To open Event Viewer in Windows 11, press Windows key + X and select Event Viewer, or press Windows key + R, type eventvwr.msc and press Enter. Crashes and errors are recorded under Windows Logs > System and Windows Logs > Application. Filtering by Critical and Error levels, then looking up the Event ID, usually points to the cause.
Event Viewer looks intimidating, but you only need a handful of its features to diagnose most problems. This guide shows which logs matter, how to filter them, and what the most common Event IDs mean.
| Event ID | Log and source | What it usually means |
|---|---|---|
| 41 | System, Kernel-Power | Windows restarted without shutting down cleanly (crash, power loss or forced power-off) |
| 6008 | System, EventLog | "The previous system shutdown … was unexpected" |
| 1001 | System, BugCheck | The PC recovered from a blue screen (stop error) |
| 1000 | Application, Application Error | A program crashed; names the faulting app and module |
| 1002 | Application, Application Hang | A program stopped responding and was closed |
| 7000 / 7001 | System, Service Control Manager | A service failed to start, or a service it depends on failed |
| 7031 / 7034 | System, Service Control Manager | A service terminated unexpectedly |
How do I open Event Viewer in Windows 11?
The quickest way is to right-click the Start button, or press Windows key + X, and select Event Viewer. You can also search for "Event Viewer" in the Start menu, or press Windows key + R and run eventvwr.msc. All three open the same console.
Event Viewer opens without administrator rights, and you can read the Application and System logs that way. The Security log, and some actions such as clearing logs, need an administrator account.
The window has three panes. The left pane is the log tree, the middle pane lists events in the selected log, and the right Actions pane holds filtering, saving and custom view commands.
Which Event Viewer logs should I check for errors?
For most problems, check Windows Logs > System and Windows Logs > Application. The System log records hardware, driver, service and shutdown events, so it covers crashes, restarts and blue screens. The Application log records programs that crash or hang. The Security log records sign-ins and audit events.
- Application: app crashes, app hangs, Office and installer errors.
- Security: successful and failed sign-ins, account changes and audit events. Useful when checking who signed in and when.
- Setup: Windows update and feature installation events.
- System: drivers, services, disks, power and unexpected shutdowns.
- Applications and Services Logs: detailed logs for individual Windows components, such as Microsoft > Windows > WindowsUpdateClient.
Each event has a level: Critical, Error, Warning, Information or Verbose. Critical and Error are the ones to start with.
What we commonly see: people panic at the number of red Error entries on a healthy PC. Every Windows system logs some harmless errors and warnings. An event only matters if its timing lines up with the problem you saw.
How do I filter Event Viewer to find a crash?
Select the log, such as System, then select Filter Current Log in the Actions pane. Tick Critical and Error, set Logged to a time range around the crash, and select OK. You can also type specific Event IDs, separated by commas, into the <All Event IDs> box.
- Note roughly when the problem happened.
- In Event Viewer, select Windows Logs > System.
- In the Actions pane, select Filter Current Log.
- Under Event level, tick Critical and Error.
- Set Logged to Last 24 hours, or choose Custom range to match the time.
- Optionally, enter IDs such as
41,6008,1001in the Event ID box. - Select OK. Select an event to read its General and Details tabs.
Select Clear Filter in the Actions pane to see the full log again. The filter only applies to the current log, so repeat it for the Application log if needed.
Advanced nuance: the first error in a cluster is usually the cause, and the ones after it are often consequences. Sort by Date and Time and read upwards from the oldest event in the burst rather than starting with the newest.
What does Event ID 41 Kernel-Power mean?
Event ID 41 means Windows restarted without first shutting down cleanly. It is logged at the next start-up, not at the moment of failure, so it records that something went wrong rather than what. Common causes are a stop error (blue screen), a power cut, a drained battery, or holding the power button to force the PC off.
Open the event and check the Details tab. Microsoft's Kernel-Power Event ID 41 article explains the two most useful fields:
- BugcheckCode: if it is not zero, a stop error occurred. The value is in decimal, so convert it to hexadecimal (Calculator in Programmer mode does this) to match the stop code.
- PowerButtonTimestamp: if it is not zero, the power button was held down to force the shutdown.
Cause and effect: when both values are zero, Windows could not record anything before the PC lost power. That pattern points towards the power supply, overheating, a loose cable or a hard lock-up rather than a software crash.
Event ID 6008 usually appears alongside Event 41 and confirms the shutdown was unexpected. If a blue screen was the cause, Event ID 1001 from BugCheck often follows, showing the stop code.
How do I find out why an app crashed?
Look in Windows Logs > Application for Event ID 1000 from the source Application Error. The event names the faulting application and the faulting module, which is the file that failed. Event ID 1002, Application Hang, means the program froze and was closed rather than crashing outright.
The faulting module is the most useful clue. If it is the app's own file, reinstall or update the app. If it is a graphics driver file or a plug-in, update that instead.
For system-level failures, the Service Control Manager entries in the System log are worth checking. Event 7000 means a service failed to start, 7001 means it could not start because a service it depends on failed, and 7031 or 7034 mean a service stopped unexpectedly.
If errors point to a driver, our guide to finding and updating Windows 11 drivers covers rolling back or reinstalling it. If they follow a black screen, see our Windows 11 black screen fixes.
How do I create a custom view in Event Viewer?
Select Create Custom View in the Actions pane, choose a time range and event levels, then pick the logs to include with By log, or the sources with By source. Select OK, give it a name and save it. The view appears under Custom Views and updates automatically every time you open it.
A practical example is a view of Critical and Error events from both the Application and System logs over the last seven days. Windows already includes a similar built-in view called Administrative Events under Custom Views, which gathers Critical, Error and Warning events from the main logs.
Custom views are also useful for a single recurring problem. Filtering on the source Kernel-Power or a specific Event ID gives you a running history of how often it happens.
What is Reliability Monitor and how is it different?
Reliability Monitor is a simpler timeline built from the same event data. It shows a day-by-day chart of app failures, Windows failures, warnings and installed updates, with a stability index from 1 to 10. It is often the quickest way to see what changed just before problems started.
To open it, press Windows key + R and run perfmon /rel. You can also go to Control Panel > Security and Maintenance, expand Maintenance and select View reliability history.
Select a day to see its events, then double-click a failure for the technical details. If a red failure icon appears straight after a driver or update installation, that installation is the first thing to undo.
What we commonly see: Reliability Monitor makes patterns obvious that are hard to spot in Event Viewer, such as the same app crashing every morning or failures starting the day a particular update arrived.
How do I export Event Viewer logs?
Select the log, or apply a filter first, then select Save All Events As (or Save Filtered Log File As) in the Actions pane. Choose the .evtx format to keep everything for another Event Viewer, or text or CSV formats for easy reading. Send the file to whoever is helping you.
From the command line, the wevtutil tool can export a whole log. Run this in Terminal (Admin), making sure the target folder exists:
wevtutil epl System C:\Logs\system.evtx
To list the ten most recent errors in the System log as text, run:
wevtutil qe System /q:"*[System[(Level=2)]]" /c:10 /rd:true /f:text
Microsoft's wevtutil command reference lists further options. Exported logs can include user names and computer names, so share them only with people you trust.
Event Viewer, Reliability Monitor and these tools are included in every edition of Windows 11. Logging policy settings for the Security log, such as advanced audit policy through Group Policy, need Windows 11 Pro, which you can get with a genuine Windows 11 Pro licence key.
Frequently asked questions
Is it safe to clear Event Viewer logs?
Clearing logs does not harm Windows, but it deletes the evidence you may need to troubleshoot. It also does not fix anything, because new errors will simply appear again. If you want a clean starting point, save the log first with Save All Events As, then select Clear Log.
Why does Event Viewer show so many errors on a working PC?
Windows and apps log many minor errors and warnings during normal operation, such as a service timing out briefly at start-up. Most are harmless. Focus on Critical events, errors that repeat, and errors whose time matches a crash, freeze or restart you actually noticed.
Can Event Viewer tell me what caused a blue screen?
Partly. Event ID 1001 from BugCheck, and the BugcheckCode field in Event 41, record the stop code. That code narrows down the cause, such as a driver or memory problem. Errors logged just before the crash often name the failing driver or device.
Where are Event Viewer log files stored?
The log files are stored in C:\Windows\System32\winevt\Logs as .evtx files. Do not move or delete them there directly. Use Event Viewer's Save All Events As or the wevtutil epl command to make a copy instead.
How do I see when my PC was shut down or restarted?
Filter the System log for Event IDs 6005 and 6006, which record the event log service starting and stopping at each boot and shutdown. Event 1074 records planned restarts and shutdowns, including which process or user requested them, while Events 41 and 6008 mark unexpected ones.
Related guides
- Windows 11 black screen: how to fix it
- How to find, download and update drivers in Windows 11
- How to shut down Windows 11: quick ways and shortcuts
- How to check your Windows 11 version and update to 26H2
Links in this guide
| Link | Type | Why it helps |
|---|---|---|
| Kernel-Power Event ID 41 | External | Explains BugcheckCode and PowerButtonTimestamp |
| wevtutil command reference | External | Exporting and querying logs from the command line |
| Find and update Windows 11 drivers | Internal | Fixing driver errors found in the logs |
| Windows 11 black screen fixes | Internal | Next steps when logs show display crashes |
| Windows 11 Pro licence key | Internal | Adds Group Policy for advanced audit logging |