Collect an Event ID and neighboring product events#

When to use this procedure#

Use this first when an event contains dynamic detail or several failures occur together.

Applies to#

This procedure applies to EventReporter.

Prerequisites#

  • Use an account that can read the product configuration and Windows diagnostic state.

  • Replace angle-bracket placeholders with values from the affected system.

Safety#

  • Run diagnostic checks before changing configuration.

  • Remove passwords, private keys, license data, and other secrets from evidence.

Configuration path#

Event Viewer > Windows Logs > Application > Filter Current Log.

Procedure#

  1. Record the Event Log source, Event ID, level, timestamp, and complete General and Details data.

    Expected result: The record includes the provider, Event ID, timestamp with time zone, message text, and all dynamic detail.

    If it fails: Export the original event as an EVTX file before copying text or changing filters.

  2. For every host involved in the affected flow, including the affected product host, sender, and destination, use an elevated PowerShell session when available to record that host’s clock state.

    Get-Date -Format o
w32tm /query /status

    Expected result: Each involved host has a recorded local timestamp and either clock-status output or the recorded query error. If elevation is unavailable or the time service cannot be queried, treat that host’s clock synchronization as unverified.

    If it fails: If the Windows Time status command returns access denied or the time service is unavailable, do not change time settings or services. Record Get-Date output and the query error, request clock status from an authorized administrator if correlation is required, and continue with the affected-host event capture.

  3. On the affected product host, collect only the product events in a bounded window around the event.

    $start=(Get-Date '<EVENT_TIME>').AddMinutes(-5)
$end=(Get-Date '<EVENT_TIME>').AddMinutes(5)
Get-WinEvent -FilterHashtable @{LogName='Application';StartTime=$start;EndTime=$end} | Where-Object ProviderName -eq '<EVENT_SOURCE>' | Format-List TimeCreated,Id,LevelDisplayName,Message

    Expected result: The event sequence contains the first failure plus any later state or recovery event.

    If it fails: Verify the provider shown on the Event ID page and expand the window only enough to include the first related event.

  4. After diagnosis, perform one uniquely identifiable product test through the same input, rule, and action, and record its sender and destination timestamps.

    Expected result: The intended destination records the test exactly once.

    If it fails: Collect the first new product event and bounded debug output from that exact test; do not change unrelated settings.

Verify the result#

Repeat the affected operation, confirm its positive output, and verify that queues, collection positions, or remote delivery continue normally.

Evidence to collect#

  • The original EVTX record plus the complete rendered event and neighboring product events with timestamps.

  • Clock-status output or the recorded query error from every involved host, plus the sender and destination timestamps for the identifiable test.

  • The relevant configuration export and bounded debug log from the same interval, with credentials, license data, private keys, addresses, and other secrets removed. Preserve hostnames and configuration object names needed to identify the affected systems and settings.