Where Windows 11 stores error logs and how to open them

Windows 11 records errors and system events in a built-in tool called Event Viewer. This is where the operating system logs everything from driver failures to security warnings to application crashes. You do not need to install anything — Event Viewer comes with Windows 11 and is the fastest way to see what went wrong on your machine.

The logs are organized by type: System logs show hardware and Windows problems, Application logs show crashes and errors from programs you run, and Security logs show login attempts and permission issues. Most people start with System or Application logs when troubleshooting a specific problem.

Key Takeaways

  • Event Viewer is built into Windows 11 and shows system errors, application crashes, and security events in one place.
  • You can open Event Viewer by typing "Event Viewer" in the Windows search box or by pressing Windows key + R and typing eventvwr.msc.
  • System logs and Application logs are the two most useful sections when your computer is not working correctly.
  • Red X icons mark errors, yellow triangles mark warnings, and blue circles mark informational messages — errors are usually what you need to investigate.
  • You can export logs to a file or search by date and time to narrow down when a problem occurred.

Opening Event Viewer on Windows 11

The fastest way to open Event Viewer is to click the Windows search box (the magnifying glass icon on your taskbar), type "Event Viewer", and press Enter. Windows will open the Event Viewer window immediately.

If the search box is not visible, you can also press Windows key + R to open the Run dialog, type eventvwr.msc, and press Enter. Both methods open the same tool. Once it opens, you will see a folder tree on the left side with categories like Windows Logs, Applications and Services Logs, and Custom Views.

Finding system errors in the System log

Click on Windows Logs in the left panel, then click System. This shows every error, warning, and informational message Windows has recorded. The list will be long — Windows logs hundreds of events even on a healthy computer.

Look for entries with a red X icon, which marks actual errors. Yellow triangles are warnings (less serious). Blue circles are informational messages (usually not a problem). Click any entry to see its full details in the panel below, including the error code, what caused it, and when it happened. If you see the same error repeated many times, that is usually the problem worth investigating.

Checking Application logs for program crashes

If a specific program keeps crashing or closing unexpectedly, click Windows Logs and then Application. This log records when programs fail, freeze, or close abnormally. You will see entries from Windows itself, from third-party applications, and from services running in the background.

Filter by the program name if you know which one is crashing. Click any red X entry to see the error code and details. The Faulting application name field tells you which program crashed, and the Exception code field gives you a technical code you can search online for more information about what went wrong.

Narrowing down logs by date and time

If you know roughly when a problem happened, you can filter the log to show only events from that time period. Right-click on System or Application in the left panel and select Filter Current Log. A dialog box will open where you can set a date range and choose which event levels to show (errors only, warnings only, or both).

This is especially useful when you have thousands of log entries and need to find the one that matters. Set the date to the day the problem occurred, set it to show only errors and warnings, and click OK. The list will shrink to show only relevant entries from that time window.

Saving and sharing error logs

If you need to send a log to a technician or save it for your records, right-click on the log name (System or Application) and select Save All Events As. Choose a location on your computer and a filename. Windows will save the entire log as an .evtx file, which you can email or upload.

You can also right-click a single error entry and select Copy to copy just that entry's details to your clipboard, then paste it into an email or document. This is useful when you want to share one specific error without sending the entire log.

Understanding common error codes and what they mean

Error codes in Windows logs are usually hexadecimal numbers (like 0x80070005 or 0xc0000374). These codes are standardized, so you can search the code online along with the program name to find what it means. Microsoft's support site and third-party tech forums usually have explanations for common codes.

The Source field tells you which component generated the error — for example, "Kernel-Power" for hardware issues, "DCOM" for permission problems, or the program name for application crashes. The Event ID is another number that narrows down the type of problem. Together, the source, event ID, and error code usually point to a specific cause.

Frequently Asked Questions

Why do I see so many errors even though my computer works fine?

Windows logs every event, including minor issues that do not affect you. A single failed network connection, a driver that briefly lost communication, or a program that closed unexpectedly all get logged. Most of these resolve on their own. Focus on errors that repeat or happen around the time you noticed a real problem.

Can I delete old error logs to free up space?

Yes. Right-click on System or Application and select Clear Log. Windows will ask if you want to save the log before clearing it — choose Yes if you want to keep a backup. Clearing logs does not free much space, but it makes the current log easier to read by removing old entries.

What if I see an error but do not understand what it means?

Copy the error code and source name, search them together on Google along with your program name or what you were doing when it happened. Most common errors have explanations on Microsoft's site or tech forums. If the error is not causing visible problems, you usually do not need to fix it.

Do I need administrator rights to open Event Viewer?

You can open Event Viewer with a standard user account and view most logs. Some logs (like Security logs) require administrator rights. If you cannot see a log, right-click Event Viewer and select Run as administrator, then open it again.

Can Event Viewer tell me why my computer is slow?

Event Viewer shows errors and crashes, but not performance problems. If your computer is slow, look for repeated errors from disk drives, memory, or network components — these can cause slowness. For detailed performance information, use Task Manager (press Ctrl + Shift + Esc) or the Performance Monitor tool instead.