---
title: How to read the Event Viewer
description: If MiTS crashes, the support team may request the Windows Application event logs to investigate the cause. You can save these logs through Event Viewer, or use PowerShell to find MiTS events within a date range and save their details…
url: "https://mes100.com/docs/read-error-log-event-viewer/"
updated: "2026-10-23"
category: Troubleshooting / General
---

# How to read the Event Viewer

If MiTS crashes, the support team may request the Windows Application event logs to investigate the cause. You can save these logs through Event Viewer, or use PowerShell to find MiTS events within a date range and save their details to a text file.

# How to open Event Viewer

1. Go to the start button and search for “Event Viewer”. Then click to open the Event Viewer.

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image1-2.png?w=1080&ssl=1)

1. On the Event Viewer window, go to Windows Logs > Application

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image7.png?w=1080&ssl=1)

1. The Event Viewer logs will record all of the events that occurred on that day and previous days.

# How to save event viewer

Users have the option to save all recorded events or only selected events.

## **To save all recorded events**

1. Go to Action tab. Click on Save All Events As…

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image2-3.png?w=1080&ssl=1)

1. Input Name > Save

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image13.png?w=1080&ssl=1)

1. Display information for these languages > English (United States) > OK

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image5-1.png?w=1080&ssl=1)

1. Users can directly send the Event Log file in “.evtx” format to the support team via email [support@mes100.com](mailto:support@mes100.com).

## ****To save selected event****

1. To save selected events, users need to ensure the correct and specific event is being selected. On the Event Viewer window, search for the specific error. The selected error should have the details as follows;

   - Level: Error
   - Date and Time: date and time the error occurred
2. Next, to ensure it is an error produced by MiTS software, on the “General Tab”, users can find the word “MiTS.exe”.

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image4-1.png?w=1080&ssl=1)

1. Once users have confirmed the selected event is correct, right click on the particular event > Save Selected Events…

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image3-1.png?w=1080&ssl=1)

1. Input Name > Save

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image12.png?w=1080&ssl=1)

1. Display information for these languages > English (United States) > OK

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image9.png?w=1080&ssl=1)

1. Users can directly send the Event Log file in “.evtx” format to the support team via email [support@mes100.com](mailto:support@mes100.com)

## Other option

1. Users can press (ctrl+A) to select all the notes appeared in the “General Tab” and press (ctrl + C) to copy

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image10.png?w=1080&ssl=1)

1. Open email and press (ctrl + V) to paste it in the body message of the email and send it to [support@mes100.com](mailto:support@mes100.com). 

![](https://i0.wp.com/mes100.com/wp-content/uploads/2017/04/image11.png?w=1080&ssl=1)

# How to open a saved .evtx file

An `.evtx` file is a Windows event log. Open it in **Event Viewer** to read the events:

1. Open Event Viewer from the Start menu.
2. Click **Event Viewer (Local)** in the left pane, then choose **Action > Open Saved Log**.
3. Browse to the `.evtx` file and click **Open**. Select the opened log under **Saved Logs** in the left pane.
4. If the file contains many events, choose **Filter Current Log** in the Actions pane. Under **Logged**, choose **Custom range** and enter the dates and times around the crash. Leave the event levels unrestricted so that related Information records remain visible.
5. Use **Find** in the Actions pane to search for `MiTS.exe`. Select a matching event and read the **General** tab in the lower pane, or double-click the event to open its properties.
6. Inspect nearby events at the same time, especially those from **.NET Runtime**, **Application Error** and **Windows Error Reporting**. The section **How to interpret the crash records** below explains what to look for.

Make sure you are reading the opened file under **Saved Logs**. **Windows Logs > Application** shows the current computer’s live log. A saved file contains only the events included when it was exported, so related records may be absent if only one event was saved. Microsoft describes [opening saved event logs in Event Viewer](https://learn.microsoft.com/en-us/windows/client-management/mdm-collect-logs).

# Find MiTS crash logs with PowerShell

Use this method on the computer where MiTS crashed. Search for **Windows PowerShell** in the Start menu and open it. The commands below work in Windows PowerShell 5.1, which is included with Windows 10 and Windows 11.

## Copy the script and change only the dates

Copy the entire script below into **Notepad** first. Change only the two dates at the top, keeping the quotation marks and using **YYYY-MM-DD**. Then copy the entire edited script into Windows PowerShell and press **Enter**. Copy the script text only, without any surrounding article text.

Both dates are included in full, using the computer’s local time. For example, the settings below search **20 to 22 October 2026 inclusive**. To search one day, enter the same date on both lines. The script finds MiTS events and automatically saves a text report to your Desktop.

```powershell
& {
    # CHANGE ONLY THESE TWO DATES (YYYY-MM-DD; both days included):
    $startDate = '2026-10-20'
    $endDate   = '2026-10-22'

    # No changes needed below this line.
    $culture = [Globalization.CultureInfo]::InvariantCulture
    try {
        $from = [datetime]::ParseExact($startDate, 'yyyy-MM-dd', $culture)
        $lastDay = [datetime]::ParseExact($endDate, 'yyyy-MM-dd', $culture)
    } catch {
        Write-Host 'Please enter valid dates in YYYY-MM-DD format.'
        return
    }
    if ($lastDay -lt $from) {
        Write-Host 'The end date must be on or after the start date.'
        return
    }
    $until = $lastDay.AddDays(1)
    $exePattern = 'bMiTS.exeb'

    try {
        $events = @(
            Get-WinEvent -FilterHashtable @{
                LogName   = 'Application'
                StartTime = $from
                EndTime   = $until
            } -ErrorAction Stop | Where-Object {
                $_.TimeCreated -lt $until -and (
                    $_.Message -match $exePattern -or
                    $_.ToXml() -match $exePattern
                )
            } | Sort-Object TimeCreated
        )
    } catch {
        if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') {
            Write-Host 'No Application events found. Check or widen the dates.'
            return
        }
        throw
    }

    if ($events.Count -eq 0) {
        Write-Host 'No MiTS events found. Check or widen the dates.'
        return
    }

    $desktop = [Environment]::GetFolderPath('Desktop')
    $file = Join-Path $desktop ("MiTS-events-{0}.txt" -f (Get-Date -Format 'yyyyMMdd-HHmmss-fff'))

    $events |
        Format-List TimeCreated, Id, RecordId, ProviderName, LevelDisplayName, Message |
        Out-File -LiteralPath $file -Encoding utf8 -Width 4096 -ErrorAction Stop

    Write-Host "Saved $($events.Count) events to $file"
}
```

## Find the saved report

When the script finishes, PowerShell displays **Saved … events to …**, followed by the file’s full location. Open the `MiTS-events-....txt` file on your Desktop and send it to [support@mes100.com](mailto:support@mes100.com), together with the approximate crash time and what you were doing in MiTS. If support requests the original `.evtx` file, use **Save Selected Events** in Event Viewer as described above; renaming the text file does not convert it to `.evtx`.

If there are no matching events, the script displays a message and does not create a report. Widen the dates and run the whole script again. Older events may already have been overwritten or cleared, and some crashes do not leave an event containing `MiTS.exe`. If your Event Viewer entry shows another executable name, send the `.evtx` file using the steps above. If you receive an **Access is denied** error, reopen Windows PowerShell using **Run as administrator** and repeat the script.

The script searches **Windows Logs > Application**, first restricting the date range, then looking for `MiTS.exe` in each event’s message or XML data. Matching is case-insensitive. It includes all event levels because related reports may be recorded as Information. It also includes other events mentioning MiTS, so check the time and message against the crash you experienced. Microsoft documents the [date filters for Get-WinEvent](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-5.1) and [application crash events](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-application-service-crashing-behavior).

# How to read the exported text report

Open `MiTS-events-....txt` in **Notepad**. Each event appears as a separate block, ordered from oldest to newest. The fields correspond to the information shown in Event Viewer:

| Text report field | What it tells you |
| --- | --- |
| `TimeCreated` | When the event was recorded, in the exporting computer’s local time. Find the entries near the time MiTS crashed. |
| `Id` | The Event ID, such as 1000, 1001 or 1026. Read it together with `ProviderName`. |
| `RecordId` | The entry’s record number in the Application log, useful when locating that same entry again. |
| `ProviderName` | The event source, such as Application Error or .NET Runtime. |
| `LevelDisplayName` | The event’s level, such as Error or Information. |
| `Message` | The detailed description shown on Event Viewer’s General tab. This is the main part to read. |

# How to interpret the crash records

Whether you are reading an `.evtx` file or the PowerShell text report, confirm that the message identifies `MiTS.exe`, then read the related entries around the crash time together:

| Source and Event ID | What to look for in General / Message |
| --- | --- |
| **.NET Runtime — 1026** | The exception type, exception message and stack trace, where provided. These describe the runtime error and the sequence of calls associated with it. |
| **Application Error — 1000** | The faulting application name and version, faulting module name, and exception code. Confirm that the faulting application is MiTS. |
| **Windows Error Reporting — 1001** | The event name and report ID, where provided. Check whether the report concerns the crash you experienced; Windows Error Reporting also records other application problems. |

Not every crash produces all three records. A faulting module such as `KERNELBASE.dll` or `ntdll.dll` identifies where the failure surfaced; that name alone does not establish the underlying cause. Microsoft explains the [fields in application crash records](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-application-service-crashing-behavior) and the [.NET exception details to inspect](https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/site-behavior-performance/process-termination-crash).

Send the complete `.evtx` file or exported text report to [support@mes100.com](mailto:support@mes100.com), together with the approximate crash time and what you were doing in MiTS. Include the computer’s time zone if support is reviewing the file on another computer. Keep the nearby records together so that support can compare the application error with its related runtime and reporting events.

### *Related*

 [![](https://i0.wp.com/mes100.com/wp-content/uploads/2024/10/me-small.jpg?resize=100%2C100&ssl=1)](https://mes100.com/author/admin/)[Ngu Soon Hui](https://mes100.com/author/admin/)

I’m the [Benevolent Dictator for Life](https://en.wikipedia.org/wiki/Benevolent_dictator_for_life) for MiTS Software cum Editor of this website. Read more [here](/about-ngu-soon-hui/).

You can also contact me at soonhui@mes100.com