0627\u0646 \u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u06cc\u0644\u062a\u0631 \u0628\u0631\u0627\u0633\u0627\u0633 Event ID<\/h1>\n\n\n\n
    \u062f\u0631 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n
    <All Event IDs>\n<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u06cc\u06a9 \u06cc\u0627 \u0686\u0646\u062f Event ID \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    41,1074,6006,6008\n<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 \u0631\u0648\u0634 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Shutdown \u0648 Restart \u0633\u0631\u0648\u0631 \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0686\u0646\u062f Event ID \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u062f\u0631 System Log<\/h1>\n\n\n\n
    Event ID<\/th>Source \u0631\u0627\u06cc\u062c<\/th>\u06a9\u0627\u0631\u0628\u0631\u062f<\/th><\/tr><\/thead>
    41<\/code><\/td>Kernel-Power<\/td>Restart \u06cc\u0627 Shutdown \u0628\u062f\u0648\u0646 \u062e\u0627\u0645\u0648\u0634 \u0634\u062f\u0646 \u0635\u062d\u06cc\u062d<\/td><\/tr>
    1074<\/code><\/td>User32<\/td>Shutdown \u06cc\u0627 Restart \u062a\u0648\u0633\u0637 User \u06cc\u0627 Process<\/td><\/tr>
    6005<\/code><\/td>EventLog<\/td>\u0634\u0631\u0648\u0639 Windows Event Log Service<\/td><\/tr>
    6006<\/code><\/td>EventLog<\/td>\u062a\u0648\u0642\u0641 Windows Event Log Service<\/td><\/tr>
    6008<\/code><\/td>EventLog<\/td>Shutdown \u0642\u0628\u0644\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a<\/td><\/tr>
    7031<\/code><\/td>Service Control Manager<\/td>Service \u0628\u0647\u200c\u0637\u0648\u0631 \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u062a\u0648\u0642\u0641 \u0634\u062f\u0647<\/td><\/tr>
    7034<\/code><\/td>Service Control Manager<\/td>Service \u0628\u062f\u0648\u0646 \u0627\u0639\u0644\u0627\u0645 \u0635\u062d\u06cc\u062d \u0645\u062a\u0648\u0642\u0641 \u0634\u062f\u0647<\/td><\/tr>
    7045<\/code><\/td>Service Control Manager<\/td>\u0646\u0635\u0628 \u06cc\u06a9 Service \u062c\u062f\u06cc\u062f<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Event ID \u0628\u0627\u06cc\u062f \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 Source \u0648 Message \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f \u0648 \u0646\u0628\u0627\u06cc\u062f \u0635\u0631\u0641\u0627\u064b \u0628\u0631\u0627\u0633\u0627\u0633 \u0634\u0645\u0627\u0631\u0647 Event \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u062b\u0627\u0644: \u0628\u0631\u0631\u0633\u06cc Restart \u0646\u0627\u06af\u0647\u0627\u0646\u06cc Server<\/h1>\n\n\n\n
    \u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Server \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0646\u0627\u06af\u0647\u0627\u0646\u06cc Restart \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \u0648\u0627\u0631\u062f:<\/p>\n\n\n\n
    Event Viewer\nWindows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u0634\u0648\u06cc\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633:<\/p>\n\n\n\n
    Filter Current Log\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u062f\u0631 Event ID \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    41,1074,6006,6008\n<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633 \u0632\u0645\u0627\u0646 \u0631\u062e\u062f\u0627\u062f\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0627\u06af\u0631:<\/p>\n\n\n\n
    Event ID 1074\n<\/code><\/pre>\n\n\n\n
    \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Process \u06cc\u0627 User \u0622\u063a\u0627\u0632\u06a9\u0646\u0646\u062f\u0647 Shutdown\/Restart \u0631\u0627 \u062f\u0631 Message \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n
    \u0627\u06af\u0631:<\/p>\n\n\n\n
    Event ID 41\n<\/code><\/pre>\n\n\n\n
    \u0648:<\/p>\n\n\n\n
    Event ID 6008\n<\/code><\/pre>\n\n\n\n
    \u062f\u0631 \u0647\u0645\u0627\u0646 \u0628\u0627\u0632\u0647 \u062f\u06cc\u062f\u0647 \u0634\u0648\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f Power Failure\u060c Crash\u060c Hypervisor\u060c Reset \u06cc\u0627 \u062a\u0648\u0642\u0641 \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc \u062e\u0637\u0627\u06cc Service\u0647\u0627<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u0634\u06a9\u0644\u0627\u062a Service\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f System Log \u0631\u0627 \u0628\u0627 Source \u0632\u06cc\u0631 Filter \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Service Control Manager\n<\/code><\/pre>\n\n\n\n
    \u062f\u0631:<\/p>\n\n\n\n
    Event sources\n<\/code><\/pre>\n\n\n\n
    \u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n
    Service Control Manager\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    Event\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Start\u060c Stop \u0648 Failure \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u062e\u0648\u0627\u0647\u0646\u062f \u0634\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u062b\u0627\u0644 \u0628\u0631\u0631\u0633\u06cc Crash \u06cc\u06a9 Service<\/h1>\n\n\n\n
    \u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u06cc\u06a9 Service \u0645\u0631\u062a\u0628 Stop \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    Event\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n
    7031\n7034\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u062f\u0631 General \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0627\u0645 Service \u0646\u06cc\u0632 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633 \u0648\u0636\u0639\u06cc\u062a \u0633\u0631\u0648\u06cc\u0633 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Get-Service -Name SERVICE_NAME\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    Get-Service -Name W32Time\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc Disk \u0648 Storage<\/h1>\n\n\n\n
    \u0627\u06af\u0631 Server \u0628\u0627 \u0645\u0634\u06a9\u0644\u0627\u062a Disk\u060c RAID\u060c Storage \u06cc\u0627 File System \u0645\u0648\u0627\u062c\u0647 \u0627\u0633\u062a\u060c System Log \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Source\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Source\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u0646\u062f:<\/p>\n\n\n\n
    Disk\nNtfs\nstorahci\nstornvme\nstorport\nvolmgr\n<\/code><\/pre>\n\n\n\n
    \u0648\u062c\u0648\u062f Error \u06cc\u0627 Warning \u0645\u06a9\u0631\u0631 \u0627\u0632 Storage Source\u0647\u0627 \u0628\u0627\u06cc\u062f \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 Event Message\u060c \u0648\u0636\u0639\u06cc\u062a Disk\u060c RAID Controller\u060c Hypervisor \u0648 Hardware \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc Network<\/h1>\n\n\n\n
    \u062f\u0631 \u0645\u0634\u06a9\u0644\u0627\u062a Network \u0646\u06cc\u0632 System Log \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Adapter\u060c Driver \u06cc\u0627 TCP\/IP \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n
    \u0628\u0647 \u0632\u0645\u0627\u0646 \u0642\u0637\u0639\u06cc \u0634\u0628\u06a9\u0647 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f \u0648 Event\u0647\u0627\u06cc \u0647\u0645\u0627\u0646 \u062f\u0642\u06cc\u0642\u0647 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u062f\u0631 Event Source \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 Component\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0628\u0627\u0634\u06cc\u062f:<\/p>\n\n\n\n
    Tcpip\nNetwork Adapter\nNDIS\nDNS Client\n<\/code><\/pre>\n\n\n\n
    Source \u062f\u0642\u06cc\u0642 \u0628\u0633\u062a\u0647 \u0628\u0647 Driver \u0648 \u0646\u0633\u062e\u0647 Windows \u0645\u062a\u0641\u0627\u0648\u062a \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0631\u062a\u0628\u200c\u0633\u0627\u0632\u06cc Event\u0647\u0627<\/h1>\n\n\n\n
    \u062f\u0631 Event Viewer \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0631\u0648\u06cc \u0633\u062a\u0648\u0646:<\/p>\n\n\n\n
    Date and Time\n<\/code><\/pre>\n\n\n\n
    \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f \u062a\u0627 Event\u0647\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 \u0632\u0645\u0627\u0646 \u0645\u0631\u062a\u0628 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc Troubleshooting \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc\u0646 Event\u0647\u0627 \u062f\u0631 \u0628\u0627\u0644\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Event \u0645\u0634\u062e\u0635<\/h1>\n\n\n\n
    \u0627\u0632 \u0633\u0645\u062a \u0631\u0627\u0633\u062a \u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n
    Find...\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0639\u0628\u0627\u0631\u062a \u0632\u06cc\u0631 \u0631\u0627 \u062c\u0633\u062a\u062c\u0648 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    disk\n<\/code><\/pre>\n\n\n\n
    \u06cc\u0627:<\/p>\n\n\n\n
    shutdown\n<\/code><\/pre>\n\n\n\n
    \u06cc\u0627 \u0646\u0627\u0645 Service:<\/p>\n\n\n\n
    W32Time\n<\/code><\/pre>\n\n\n\n
    \u0627\u06cc\u0646 \u0631\u0648\u0634 \u0628\u0631\u0627\u06cc Log\u0647\u0627\u06cc \u062d\u062c\u06cc\u0645 \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0627\u06cc\u062c\u0627\u062f Custom View<\/h1>\n\n\n\n
    \u0627\u06af\u0631 \u0645\u0631\u062a\u0628\u0627\u064b Event\u0647\u0627\u06cc \u062e\u0627\u0635\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u062f \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0632:<\/p>\n\n\n\n
    Create Custom View...\n<\/code><\/pre>\n\n\n\n
    \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u06cc\u06a9 View \u0628\u0633\u0627\u0632\u06cc\u062f \u06a9\u0647 \u0641\u0642\u0637 Event\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u062f:<\/p>\n\n\n\n
    Log: System\nLevel: Critical, Error, Warning\n<\/code><\/pre>\n\n\n\n
    \u06cc\u0627 \u0641\u0642\u0637 Event\u0647\u0627\u06cc \u06cc\u06a9 Service \u062e\u0627\u0635.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0633\u06cc\u0631 \u0641\u0627\u06cc\u0644 System Log<\/h1>\n\n\n\n
    \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Event Log \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f:<\/p>\n\n\n\n
    C:\\Windows\\System32\\winevt\\Logs\n<\/code><\/pre>\n\n\n\n
    System Log \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631 \u0641\u0627\u06cc\u0644 \u0632\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n
    C:\\Windows\\System32\\winevt\\Logs\\System.evtx\n<\/code><\/pre>\n\n\n\n
    Microsoft \u0646\u06cc\u0632 \u0645\u0633\u06cc\u0631 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 Event Log\u0647\u0627 \u0631\u0627 \u062f\u0631 %SystemRoot%\\System32\\winevt\\Logs<\/code> \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Export \u06af\u0631\u0641\u062a\u0646 \u0627\u0632 System Log<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 Log \u0628\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u06cc\u0627 \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u0646\u0633\u062e\u0647 \u0622\u0646:<\/p>\n\n\n\n
    \u0631\u0648\u06cc:<\/p>\n\n\n\n
    System\n<\/code><\/pre>\n\n\n\n
    Right Click \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633:<\/p>\n\n\n\n
    Save All Events As...\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0641\u0631\u0645\u062a \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc:<\/p>\n\n\n\n
    .evtx\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    System-2026-09-13.evtx\n<\/code><\/pre>\n\n\n\n
    \u0641\u0631\u0645\u062a EVTX \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u06a9\u0627\u0645\u0644 Event\u0647\u0627 \u0631\u0627 \u062d\u0641\u0638 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062a\u062e\u0635\u0635\u06cc \u0645\u0646\u0627\u0633\u0628\u200c\u062a\u0631 \u0627\u0632 Screenshot \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    Export \u0628\u0627 Command Line<\/h1>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0627 wevtutil<\/code> \u0646\u06cc\u0632 System Log \u0631\u0627 Export \u06a9\u0631\u062f.<\/p>\n\n\n\n
    \u0627\u0628\u062a\u062f\u0627 Folder \u0628\u0633\u0627\u0632\u06cc\u062f:<\/p>\n\n\n\n
    New-Item -ItemType Directory -Path C:\\EventLogs -Force\n<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633:<\/p>\n\n\n\n
    wevtutil epl System C:\\EventLogs\\System.evtx\n<\/code><\/pre>\n\n\n\n
    Microsoft \u0627\u0639\u0644\u0627\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f wevtutil<\/code> \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc Query\u060c Export\u060c Archive \u0648 \u0645\u062f\u06cc\u0631\u06cc\u062a Event Log\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f \u0648 \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u0631\u0648\u06cc Windows Server 2025 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc System Log \u0628\u0627 PowerShell<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0622\u062e\u0631\u06cc\u0646 Event\u0647\u0627\u06cc System:<\/p>\n\n\n\n
    Get-WinEvent -LogName System -MaxEvents 50\n<\/code><\/pre>\n\n\n\n
    Get-WinEvent<\/code> \u0627\u0645\u06a9\u0627\u0646 \u062f\u0631\u06cc\u0627\u0641\u062a Event\u0647\u0627 \u0627\u0632 Log\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f System \u0648 Application \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 Event\u0647\u0627 \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u0627\u0632 \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc\u0646 \u0628\u0647 \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631\u06cc\u0646 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0646\u0645\u0627\u06cc\u0634 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645 Event\u0647\u0627<\/h1>\n\n\n\n
    Get-WinEvent -LogName System -MaxEvents 20 |\nSelect-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u062e\u0648\u0627\u0646\u0627\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631:<\/p>\n\n\n\n
    Get-WinEvent -LogName System -MaxEvents 20 |\nSelect-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message |\nFormat-List\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 Error \u0648 Warning\u0647\u0627\u06cc 24 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    Level = 1,2,3\n    StartTime = (Get-Date).AddHours(-24)\n} |\nSelect-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message\n<\/code><\/pre>\n\n\n\n
    Level\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647:<\/p>\n\n\n\n
    1 = Critical\n2 = Error\n3 = Warning\n4 = Information\n5 = Verbose\n<\/code><\/pre>\n\n\n\n
    Microsoft \u0628\u0631\u0627\u06cc Query\u0647\u0627\u06cc \u0628\u0647\u06cc\u0646\u0647 \u062f\u0631 Get-WinEvent<\/code> \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 FilterHashtable<\/code> \u0631\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f LogName<\/code>\u060c ID<\/code>\u060c Level<\/code>\u060c StartTime<\/code> \u0648 ProviderName<\/code> \u0631\u0627 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Event ID \u0645\u0634\u062e\u0635 \u0628\u0627 PowerShell<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 Event ID 41<\/code>:<\/p>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    Id = 41\n} -MaxEvents 20\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc \u0686\u0646\u062f Event ID \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Restart<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    Id = 41,1074,6006,6008\n} |\nSelect-Object TimeCreated, Id, ProviderName, Message |\nFormat-List\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Service Control Manager<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    ProviderName = 'Service Control Manager'\n    StartTime = (Get-Date).AddDays(-1)\n} |\nSelect-Object TimeCreated, Id, LevelDisplayName, Message |\nFormat-List\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0642\u0637 Error\u0647\u0627\u06cc System<\/h1>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    Level = 2\n} -MaxEvents 50\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Log \u0628\u0627 wevtutil<\/h1>\n\n\n\n
    \u0646\u0645\u0627\u06cc\u0634 \u0622\u062e\u0631\u06cc\u0646 20 Event:<\/p>\n\n\n\n
    wevtutil qe System \/c:20 \/rd:true \/f:text\n<\/code><\/pre>\n\n\n\n
    \u067e\u0627\u0631\u0627\u0645\u062a\u0631:<\/p>\n\n\n\n
    \/rd:true\n<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u062c\u062f\u06cc\u062f\u062a\u0631\u06cc\u0646 Event\u0647\u0627 \u0627\u0628\u062a\u062f\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a System Log<\/h1>\n\n\n\n
    wevtutil gl System\n<\/code><\/pre>\n\n\n\n
    \u0628\u0627 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n
    enabled\nretention\nmaxSize\nlogFileName\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc \u0627\u0646\u062f\u0627\u0632\u0647 Log<\/h1>\n\n\n\n
    \u062f\u0631 Event Viewer \u0631\u0648\u06cc:<\/p>\n\n\n\n
    System\n<\/code><\/pre>\n\n\n\n
    Right Click \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633:<\/p>\n\n\n\n
    Properties\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0645\u0648\u0627\u0631\u062f \u0645\u0647\u0645:<\/p>\n\n\n\n
    Log path\nCurrent log size\nMaximum log size\n<\/code><\/pre>\n\n\n\n
    \u0647\u0645\u0686\u0646\u06cc\u0646 \u0646\u062d\u0648\u0647 \u0631\u0641\u062a\u0627\u0631 \u0647\u0646\u06af\u0627\u0645 \u067e\u0631 \u0634\u062f\u0646 Log \u0642\u0627\u0628\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0627\u0641\u0632\u0627\u06cc\u0634 Maximum Log Size<\/h1>\n\n\n\n
    \u062f\u0631 Server\u0647\u0627\u06cc \u067e\u0631\u062a\u0631\u0627\u0641\u06cc\u06a9 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a System Log \u062e\u06cc\u0644\u06cc \u0633\u0631\u06cc\u0639 Overwrite \u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0627\u0632:<\/p>\n\n\n\n
    System\nProperties\n<\/code><\/pre>\n\n\n\n
    \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0645\u0642\u062f\u0627\u0631:<\/p>\n\n\n\n
    Maximum log size\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0647\u06cc\u062f.<\/p>\n\n\n\n
    \u0645\u0642\u062f\u0627\u0631 \u0645\u0646\u0627\u0633\u0628 \u0628\u0647 \u062d\u062c\u0645 Event\u0647\u0627\u060c \u0641\u0636\u0627\u06cc Disk \u0648 \u0633\u06cc\u0627\u0633\u062a \u0646\u06af\u0647\u062f\u0627\u0631\u06cc Log \u0633\u0627\u0632\u0645\u0627\u0646 \u0628\u0633\u062a\u06af\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    Clear \u06a9\u0631\u062f\u0646 System Log<\/h1>\n\n\n\n
    \u062f\u0631 \u0634\u0631\u0627\u06cc\u0637 \u0639\u0627\u062f\u06cc System Log \u0631\u0627 \u0628\u062f\u0648\u0646 \u062f\u0644\u06cc\u0644 \u067e\u0627\u06a9 \u0646\u06a9\u0646\u06cc\u062f<\/strong>\u060c \u0632\u06cc\u0631\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645 Troubleshooting \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u0648\u062f.<\/p>\n\n\n\n
    \u0627\u06af\u0631 \u0648\u0627\u0642\u0639\u0627\u064b \u0646\u06cc\u0627\u0632 \u0628\u0647 Clear \u06a9\u0631\u062f\u0646 Log \u062f\u0627\u0631\u06cc\u062f\u060c \u0627\u0628\u062a\u062f\u0627 Export \u062a\u0647\u06cc\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    wevtutil epl System C:\\EventLogs\\System-Before-Clear.evtx\n<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Log \u0631\u0627 Clear \u06a9\u0631\u062f:<\/p>\n\n\n\n
    wevtutil cl System\n<\/code><\/pre>\n\n\n\n
    wevtutil<\/code> \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0631\u0633\u0645\u06cc \u0642\u0627\u0628\u0644\u06cc\u062a Clear \u06a9\u0631\u062f\u0646 Event Log \u0631\u0627 \u0646\u06cc\u0632 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc System Log \u06cc\u06a9 Server \u062f\u06cc\u06af\u0631<\/h1>\n\n\n\n
    \u062f\u0631 Event Viewer \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0632:<\/p>\n\n\n\n
    Action\nConnect to Another Computer...\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0627\u062a\u0635\u0627\u0644 \u0628\u0647 Event Log \u06cc\u06a9 Windows Server \u062f\u06cc\u06af\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0627\u0631 Account \u0634\u0645\u0627 \u0628\u0627\u06cc\u062f Permission \u0644\u0627\u0632\u0645 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u0648 \u0627\u0631\u062a\u0628\u0627\u0637 \u0634\u0628\u06a9\u0647 \u0648 Firewall \u0627\u062c\u0627\u0632\u0647 Remote Event Log Management \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0628\u0631\u0631\u0633\u06cc Remote System Log \u0628\u0627 PowerShell<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n
    Get-WinEvent -ComputerName SERVER01 -LogName System -MaxEvents 50\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645:<\/p>\n\n\n\n
    Get-WinEvent -ComputerName SERVER01 -LogName System -MaxEvents 50 |\nSelect-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message\n<\/code><\/pre>\n\n\n\n
    Get-WinEvent<\/code> \u0627\u0645\u06a9\u0627\u0646 \u062f\u0631\u06cc\u0627\u0641\u062a Event\u0647\u0627 \u0627\u0632 Computer\u0647\u0627\u06cc Remote \u0631\u0627 \u0646\u06cc\u0632 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    System Log \u0628\u0627 Application Log \u0686\u0647 \u062a\u0641\u0627\u0648\u062a\u06cc \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n
    Log<\/th>\u06a9\u0627\u0631\u0628\u0631\u062f \u0627\u0635\u0644\u06cc<\/th><\/tr><\/thead>
    System<\/td>Windows\u060c Driver\u0647\u0627\u060c Service\u0647\u0627 \u0648 Hardware<\/td><\/tr>
    Application<\/td>\u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0648 Application\u0647\u0627<\/td><\/tr>
    Security<\/td>Audit\u060c Login \u0648 Security Events<\/td><\/tr>
    Setup<\/td>\u0646\u0635\u0628 \u0648 Setup Component\u0647\u0627<\/td><\/tr>
    Forwarded Events<\/td>Event\u0647\u0627\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a\u200c\u0634\u062f\u0647 \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \u0627\u06af\u0631 \u0645\u0634\u06a9\u0644 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u062e\u0648\u062f Application \u0628\u0627\u0634\u062f\u060c \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 System Log \u0628\u0627\u06cc\u062f:<\/p>\n\n\n\n
    Windows Logs\nApplication\n<\/code><\/pre>\n\n\n\n
    \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc \u06cc\u06a9 \u0645\u0634\u06a9\u0644 \u0627\u0632 \u06a9\u062c\u0627 \u0634\u0631\u0648\u0639 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n
    \u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u06a9\u0627\u0631\u0628\u0631 \u0645\u06cc\u200c\u06af\u0648\u06cc\u062f:<\/p>\n\n\n\n
    The server restarted at approximately 02:30 AM.\n<\/code><\/pre>\n\n\n\n
    \u0627\u0628\u062a\u062f\u0627 \u0632\u0645\u0627\u0646 \u062f\u0642\u06cc\u0642 \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0633\u067e\u0633:<\/p>\n\n\n\n
    Event Viewer\nWindows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    Filter \u0631\u0627 \u0631\u0648\u06cc \u0628\u0627\u0632\u0647 \u0632\u0645\u0627\u0646\u06cc \u0647\u0645\u0627\u0646 \u0633\u0627\u0639\u062a \u0642\u0631\u0627\u0631 \u062f\u0647\u06cc\u062f \u0648 \u0627\u0628\u062a\u062f\u0627 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Critical\nError\nWarning\n<\/code><\/pre>\n\n\n\n
    \u0633\u067e\u0633 Event\u0647\u0627\u06cc \u0642\u0628\u0644 \u0648 \u0628\u0639\u062f \u0627\u0632 \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0646\u06cc\u0632 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f \u0639\u0644\u062a \u0627\u0635\u0644\u06cc \u062f\u0642\u06cc\u0642\u0627\u064b \u0686\u0646\u062f \u062b\u0627\u0646\u06cc\u0647 \u06cc\u0627 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 \u0642\u0628\u0644 \u0627\u0632 Event \u0646\u0647\u0627\u06cc\u06cc \u062b\u0628\u062a \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0641\u0642\u0637 Error \u0646\u0647\u0627\u06cc\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n
    \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0641\u0642\u0637 \u0622\u062e\u0631\u06cc\u0646 Error \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Event \u0632\u06cc\u0631 \u062b\u0628\u062a \u0634\u0648\u062f:<\/p>\n\n\n\n
    Service terminated unexpectedly\n<\/code><\/pre>\n\n\n\n
    \u0627\u0645\u0627 \u0639\u0644\u062a \u0627\u0635\u0644\u06cc \u0686\u0646\u062f \u062b\u0627\u0646\u06cc\u0647 \u0642\u0628\u0644 \u0627\u0632 \u0622\u0646 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n
    Disk\nNetwork\nAuthentication\nDependency\nDriver\n<\/code><\/pre>\n\n\n\n
    \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n
    \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0647\u0645\u06cc\u0634\u0647 Event\u0647\u0627\u06cc \u0642\u0628\u0644 \u0648 \u0628\u0639\u062f \u0627\u0632 \u0632\u0645\u0627\u0646 \u062e\u0637\u0627 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \n\n\n\n
    \u0686\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0628\u0631\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642 \u06cc\u06a9 \u0645\u0634\u06a9\u0644 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0632\u06cc\u0631 \u0627\u0631\u0627\u0626\u0647 \u0634\u0648\u0646\u062f:<\/p>\n\n\n\n
    Server name\nProblem date and time\nEvent Source\nEvent ID\nEvent Level\nGeneral message\nRelated events before and after the error\nSystem.evtx export\n<\/code><\/pre>\n\n\n\n
    \u0627\u06af\u0631 \u0641\u0642\u0637 \u06cc\u06a9 Event \u0645\u0637\u0631\u062d \u0627\u0633\u062a\u060c Screenshot \u0628\u062e\u0634:<\/p>\n\n\n\n
    General\n<\/code><\/pre>\n\n\n\n
    \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u06cc\u0627\u0632:<\/p>\n\n\n\n
    Details\nXML View\n<\/code><\/pre>\n\n\n\n
    \u0646\u06cc\u0632 \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n
    \n\n\n\n
    \u0686\u06a9\u200c\u0644\u06cc\u0633\u062a \u0628\u0631\u0631\u0633\u06cc System Log<\/h1>\n\n\n\n
    \u0645\u0648\u0631\u062f<\/th>\u0628\u0631\u0631\u0633\u06cc<\/th><\/tr><\/thead>
    \u0632\u0645\u0627\u0646 \u062f\u0642\u06cc\u0642 \u0645\u0634\u06a9\u0644 \u0645\u0634\u062e\u0635 \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Windows Logs > System \u0628\u0627\u0632 \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Critical \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Error \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Warning \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Event ID \u062b\u0628\u062a \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Source \u062b\u0628\u062a \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    General Message \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Event\u0647\u0627\u06cc \u0642\u0628\u0644 \u0648 \u0628\u0639\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    Filter Current Log \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr>
    \u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u06cc\u0627\u0632 EVTX Export \u06af\u0631\u0641\u062a\u0647 \u0634\u062f\u0647<\/td>\u2713<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    \u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n
    \u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Windows Event Logging:<\/p>\n\n\n\n
    Event Logging \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n
    \u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Get-WinEvent<\/code>:<\/p>\n\n\n\n
    Get-WinEvent \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n
    \u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Filter \u06a9\u0631\u062f\u0646 Event\u0647\u0627 \u0628\u0627 FilterHashtable<\/code>:<\/p>\n\n\n\n
    Creating Get-WinEvent Queries with FilterHashtable \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n
    \u0645\u0633\u062a\u0646\u062f \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 wevtutil<\/code> \u062f\u0631 Windows Server:<\/p>\n\n\n\n
    wevtutil \u2014 Microsoft Learn<\/a><\/p>\n\n\n\n
    \n\n\n\n
    \u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc System Log \u062f\u0631 Windows Server \u0645\u0633\u06cc\u0631 \u0627\u0635\u0644\u06cc \u0628\u0647 \u0634\u06a9\u0644 \u0632\u06cc\u0631 \u0627\u0633\u062a:<\/p>\n\n\n\n
    Server Manager\nTools\nEvent Viewer\nWindows Logs\nSystem\n<\/code><\/pre>\n\n\n\n
    \u06cc\u0627 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b:<\/p>\n\n\n\n
    eventvwr.msc\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc Troubleshooting \u0627\u0628\u062a\u062f\u0627 \u0632\u0645\u0627\u0646 \u0631\u062e\u062f\u0627\u062f \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0631\u062f\u0647 \u0648 \u0633\u067e\u0633 \u0627\u0632:<\/p>\n\n\n\n
    Filter Current Log\n<\/code><\/pre>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Event\u0647\u0627 \u0628\u0631\u0627\u0633\u0627\u0633:<\/p>\n\n\n\n
    Time\nLevel\nSource\nEvent ID\n<\/code><\/pre>\n\n\n\n
    \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc \u0645\u0647\u0645 \u0627\u0628\u062a\u062f\u0627:<\/p>\n\n\n\n
    Critical\nError\nWarning\n<\/code><\/pre>\n\n\n\n
    \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f \u0648 \u0631\u0648\u06cc \u06cc\u06a9 Event ID \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u0646\u06a9\u0646\u06cc\u062f\u061b Source\u060c Message \u0648 Event\u0647\u0627\u06cc \u0642\u0628\u0644 \u0648 \u0628\u0639\u062f \u0627\u0632 \u0622\u0646 \u0646\u06cc\u0632 \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u0646\u062f<\/strong>.<\/p>\n\n\n\n
    \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u06cc\u0639 \u0627\u0632 PowerShell \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n
    Get-WinEvent -FilterHashtable @{\n    LogName = 'System'\n    Level = 1,2,3\n    StartTime = (Get-Date).AddHours(-24)\n}\n<\/code><\/pre>\n\n\n\n
    \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u0631\u0633\u0627\u0644 Log \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062a\u062e\u0635\u0635\u06cc\u060c \u0641\u0627\u06cc\u0644 System Log \u0631\u0627 \u0628\u0627 \u0641\u0631\u0645\u062a:<\/p>\n\n\n\n
    .evtx\n<\/code><\/pre>\n\n\n\n
    Export \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    \u0645\u0642\u062f\u0645\u0647 \u062f\u0631 Windows Server \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0627\u062a\u0641\u0627\u0642\u0627\u062a \u0645\u0647\u0645 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u060c \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u060c Driver\u0647\u0627\u060c Storage\u060c Network\u060c Shutdown \u0648 Restart \u062f\u0631 Windows Event Log \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Log\u0647\u0627 \u0628\u0631\u0627\u06cc \u0639\u06cc\u0628\u200c\u06cc\u0627\u0628\u06cc \u0633\u0631\u0648\u0631: \u0627\u0633\u062a. Event Viewer \u0627\u0628\u0632\u0627\u0631 \u062f\u0627\u062e\u0644\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u06cc\u0646 Event\u0647\u0627 \u0627\u0633\u062a \u0648 Windows Event Log \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0648 \u0633\u062e\u062a\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0645\u062a\u0645\u0631\u06a9\u0632 \u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f. \u062f\u0631 […]<\/p>\n","protected":false},"author":4,"featured_media":21801,"parent":17708,"menu_order":42,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-21798","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/86d527e9d6c721b378b27e18daa8865e.jpg?ver=1790059220","author_name":"Fateme Moayed","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21798","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=21798"}],"version-history":[{"count":3,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21798\/revisions"}],"predecessor-version":[{"id":21809,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21798\/revisions\/21809"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/21801"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=21798"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=21798"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}