log analyzer windows event log

    1

    Diagnose Windows Server outages and security incidents by correlating Event IDs, Sources, and XML data across log channels.

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    log analyzer windows event log

    Example session with this skill installed

    Analyze these System logs from a Windows Server 2022 PROD Domain Controller.
    Event 7034, Service Control Manager, 10:45:02.
    Event 1000, Application Error, 10:45:01, faulting module ntdll.dll.

    • Read your context and instructions
    • Compiled the log analyzer windows

    I have analyzed the provided logs from your Windows Server 2022 Production Domain Controller. The service termination in the System log is a direct result of the application crash recorded one second prior.

    REPORTE DE ANÁLISIS DE LOG — WINDOWS EVENT LOG

    SECCIÓNDETALLES
    TecnologíaWindows Server 2022 / Canal: System & Application
    EntornoPROD (Domain Controller)
    Período10:45:01 → 10:45:02
    DiagnósticoService Control Manager (SCM) detected a service crash (ID 7034) triggered by a memory access violation in ntdll.dll (ID 1000).

    🔴 HALLAZGOS CRÍTICOS

    Event ID 1000 + Application Error / 10:45:01 / Faulting application name unknown, Faulting module: ntdll.dll /

    Causa raíz: Access Violation (0xc0000005) in the core NT layer.
    2.

    Event ID 7034 + Service Control Manager / 10:45:02 / The service terminated unexpectedly. /

    Hipótesis: The service process crashed due to the ntdll.dll error above, causing SCM to report an unexpected stop.

    🟡 ADVERTENCIAS

    • The faulting application name was not provided in the snippet. Identifying the specific executable is required to determine if this is a third-party agent or a core OS service.
    • ⚠️ DATOS SENSIBLES: None detected in this snippet.

    🛠️ PRÓXIMOS PASOS

    1. Locate the Event ID 1001 (Windows Error Reporting) that usually follows ID 1000 to find the crash dump location.
    2. Verify if any Windows Updates or driver changes were applied to this DC in the 24 hours prior to 10:45:01.
    3. Check the

    Security channel for Event ID 4688 (Process Creation) at 10:45:00 to identify the user context the crashing service was running under.

    ¿Deseas el reporte como documento entregable?

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Troubleshooting Windows Server environments is often a chaotic search through thousands of logs where Event IDs are meaningless without their specific context. This skill parses Windows Event Logs (EVTX/XML) to isolate root causes by correlating events across Application, System, and Security channels.

    What it does

    • Multi-channel correlation maps System service failures to Application crashes and .NET runtime exceptions.
    • Root cause isolation identifies the primary Critical or Error event in a cascade to prevent chasing symptoms.
    • Security audit analysis decodes LogonTypes and SubStatus codes in ID 4625/4740 events to identify RDP attacks or account lockouts.
    • Sensitive data redaction flags PII, SIDs, domain credentials, and internal connection strings found in log payloads.
    • Stack trace parsing extracts specific namespaces and classes from .NET Runtime ID 1026 exceptions.

    How it works

    1. Input logs from Windows Server channels (Application, System, Security, Setup) or specific XML data.
    2. Context verification triggers prompts for server roles, Windows versions, and environment types if not provided.
    3. Structured analysis correlates Event ID and Source pairs against known Win32 codes and Microsoft troubleshooting patterns.

    Frameworks & tools

    This tool handles logs from Windows Server (2012 R2 through 2022) including Microsoft-Windows-Kernel-Power, Service Control Manager, W3SVC (IIS), and .NET Runtime.

    Why this beats prompting it yourself

    Generic AI often misinterprets Event IDs, which change meaning depending on the Source. This skill enforces the ID + Source relationship and specifically decodes hexadecimal SubStatus codes that standard prompts frequently hallucinate or ignore.

    Use cases

    • Crash investigation resolving recurring Application Error ID 1000 and 1026 loops.
    • Outage post-mortems identifying unexpected shutdowns via Kernel-Power ID 41.
    • Security forensics tracking brute-force attempts and account lockout origins.
    • Service management debugging SCM service start failures (ID 7000/7023).

    Known limitations

    Does not support non-Windows syslog formats or cloud-native logs like AWS CloudWatch without the original Windows Event structure. Requires the Source field for accurate diagnosis.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Listedtoday

    What's inside

    Frequently Asked Questions