603 - 5885 1250 (4 lines) info@mes100.com
Popular Search drainroadponddetentionwatershed
View Categories

How to read the Event Viewer

Estimated: 6 min read

0:00 8:12
Table of Contents

If MiTS crashes, the support team may request the Windows Application event logs to investigate the cause. You can save these logs through Event Viewer, or use PowerShell to find MiTS events within a date range and save their details to a text file.

How to open Event Viewer #

  1. Go to the start button and search for “Event Viewer”. Then click to open the Event Viewer.

  1. On the Event Viewer window, go to Windows Logs > Application

  1. The Event Viewer logs will record all of the events that occurred on that day and previous days.

How to save event viewer #

Users have the option to save all recorded events or only selected events.

To save all recorded events #

  1. Go to Action tab. Click on Save All Events As…

  1. Input Name > Save

  1. Display information for these languages > English (United States) > OK

  1. Users can directly send the Event Log file in “.evtx” format to the support team via email support@mes100.com.

To save selected event #

  1. To save selected events, users need to ensure the correct and specific event is being selected. On the Event Viewer window, search for the specific error. The selected error should have the details as follows;

    • Level: Error
    • Date and Time: date and time the error occurred

  2. Next, to ensure it is an error produced by MiTS software, on the “General Tab”, users can find the word “MiTS.exe”.

  1. Once users have confirmed the selected event is correct, right click on the particular event > Save Selected Events…

  1. Input Name > Save

  1. Display information for these languages > English (United States) > OK

  1. Users can directly send the Event Log file in “.evtx” format to the support team via email support@mes100.com

Other option #

  1. Users can press (ctrl+A) to select all the notes appeared in the “General Tab” and press (ctrl + C) to copy

  1. Open email and press (ctrl + V) to paste it in the body message of the email and send it to support@mes100.com. 

How to open a saved .evtx file #

An .evtx file is a Windows event log. Open it in Event Viewer to read the events:

  1. Open Event Viewer from the Start menu.
  2. Click Event Viewer (Local) in the left pane, then choose Action > Open Saved Log.
  3. Browse to the .evtx file and click Open. Select the opened log under Saved Logs in the left pane.
  4. If the file contains many events, choose Filter Current Log in the Actions pane. Under Logged, choose Custom range and enter the dates and times around the crash. Leave the event levels unrestricted so that related Information records remain visible.
  5. Use Find in the Actions pane to search for MiTS.exe. Select a matching event and read the General tab in the lower pane, or double-click the event to open its properties.
  6. Inspect nearby events at the same time, especially those from .NET Runtime, Application Error and Windows Error Reporting. The section How to interpret the crash records below explains what to look for.

Make sure you are reading the opened file under Saved Logs. Windows Logs > Application shows the current computer’s live log. A saved file contains only the events included when it was exported, so related records may be absent if only one event was saved. Microsoft describes opening saved event logs in Event Viewer.

Find MiTS crash logs with PowerShell #

Use this method on the computer where MiTS crashed. Search for Windows PowerShell in the Start menu and open it. The commands below work in Windows PowerShell 5.1, which is included with Windows 10 and Windows 11.

Copy the script and change only the dates #

Copy the entire script below into Notepad first. Change only the two dates at the top, keeping the quotation marks and using YYYY-MM-DD. Then copy the entire edited script into Windows PowerShell and press Enter. Copy the script text only, without any surrounding article text.

Both dates are included in full, using the computer’s local time. For example, the settings below search 20 to 22 October 2026 inclusive. To search one day, enter the same date on both lines. The script finds MiTS events and automatically saves a text report to your Desktop.

& {
    # CHANGE ONLY THESE TWO DATES (YYYY-MM-DD; both days included):
    $startDate = '2026-10-20'
    $endDate   = '2026-10-22'

    # No changes needed below this line.
    $culture = [Globalization.CultureInfo]::InvariantCulture
    try {
        $from = [datetime]::ParseExact($startDate, 'yyyy-MM-dd', $culture)
        $lastDay = [datetime]::ParseExact($endDate, 'yyyy-MM-dd', $culture)
    } catch {
        Write-Host 'Please enter valid dates in YYYY-MM-DD format.'
        return
    }
    if ($lastDay -lt $from) {
        Write-Host 'The end date must be on or after the start date.'
        return
    }
    $until = $lastDay.AddDays(1)
    $exePattern = '\bMiTS\.exe\b'

    try {
        $events = @(
            Get-WinEvent -FilterHashtable @{
                LogName   = 'Application'
                StartTime = $from
                EndTime   = $until
            } -ErrorAction Stop | Where-Object {
                $_.TimeCreated -lt $until -and (
                    $_.Message -match $exePattern -or
                    $_.ToXml() -match $exePattern
                )
            } | Sort-Object TimeCreated
        )
    } catch {
        if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') {
            Write-Host 'No Application events found. Check or widen the dates.'
            return
        }
        throw
    }

    if ($events.Count -eq 0) {
        Write-Host 'No MiTS events found. Check or widen the dates.'
        return
    }

    $desktop = [Environment]::GetFolderPath('Desktop')
    $file = Join-Path $desktop ("MiTS-events-{0}.txt" -f (Get-Date -Format 'yyyyMMdd-HHmmss-fff'))

    $events |
        Format-List TimeCreated, Id, RecordId, ProviderName, LevelDisplayName, Message |
        Out-File -LiteralPath $file -Encoding utf8 -Width 4096 -ErrorAction Stop

    Write-Host "Saved $($events.Count) events to $file"
}

Find the saved report #

When the script finishes, PowerShell displays Saved … events to …, followed by the file’s full location. Open the MiTS-events-....txt file on your Desktop and send it to support@mes100.com, together with the approximate crash time and what you were doing in MiTS. If support requests the original .evtx file, use Save Selected Events in Event Viewer as described above; renaming the text file does not convert it to .evtx.

If there are no matching events, the script displays a message and does not create a report. Widen the dates and run the whole script again. Older events may already have been overwritten or cleared, and some crashes do not leave an event containing MiTS.exe. If your Event Viewer entry shows another executable name, send the .evtx file using the steps above. If you receive an Access is denied error, reopen Windows PowerShell using Run as administrator and repeat the script.

The script searches Windows Logs > Application, first restricting the date range, then looking for MiTS.exe in each event’s message or XML data. Matching is case-insensitive. It includes all event levels because related reports may be recorded as Information. It also includes other events mentioning MiTS, so check the time and message against the crash you experienced. Microsoft documents the date filters for Get-WinEvent and application crash events.

How to read the exported text report #

Open MiTS-events-....txt in Notepad. Each event appears as a separate block, ordered from oldest to newest. The fields correspond to the information shown in Event Viewer:

Text report field What it tells you
TimeCreated When the event was recorded, in the exporting computer’s local time. Find the entries near the time MiTS crashed.
Id The Event ID, such as 1000, 1001 or 1026. Read it together with ProviderName.
RecordId The entry’s record number in the Application log, useful when locating that same entry again.
ProviderName The event source, such as Application Error or .NET Runtime.
LevelDisplayName The event’s level, such as Error or Information.
Message The detailed description shown on Event Viewer’s General tab. This is the main part to read.

How to interpret the crash records #

Whether you are reading an .evtx file or the PowerShell text report, confirm that the message identifies MiTS.exe, then read the related entries around the crash time together:

Source and Event ID What to look for in General / Message
.NET Runtime — 1026 The exception type, exception message and stack trace, where provided. These describe the runtime error and the sequence of calls associated with it.
Application Error — 1000 The faulting application name and version, faulting module name, and exception code. Confirm that the faulting application is MiTS.
Windows Error Reporting — 1001 The event name and report ID, where provided. Check whether the report concerns the crash you experienced; Windows Error Reporting also records other application problems.

Not every crash produces all three records. A faulting module such as KERNELBASE.dll or ntdll.dll identifies where the failure surfaced; that name alone does not establish the underlying cause. Microsoft explains the fields in application crash records and the .NET exception details to inspect.

Send the complete .evtx file or exported text report to support@mes100.com, together with the approximate crash time and what you were doing in MiTS. Include the computer’s time zone if support is reviewing the file on another computer. Keep the nearby records together so that support can compare the application error with its related runtime and reporting events.

What are your Feelings

Powered by BetterDocs