There's a very high chance you've run into an error on your PC at some point. You've probably seen the infamous "blue screen of death" once or twice or some other problem. While it may not be known to most people, Windows 11 has a tool that lets you learn more about these errors, called the Event Viewer.

The Event Viewer has been around for many Windows versions, and it mostly works like it did in the past. It logs all kinds of events related to your Windows PC, not just errors. The primary reason you'd want to use it is to find information about problems you're running into.

That said, using the Event Viewer can feel convoluted if you're relatively new to it, so we're here to help with that. While we won't be diving into specific errors, this article will give you an overview on how to use Event Viewer to find errors and other events on your Windows 11 PC.

The Windows Event Viewer interface

The easiest way to open the Event Viewer on Windows 11 is to search for it on the Start menu. Simply open Start and type Event Viewer into the search bar. It should be the first result.

When you first launch the Event Viewer, you'll see a summary of recent events on your PC. It includes all the events logged in the past week but also breaks down the events over the last 24 hours and the last hour, making it easier to have an idea of when a problem might have occurred. You'll also see a navigation tree on the left side of the window, along with the Actions pane on the right side.

As you can see above, there are four general types of events that Event Viewer tracks: Critical, Error, Warning, and Information. Information events are the most common because they appear whenever things work as intended. Warning events also aren't particularly interesting since they don't necessarily relate to any major problems.

Error events are more interesting, as they might suggest a more serious problem, but they can also crop up when everything functions normally. You shouldn't take these numbers as a guarantee that something is persistently wrong. It could be something as simple as a service failing to start up on the first try but then starting anyway later. Critical events are errors that cause the computer to crash, and those are probably the ones you'll be looking for most often. If you keep running into a blue screen of death, it's because of an error that falls in this category.

While this summary is helpful, your focus will probably be on the Windows Logs folder on the navigation pane on the left. If you expand it, you'll see five different logs, and the most likely ones to be important to you are the System and Application logs, which are related to Windows 11 itself and installed apps. The Security log keeps track of all kinds of security events, including login attempts, while the Setup log includes events related to updates.

You can click any of these logs to view all the events in the log, and most of them will likely have the Information type. If you find an error or warning you want to learn more about, you can click it, and the related information will appear at the bottom of the window. You can also double-click the event to see that information in a separate window.

The event properties pane/window includes a description of the error, which should include enough information for you to know what's wrong and how to fix it, if necessary. You may also want to look at the Event ID, which you can use to help you find more information about the problem online. In some cases, the description itself includes an error code, which is good if you want to search for it online.

Searching for specific events in Event Viewer

If you want to find a specific event in your log, assuming you already have an idea of what to look for, the Event Viewer can help you do that, too. Two primary search tools can help, one being more basic and the other giving you more advanced options.

Find (basic search)

The more basic tool is called Find, and you can use it to find an event by searching for a term in any of the fields related to it. You can search for a service that created the event, a task category, or an event ID. Here's how to do it:

1. Open Event Viewer.
2. Expand the Windows Logs folder (you can also use custom views, which we'll get to later).

   

3. Select the log you want to search in, such as System.
4. Click Find in the Actions pane on the right side of the window.
   • Alternatively, right-click the log and choose Find in the context menu

     

5. Enter the keyword, event ID, or another search term into the text field and click Find Next.

   

6. Event Viewer will highlight events that match the keyword, and you can cycle through them one at a time.

This more basic search can help you find a specific event, but it is somewhat limited since you can only see one result at a time, and other unrelated events are still visible. That's where the advanced search tools come in.

Filter logs (advanced search)

If you want to find all events that match a specific set of criteria, your best bet is to use the log filtering options in Event Viewer. This feature provides more ways to find the events you're looking for. Here's how to do it:

1. Open Event Viewer and navigate to the log you want to search (as explained in steps 1-3 above).
2. In the Actions pane, click Filter Current Log.

   

3. Here, you can filter events based on multiple criteria. First, you'll need to choose the event levels you want to see, such as Critical, Error, Warning, or Information event types.

   

4. The Logged field at the top allows you to choose when the event occurred, so if you know a particular error happened recently, you can filter it for the last hour, for example.
5. The Event source filter (optional) lets you choose a service or app that created the event you're looking for.

   

6. You can also enter an Event ID if you know more specifically what kind of event you're looking for.
7. Finally, the Keywords field provides a list of common keywords you might be looking for.
8. After applying your filters, click OK.
9. You can now sort through all the errors that match your criteria and see more details about them.

This should make it much easier to find specific errors in Windows 11, considering there are thousands of events that aren't always relevant.

Creating a custom view in Event Viewer

If the default logs provided by Event Viewer are too cluttered or unrefined for your usage, you can also create custom views. This is especially useful for regular users frequently looking for specific events that may now be well organized in the default logs. Custom views work similarly to filters, except they're permanently available. Here's how to create a custom view:

1. Open Event Viewer.
2. On the left-side pane, click Custom views.
3. Select Create custom view from the Actions pane on the right side of the window.

   

4. The Logged field works as we explained above so that you can filter events by date. You can also choose the same event levels as before.
5. Here, you can choose if you want to filter results by log or by source.
   • By log lets you choose one or multiple logs where the events originate, such as System and Applications.
   • By source lets you choose a service or app that created the events you want to filter for.

     

6. Once you've selected the field above, the rest of the fields work similarly to normal filters. You can choose an Event ID, a Task Category, and Keywords, if you know what events you want to see in your custom view.
7. Click OK
8. Choose a name and description for your custom view. You can also choose where to store the custom view on your navigation tree, which is useful if you have a lot of custom views.

   

9. Click OK.
10. You'll now see your custom view in the Custom Views folder (or whatever folder you chose to create for it). Simply select it from the left-side pane to view the events in your custom view.

    

How to back up event logs

If you don't know how to investigate a specific error or need more help, you can save event logs into a file that you can share with someone else who can look at the events from your computer. Here's how:

1. Open Event Viewer.
2. Navigate to the log or custom view you want to export.
3. In the Actions pane on the right, choose Save All Events As... (for logs) or Save All Events in Custom View As...

   

   • Alternatively, you can select specific events manually and then choose Save Selected Events.

4. Choose a name and location for the file and click Save.
5. You can then send this file to someone you trust, so they can check what might be happening with your computer.

How to clear event logs

There should be no reason to clear your event logs most of the time, but if you need to save some space on your drive, you can delete all the events in a log. We wouldn't necessarily recommend this, but if you want to do it, here's how:

1. Open the Event Viewer.
2. Expand the Windows Logs option on the left-side panel.
3. Open the log you want to clear (such as System) and choose Clear Log in the Actions pane.

   

4. Choose Clear to delete all the events in the log, or Save and Clear if you'd like to back up the events to a separate file before deleting them.

And that's about all you need to know about using the Event Viewer in Windows 11. As you can tell, there's a lot to it, and it can be very useful to figure out what's happening with your normally great PC or laptop. If you'd like to learn about other Windows 11 features, check out how to use BitLocker or how to customize Windows 11 if you'd like to tweak your experience.