Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Application.evtx
LogRisk: Caution

Application.evtx C:\Windows\System32\winevt\Logs\Application.evtx

Application log: events raised by applications and some components (errors, warnings, information).

Updated on By AltF4 Formation

What it’s for

Application.evtx receives events from installed programs and some services: crashes, runtime errors, informational messages. It is the log to open to understand why a piece of software closes or no longer starts. Its neighbors each have their own audience: System.evtx for Windows and its drivers, Security.evtx for auditing.

What it contains

  • Application errors (Application Error source, ID 1000) and hangs (Application Hang, ID 1002).
  • Windows Error Reporting entries (Windows Error Reporting source, ID 1001) and .NET Runtime errors (ID 1026).
  • Windows Installer messages (MsiInstaller source, for example ID 11707 for a successful installation and 11708 for a failure).
  • Events from database engines, antivirus products and line-of-business software that use this log.

Risks and best practices

  • The EventLog service locks the file, so export it with wevtutil epl instead of copying or deleting it.
  • The log can contain file names or paths, so review it before sending it to a third party.
  • Adjust its maximum size rather than clearing it regularly, and export it before any clearing during an investigation.

Useful commands

Fenêtre de terminal
# Last 20 events
Get-WinEvent -LogName Application -MaxEvents 20


# Application crashes (event 1000) in the last 7 days
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000; StartTime=(Get-Date).AddDays(-7)}


# Back up a copy of the log
wevtutil epl Application "$env:USERPROFILE\Desktop\Application-backup.evtx"

Format

Binary XML file (.evtx). Each event has a source, an ID, a level and a message formatted by the emitting application’s message library.

Rotation and archiving

Maximum size and retention are set per log (log properties or Group Policy), and wevtutil gl Application shows the current values. To archive, export to .evtx with wevtutil epl.

How to read it

Open Event Viewer, Windows Logs, Application, then filter on the Error level and the source you care about. If an event’s text is incomplete, the emitting software may no longer be installed: the ID and source remain usable.

Report a mistake