Windows Eventing 6.0

 Executive Summary:

Windows Server 2008 and Windows Vista include a redesigned Microsoft Management Console (MMC) Event Viewer snap-in. The Event Viewer snap-in’s use of XML makes it easy to query and filter events by using XML Path Language (XPath). Event Viewer and Task Scheduler can be used to attach actions to event queries.

Most of us use the built-in Windows event log service and the associated Event Viewer as troubleshooting tools. However, the Windows event management tools can be leveraged for much more. These tools can inform us of problems long before a disaster happens and give us event "signs” about applications, services, or OS components that aren't functioning properly or users that are misusing a system’s resources or data.

It's true that the legacy Event Viewer shows a lot of useless event information, and it's often difficult to find crucial event information in Event Viewer. However, usability isn't the only problem. Many of us have a mental block regarding the use of event management tools. We consider these tools to be primarily reactive tools, not proactive tools that can help us increase the availability and security of our Windows systems. . . .