The marvel that is Event Viewer
November 13th, 2007
I recently received an exported event log from our testing department. Usually our tracing is all I need, but in this case where the application in question simply won’t start, it’s kind of hard for the tracing module to initialize. So we had to resort to the event log. Although I don’t use the Event Viewer much, I must say… I’m not a big fan. Everything I’ve seen is a usability nightmare. For example, the log I received started logging events a few days earlier than the event in question. Ok, so I just need to scroll a bit… Whoops, it looks like saved event logs are paged. You only get about 250 rows before you have to go the next page. Ok, paging isn’t toooooo bad. We can deal with that:
So I click “Next Page” several times to get where I want. Uh oh. I went too far. That’s ok, I just need to click the… Wait a second, there’s no “Previous Page” button! There is a “Next Page” button and a “Back to Top” button for all those times you want to go back to the very first page, but no “Previous Page” button. Did we not have our thinking caps on when we designed this, Microsoft? What use is a web browser with no back button? Little. So what use is an event viewer with no previous page button? Not much, I gotta tell you.
So maybe now you’re thinking “But wait a second, Mike. You can just click on the ‘Date and Time’ column header to sort on that header and get the most recent events at the top.” Sorry, but that doesn’t work either. Sorting only works on the current page, which isn’t all that useful. And even if it did sort through all the pages, what would the page number show? If you’re observant, you probably saw the page display only shows the name of the log followed by the current page number. It’s not “Page 5/12″ or anything useful like that, it’s just the number of the current page. I still don’t know how many pages my saved event log contains.
So what’s the lesson here? Is it “Don’t display partial information”? Is it “Don’t provide partial functionality”? Is it “Don’t design for only a partial set of use cases”? I think any of those would work…





Clearly you need to use Powershell!!
I think the Event Viewer team at Microsoft did that on purpose just so you’d become more familiar with “the shell”.
November 13, 2007 @ 7:12 am
Actually, event logs can be saved into xml or csv’s, so powershell might be a really good choice for that. I think I smell another powershell-powered app in the works…
November 13, 2007 @ 11:54 pm
Ctrl-Z!!!
November 14, 2007 @ 3:50 pm